Edit tour

Windows Analysis Report
UF7jzc7ETP.exe

Overview

General Information

Sample name:	UF7jzc7ETP.exe renamed because original name is a hash value
Original sample name:	f232220fdf23a7eb11d3a20c989fd8f4db2cbc4bff1ecdaf05ffccbb0efce49b.exe
Analysis ID:	1588211
MD5:	84271c44d2e9f203b8e21364c2c0a235
SHA1:	cfc39b474fd8d0301308fedaffb43574ba1a7f14
SHA256:	f232220fdf23a7eb11d3a20c989fd8f4db2cbc4bff1ecdaf05ffccbb0efce49b
Tags:	exeSnakeKeyloggeruser-adrian__luca
Infos:

Detection

MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

UF7jzc7ETP.exe (PID: 7344 cmdline: "C:\Users\user\Desktop\UF7jzc7ETP.exe" MD5: 84271C44D2E9F203B8E21364C2C0A235)

RegSvcs.exe (PID: 7360 cmdline: "C:\Users\user\Desktop\UF7jzc7ETP.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Configuration

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7277445290:AAGPMfh-7hOfYQqkToVnhbp-yTYEzy9NhGk", "Telegram Chatid": "5557063310"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.2945279225.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000001.00000002.2945279225.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2945279225.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.2945279225.0000000000402000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xeed7:$a1: get_encryptedPassword 0xf1ff:$a2: get_encryptedUsername 0xec72:$a3: get_timePasswordChanged 0xed93:$a4: get_passwordField 0xeeed:$a5: set_encryptedPassword 0x1084b:$a7: get_logins 0x104fc:$a8: GetOutlookPasswords 0x102ee:$a9: StartKeylogger 0x1079b:$a10: KeyLoggerEventArgs 0x1034b:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1712329342.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000000.00000002.1712329342.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1712329342.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1712329342.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf0d7:$a1: get_encryptedPassword 0xf3ff:$a2: get_encryptedUsername 0xee72:$a3: get_timePasswordChanged 0xef93:$a4: get_passwordField 0xf0ed:$a5: set_encryptedPassword 0x10a4b:$a7: get_logins 0x106fc:$a8: GetOutlookPasswords 0x104ee:$a9: StartKeylogger 0x1099b:$a10: KeyLoggerEventArgs 0x1054b:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1712329342.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1408d:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1358b:$a3: \Google\Chrome\User Data\Default\Login Data 0x13899:$a4: \Orbitum\User Data\Default\Login Data 0x14691:$a5: \Kometa\User Data\Default\Login Data
00000001.00000002.2948623327.0000000002D85000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: UF7jzc7ETP.exe PID: 7344	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: UF7jzc7ETP.exe PID: 7344	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: UF7jzc7ETP.exe PID: 7344	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: UF7jzc7ETP.exe PID: 7344	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x259cab:$a1: get_encryptedPassword 0x259fc4:$a2: get_encryptedUsername 0x259a5a:$a3: get_timePasswordChanged 0x259b7b:$a4: get_passwordField 0x259cc1:$a5: set_encryptedPassword 0x25b5c6:$a7: get_logins 0x25b277:$a8: GetOutlookPasswords 0x25b069:$a9: StartKeylogger 0x25b516:$a10: KeyLoggerEventArgs 0x25b0c6:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RegSvcs.exe PID: 7360	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 7360	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7360	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 7360	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2b8dd:$a1: get_encryptedPassword 0x2bbf6:$a2: get_encryptedUsername 0x2b68c:$a3: get_timePasswordChanged 0x2b7ad:$a4: get_passwordField 0x2b8f3:$a5: set_encryptedPassword 0x2d1f8:$a7: get_logins 0x2cea9:$a8: GetOutlookPasswords 0x2cc9b:$a9: StartKeylogger 0x2d148:$a10: KeyLoggerEventArgs 0x2ccf8:$a11: KeyLoggerEventArgsEventHandler
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.UF7jzc7ETP.exe.3de0000.1.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.UF7jzc7ETP.exe.3de0000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.UF7jzc7ETP.exe.3de0000.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.UF7jzc7ETP.exe.3de0000.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd2d7:$a1: get_encryptedPassword 0xd5ff:$a2: get_encryptedUsername 0xd072:$a3: get_timePasswordChanged 0xd193:$a4: get_passwordField 0xd2ed:$a5: set_encryptedPassword 0xec4b:$a7: get_logins 0xe8fc:$a8: GetOutlookPasswords 0xe6ee:$a9: StartKeylogger 0xeb9b:$a10: KeyLoggerEventArgs 0xe74b:$a11: KeyLoggerEventArgsEventHandler
0.2.UF7jzc7ETP.exe.3de0000.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1228d:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1178b:$a3: \Google\Chrome\User Data\Default\Login Data 0x11a99:$a4: \Orbitum\User Data\Default\Login Data 0x12891:$a5: \Kometa\User Data\Default\Login Data
0.2.UF7jzc7ETP.exe.3de0000.1.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.UF7jzc7ETP.exe.3de0000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.UF7jzc7ETP.exe.3de0000.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.UF7jzc7ETP.exe.3de0000.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf0d7:$a1: get_encryptedPassword 0xf3ff:$a2: get_encryptedUsername 0xee72:$a3: get_timePasswordChanged 0xef93:$a4: get_passwordField 0xf0ed:$a5: set_encryptedPassword 0x10a4b:$a7: get_logins 0x106fc:$a8: GetOutlookPasswords 0x104ee:$a9: StartKeylogger 0x1099b:$a10: KeyLoggerEventArgs 0x1054b:$a11: KeyLoggerEventArgsEventHandler
0.2.UF7jzc7ETP.exe.3de0000.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1408d:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1358b:$a3: \Google\Chrome\User Data\Default\Login Data 0x13899:$a4: \Orbitum\User Data\Default\Login Data 0x14691:$a5: \Kometa\User Data\Default\Login Data
1.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
1.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.RegSvcs.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf0d7:$a1: get_encryptedPassword 0xf3ff:$a2: get_encryptedUsername 0xee72:$a3: get_timePasswordChanged 0xef93:$a4: get_passwordField 0xf0ed:$a5: set_encryptedPassword 0x10a4b:$a7: get_logins 0x106fc:$a8: GetOutlookPasswords 0x104ee:$a9: StartKeylogger 0x1099b:$a10: KeyLoggerEventArgs 0x1054b:$a11: KeyLoggerEventArgsEventHandler
1.2.RegSvcs.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1408d:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1358b:$a3: \Google\Chrome\User Data\Default\Login Data 0x13899:$a4: \Orbitum\User Data\Default\Login Data 0x14691:$a5: \Kometa\User Data\Default\Login Data
Click to see the 10 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:41:44.426183+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49730	132.226.8.169	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000001.00000002.2948623327.0000000002C61000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7277445290:AAGPMfh-7hOfYQqkToVnhbp-yTYEzy9NhGk", "Telegram Chatid": "5557063310"}

Multi AV Scanner detection for submitted file

Source: UF7jzc7ETP.exe	ReversingLabs: Detection: 82%
Source: UF7jzc7ETP.exe	Virustotal: Detection: 53%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: UF7jzc7ETP.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: UF7jzc7ETP.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49731 version: TLS 1.0

Source:	Binary string: wntdll.pdbUGP source: UF7jzc7ETP.exe, 00000000.00000003.1705345550.0000000004170000.00000004.00001000.00020000.00000000.sdmp, UF7jzc7ETP.exe, 00000000.00000003.1705553948.0000000004310000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: UF7jzc7ETP.exe, 00000000.00000003.1705345550.0000000004170000.00000004.00001000.00020000.00000000.sdmp, UF7jzc7ETP.exe, 00000000.00000003.1705553948.0000000004310000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F3445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00F3445A
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F3C6D1 FindFirstFileW,FindClose,	0_2_00F3C6D1
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F3C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00F3C75C
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F3EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00F3EF95
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F3F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00F3F0F2
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F3F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00F3F3F3
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F337EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00F337EF
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F33B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00F33B12
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F3BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00F3BCBC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 01019731h	1_2_01019480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 01019E5Ah	1_2_01019A40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 01019E5Ah	1_2_01019A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 01019E5Ah	1_2_01019D87

Source: global traffic

HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49730 -> 132.226.8.169:80

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49731 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00F422EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00F422EE

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: RegSvcs.exe, 00000001.00000002.2948623327.0000000002CE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: RegSvcs.exe, 00000001.00000002.2948623327.0000000002CE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.comd
Source: RegSvcs.exe, 00000001.00000002.2948623327.0000000002CE0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2948623327.0000000002CCE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: RegSvcs.exe, 00000001.00000002.2948623327.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: RegSvcs.exe, 00000001.00000002.2948623327.0000000002CE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/d
Source: UF7jzc7ETP.exe, 00000000.00000002.1712329342.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2945279225.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: RegSvcs.exe, 00000001.00000002.2948623327.0000000002CE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgd
Source: RegSvcs.exe, 00000001.00000002.2948623327.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: RegSvcs.exe, 00000001.00000002.2948623327.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.orgd
Source: RegSvcs.exe, 00000001.00000002.2948623327.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: UF7jzc7ETP.exe, 00000000.00000002.1712329342.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2945279225.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: RegSvcs.exe, 00000001.00000002.2948623327.0000000002CE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: UF7jzc7ETP.exe, 00000000.00000002.1712329342.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2948623327.0000000002CE0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2945279225.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: RegSvcs.exe, 00000001.00000002.2948623327.0000000002CE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189d
Source: RegSvcs.exe, 00000001.00000002.2948623327.0000000002CE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189l

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00F44164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00F44164

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00F44164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00F44164

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00F43F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00F43F66

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00F3001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00F3001C

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00F5CABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00F5CABC

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.UF7jzc7ETP.exe.3de0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.UF7jzc7ETP.exe.3de0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.UF7jzc7ETP.exe.3de0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.UF7jzc7ETP.exe.3de0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000001.00000002.2945279225.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1712329342.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1712329342.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: Process Memory Space: UF7jzc7ETP.exe PID: 7344, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RegSvcs.exe PID: 7360, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00ED3B3A
Source: UF7jzc7ETP.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: UF7jzc7ETP.exe, 00000000.00000000.1696341792.0000000000F84000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_286c0a46-3
Source: UF7jzc7ETP.exe, 00000000.00000000.1696341792.0000000000F84000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_fdf750a3-d
Source: UF7jzc7ETP.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_eb28e4a0-4
Source: UF7jzc7ETP.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_9fe83595-b

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00F3A1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00F3A1EF

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00F28310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00F28310

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00F351BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00F351BD

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00EFD975	0_2_00EFD975
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00EF21C5	0_2_00EF21C5
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F062D2	0_2_00F062D2
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F503DA	0_2_00F503DA
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F0242E	0_2_00F0242E
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00EF25FA	0_2_00EF25FA
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00EE66E1	0_2_00EE66E1
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00EDE6A0	0_2_00EDE6A0
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F2E616	0_2_00F2E616
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F0878F	0_2_00F0878F
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F38889	0_2_00F38889
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F50857	0_2_00F50857
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F06844	0_2_00F06844
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00EE8808	0_2_00EE8808
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00EFCB21	0_2_00EFCB21
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F06DB6	0_2_00F06DB6
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00EE6F9E	0_2_00EE6F9E
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00EE3030	0_2_00EE3030
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00EFF1D9	0_2_00EFF1D9
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00EF3187	0_2_00EF3187
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00ED1287	0_2_00ED1287
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00EF1484	0_2_00EF1484
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00EE5520	0_2_00EE5520
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00EF7696	0_2_00EF7696
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00EE5760	0_2_00EE5760
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00EF1978	0_2_00EF1978
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F09AB5	0_2_00F09AB5
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00EDFCE0	0_2_00EDFCE0
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F57DDB	0_2_00F57DDB
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00EFBDA6	0_2_00EFBDA6
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00EF1D90	0_2_00EF1D90
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00EE3FE0	0_2_00EE3FE0
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00EDDF00	0_2_00EDDF00
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_017EC950	0_2_017EC950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0101C530	1_2_0101C530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_010127B9	1_2_010127B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01019480	1_2_01019480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0101C521	1_2_0101C521
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_01012DD1	1_2_01012DD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0101946F	1_2_0101946F

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: String function: 00EF0AE3 appears 70 times
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: String function: 00ED7DE1 appears 35 times
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: String function: 00EF8900 appears 42 times

Source: UF7jzc7ETP.exe, 00000000.00000003.1707027811.000000000443D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs UF7jzc7ETP.exe
Source: UF7jzc7ETP.exe, 00000000.00000003.1707548667.0000000004293000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs UF7jzc7ETP.exe
Source: UF7jzc7ETP.exe, 00000000.00000002.1712329342.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs UF7jzc7ETP.exe

Source: UF7jzc7ETP.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.UF7jzc7ETP.exe.3de0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.UF7jzc7ETP.exe.3de0000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.UF7jzc7ETP.exe.3de0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.UF7jzc7ETP.exe.3de0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000001.00000002.2945279225.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1712329342.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1712329342.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: UF7jzc7ETP.exe PID: 7344, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RegSvcs.exe PID: 7360, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/4@2/2

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00F3A06A GetLastError,FormatMessageW,

0_2_00F3A06A

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F281CB AdjustTokenPrivileges,CloseHandle,		0_2_00F281CB
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F287E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00F287E1

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00F3B3FB SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00F3B3FB

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00F4EE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00F4EE0D

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00F483BB CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_00F483BB

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00ED4E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00ED4E89

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

File created: C:\Users\user\AppData\Local\Temp\autECA5.tmp

Jump to behavior

Source: UF7jzc7ETP.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegSvcs.exe, 00000001.00000002.2948623327.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2948623327.0000000002D40000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2948623327.0000000002D50000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: UF7jzc7ETP.exe	ReversingLabs: Detection: 82%
Source: UF7jzc7ETP.exe	Virustotal: Detection: 53%

Source: unknown	Process created: C:\Users\user\Desktop\UF7jzc7ETP.exe "C:\Users\user\Desktop\UF7jzc7ETP.exe"
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\UF7jzc7ETP.exe"
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\UF7jzc7ETP.exe"	Jump to behavior

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: UF7jzc7ETP.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: UF7jzc7ETP.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: UF7jzc7ETP.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: UF7jzc7ETP.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: UF7jzc7ETP.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: UF7jzc7ETP.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: UF7jzc7ETP.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: UF7jzc7ETP.exe, 00000000.00000003.1705345550.0000000004170000.00000004.00001000.00020000.00000000.sdmp, UF7jzc7ETP.exe, 00000000.00000003.1705553948.0000000004310000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: UF7jzc7ETP.exe, 00000000.00000003.1705345550.0000000004170000.00000004.00001000.00020000.00000000.sdmp, UF7jzc7ETP.exe, 00000000.00000003.1705553948.0000000004310000.00000004.00001000.00020000.00000000.sdmp

Source: UF7jzc7ETP.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: UF7jzc7ETP.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: UF7jzc7ETP.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: UF7jzc7ETP.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: UF7jzc7ETP.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00ED4B37 LoadLibraryA,GetProcAddress,

0_2_00ED4B37

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F3848F push FFFFFF8Bh; iretd	0_2_00F38491
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00EFE70F push edi; ret	0_2_00EFE711
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00EFE828 push esi; ret	0_2_00EFE82A
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00EF8945 push ecx; ret	0_2_00EF8958
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00EFEAEC push edi; ret	0_2_00EFEAEE
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00EFEA03 push esi; ret	0_2_00EFEA05
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0101B3A8 push eax; iretd	1_2_0101B445

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00ED48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00ED48D7
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F55376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00F55376

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00EF3187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00EF3187

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

API/Special instruction interceptor: Address: 17EC574

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: UF7jzc7ETP.exe, 00000000.00000002.1712073367.0000000001877000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXEN
Source: UF7jzc7ETP.exe, 00000000.00000002.1711781525.0000000001788000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXERNCBU

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-105009

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

API coverage: 4.7 %

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F3445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00F3445A
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F3C6D1 FindFirstFileW,FindClose,	0_2_00F3C6D1
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F3C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00F3C75C
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F3EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00F3EF95
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F3F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00F3F0F2
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F3F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00F3F3F3
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F337EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00F337EF
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F33B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00F33B12
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F3BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00F3BCBC

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00ED49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00ED49A0

Source: RegSvcs.exe, 00000001.00000002.2945457083.0000000000D7F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

API call chain: ExitProcess graph end node

graph_0-103631

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00F43F09 BlockInput,

0_2_00F43F09

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00ED3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00ED3B3A

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00F05A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00F05A7C

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00ED4B37 LoadLibraryA,GetProcAddress,

0_2_00ED4B37

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_017EB190 mov eax, dword ptr fs:[00000030h]	0_2_017EB190
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_017EC7E0 mov eax, dword ptr fs:[00000030h]	0_2_017EC7E0
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_017EC840 mov eax, dword ptr fs:[00000030h]	0_2_017EC840

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00F280A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

0_2_00F280A9

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00EFA155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00EFA155
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00EFA124 SetUnhandledExceptionFilter,		0_2_00EFA124

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: B61008

Jump to behavior

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00F287B1 LogonUserW,

0_2_00F287B1

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00ED3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00ED3B3A

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00ED48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00ED48D7

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00F34C7F mouse_event,

0_2_00F34C7F

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\UF7jzc7ETP.exe"

Jump to behavior

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00F27CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00F27CAF

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00F2874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00F2874B

Source: UF7jzc7ETP.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: UF7jzc7ETP.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00EF862B cpuid

0_2_00EF862B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00F04E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00F04E87

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00F11E06 GetUserNameW,

0_2_00F11E06

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00F03F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00F03F3A

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe

Code function: 0_2_00ED49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00ED49A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: UF7jzc7ETP.exe, 00000000.00000002.1712073367.0000000001877000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: mcupdate.exe

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 0.2.UF7jzc7ETP.exe.3de0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UF7jzc7ETP.exe.3de0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2945279225.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1712329342.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UF7jzc7ETP.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7360, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.UF7jzc7ETP.exe.3de0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UF7jzc7ETP.exe.3de0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2945279225.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1712329342.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UF7jzc7ETP.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7360, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: UF7jzc7ETP.exe	Binary or memory string: WIN_81
Source: UF7jzc7ETP.exe	Binary or memory string: WIN_XP
Source: UF7jzc7ETP.exe	Binary or memory string: WIN_XPe
Source: UF7jzc7ETP.exe	Binary or memory string: WIN_VISTA
Source: UF7jzc7ETP.exe	Binary or memory string: WIN_7
Source: UF7jzc7ETP.exe	Binary or memory string: WIN_8
Source: UF7jzc7ETP.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 0.2.UF7jzc7ETP.exe.3de0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UF7jzc7ETP.exe.3de0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2945279225.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1712329342.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2948623327.0000000002D85000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UF7jzc7ETP.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7360, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 0.2.UF7jzc7ETP.exe.3de0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UF7jzc7ETP.exe.3de0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2945279225.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1712329342.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UF7jzc7ETP.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7360, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.UF7jzc7ETP.exe.3de0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UF7jzc7ETP.exe.3de0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2945279225.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1712329342.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UF7jzc7ETP.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7360, type: MEMORYSTR

Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F46283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00F46283
Source: C:\Users\user\Desktop\UF7jzc7ETP.exe	Code function: 0_2_00F46747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00F46747

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	3 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	127 System Information Discovery	Distributed Component Object Model	21 Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	241 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Access Token Manipulation	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	212 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
UF7jzc7ETP.exe	83%	ReversingLabs	Win32.Trojan.AutoitInject
UF7jzc7ETP.exe	54%	Virustotal		Browse
UF7jzc7ETP.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.48.1	true	false	high
checkip.dyndns.com	132.226.8.169	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false		high
https://reallyfreegeoip.org/xml/8.46.123.189	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189l	RegSvcs.exe, 00000001.00000002.2948623327.0000000002CE0000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.comd	RegSvcs.exe, 00000001.00000002.2948623327.0000000002CE0000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	UF7jzc7ETP.exe, 00000000.00000002.1712329342.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2945279225.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	high
http://reallyfreegeoip.orgd	RegSvcs.exe, 00000001.00000002.2948623327.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189d	RegSvcs.exe, 00000001.00000002.2948623327.0000000002CE0000.00000004.00000800.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	RegSvcs.exe, 00000001.00000002.2948623327.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.orgd	RegSvcs.exe, 00000001.00000002.2948623327.0000000002CE0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	RegSvcs.exe, 00000001.00000002.2948623327.0000000002CE0000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	RegSvcs.exe, 00000001.00000002.2948623327.0000000002CE0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2948623327.0000000002CCE000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	RegSvcs.exe, 00000001.00000002.2948623327.0000000002CE0000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/d	RegSvcs.exe, 00000001.00000002.2948623327.0000000002CE0000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000001.00000002.2948623327.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot-/sendDocument?chat_id=	UF7jzc7ETP.exe, 00000000.00000002.1712329342.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2945279225.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	UF7jzc7ETP.exe, 00000000.00000002.1712329342.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2948623327.0000000002CE0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2945279225.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
132.226.8.169	checkip.dyndns.com	United States		16989	UTMEMUS	false
104.21.48.1	reallyfreegeoip.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588211
Start date and time:	2025-01-10 22:40:47 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	UF7jzc7ETP.exe renamed because original name is a hash value
Original Sample Name:	f232220fdf23a7eb11d3a20c989fd8f4db2cbc4bff1ecdaf05ffccbb0efce49b.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/4@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 59 Number of non-executed functions: 274
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target RegSvcs.exe, PID 7360 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
132.226.8.169	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	FylY1FW6fl.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	xom6WSISuh.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	3WgNXsWvMO.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	b5JCISnBV1.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
104.21.48.1	NWPZbNcRxL.exe	Get hash	malicious	FormBook	Browse	www.axis138ae.shop/j2vs/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	twirpx.org/administrator/index.php
	SN500, SN150 Spec.exe	Get hash	malicious	FormBook	Browse	www.antipromil.site/7ykh/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	VQsnGWaNi5.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.80.1
	JgE2YgxSzB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	lsc5QN46NH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	upXUt2jZ0S.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.16.1
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
checkip.dyndns.com	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	VQsnGWaNi5.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	JgE2YgxSzB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	lsc5QN46NH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	upXUt2jZ0S.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	VQsnGWaNi5.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.80.1
	http://@1800-web.com/new/auth/6XEcGVvsnjwXq8bbJloqbuPkeuHjc6rLcgYUe/bGVvbi5ncmF2ZXNAYXRvcy5uZXQ=	Get hash	malicious	Unknown	Browse	104.17.25.14
	JgE2YgxSzB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	87J30ulb4q.exe	Get hash	malicious	Unknown	Browse	104.21.96.1
	lsc5QN46NH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.32.1
	https://services221.com/mm/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://atpscan.global.hornetsecurity.com/?d=W3rdHn1Og9hhUJnVJzqWF36wMmxswAZldvtx3E21ybg&f=v8m9AqGfgV2Ri7cjqmfsuyl2V2Mu_lVW0BRsqcFw4upagWAQ1C-MqANvN6gf4zNV&i=&k=xREg&m=b_ORYMkPffImCXbCPli-aiR7Ga6rGe55sar2xtigCL4MrowDPSzt7ABKETTGxzegakAfoZ57KD02aVix8V8TVmZ2VcxzjeybXYrPiS2SB73LCKYktj5jv2aw6VcPRslz&n=s4crRkyHC4bab6S3yrgn1E3n-VmdqgfSqNiaCJyPrf6hnyL_SE4PHEo5SUcwwsFGV6rnB35iQFM5FLsE91obvZ0HTAEiqHnB8ROLzY5JVgg&r=oMs_cp4DXIjeQhcPWsPLyR3_oxBVUN4Iok_tSVE4DNNtzqeot7ZzvdXkh4vatwpC&s=bd82eb507a358fd35f72f18b86e67f3bfc1ce64bbeab0c01d700897b1b678efb&u=https%3A%2F%2Fe.trustifi.com%2F%23%2Ffff2af%2F32054d%2F67960f%2Fee6fed%2F5d1d11%2F46c760%2Ff79190%2Fc5ec40%2Fe8666a%2Fef542d%2F85972d%2F627493%2F9a11d6%2F1f4096%2F1d247f%2F818e78%2Fc53383%2Fd59aa0%2Fedfa57%2F7914c7%2Fc38cf6%2Ff74f56%2Ff45915%2F39dbbd%2Ff48710%2F1ddf22%2F37d5f2%2F9de9f7%2F96109e%2F882355%2F854b66%2F9d606d%2F2d0447%2Fad3b01%2F637d1c%2F3c0f2b%2F606f48%2Fa6d904%2F8fefe3%2F00a4bb%2F6520c6%2F9b795c%2Fb7de1a%2Fb5dde6%2F3f5692%2F997c7d%2Fc00925%2F782cce%2F511459%2Fab5aa8%2F91722a%2Feec933%2F3f4f91%2F894088%2F43adfa%2Fb78195%2F0407d0%2F56f022%2Fddf20e%2F946567%2Faa271a%2F507b7a%2Faccd06%2F50d63c%2F485c4b%2F07ced8%2Fd0ec21%2F260ce6%2Fb5edbb%2F79a81e%2F1fd160%2Ff4da41%2F7073e0%2F8a5e9a%2Fdac829%2F521e52%2Fa1a847%2F13ea63%2Fabb5a3%2Fe1901e%2Fd876f6%2F7b0bf4%2Fbd19df%2F89bdcd%2F1874d8%2F0fb7f3%2F72f438%2Fa098c5%2F4e2214%2F4b6e54%2F0c4a8f	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
UTMEMUS	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	JgE2YgxSzB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169
	upXUt2jZ0S.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	oEQp0EklDb.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	FylY1FW6fl.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	v4nrZtP7K2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.8.169

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	9Yn5tjyOgT.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	VQsnGWaNi5.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	JgE2YgxSzB.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	lsc5QN46NH.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	V7OHj6ISEo.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	upXUt2jZ0S.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	2CQ2zMn0hb.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	6mGpn6kupm.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.48.1
	SABXJ1B5c8.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1

Process:	C:\Users\user\Desktop\UF7jzc7ETP.exe
File Type:	data
Category:	dropped
Size (bytes):	61330
Entropy (8bit):	7.869465492012193
Encrypted:	false
SSDEEP:	1536:7nfrenrjMEoxHAwBXlrBb+SkENxEndkRqgGtYZ37mDPgaf6AP:Tfa/MEitVlrBb+SfEniRqgH3uZf
MD5:	64A2E0190B63F961A3C4CF7C27B1C52A
SHA1:	FFBB86CE84B4D5F38A907F5A046CD3D9E120B4AC
SHA-256:	A66985ED039BE91D09A4D68790AD03DBDAA425641A708F07E4D89DE6C8F5D078
SHA-512:	6344F8660782F95300D8B172A7B6A2A285C401C0EFDD548AD1DAE037DD9BB380428FECD4DAB7295426885380AFB9E1446DFC94842F4E417590B275BA68060288
Malicious:	false
Reputation:	low
Preview:	EA06..l...5...J.I.R....6.X.Rh59..qQ......B.2..+......\|[`.BoM.Q....r..E2....1.His...'.L.....Yi....l.3;.Zn.X=.I]..n.Jef$....>.Q...L....d.B.V.P.pz.bW@..@...r...LH.....+.Fsr..).J.4.33...j......&..RsR.Rf...F.X.V@21)....m@..@........x\|..F......}.....S....q.(..{$......I.Z....Z.X..(\|6..^qv..5P.C.W..=@....@....>.L...N...qQ..Zd.....\|...O....PW..BwR..i.z.Fs...+`....8..s.JN ...........Z..........R..+....Q.....f+...B&.(U......7..$...H.P......B..(M......e..:.2.....-B.V.7.T.#J.V.3:.b.:.....NsR.N.`....Q...5P.F.(.....n.5.K..~M...)3.M6.I..#.I.N#k.RgT....Sv..Os[. ,.).ReW.\!t...m1..j.J..P......b.K..'....o....-&eS..,v9l..8..V.]:..PFj.+..S.Q.u..R.+.N;..M..7..h5X..qQ.....2.{..5j.&.Q........0.A.}..$...Z1U.=..0.T....^.s...Sj.._?.Q)3i..I.\...M.......+v.ab...Q@...u..j.K...T..cQ..b.A..x...,...~3.J.c....FsX.R.s{.F.6..$.:.Neh.Tgr.E&aN.Mi3...a.......l.L)U...".P8 ....R.m..F.0.Ic@...E....=....I............d^.0.J`.%.j.4....,....L)U[.gN.HXr.7.....buJ."/N.q91...OK..@i.P..6..

C:\Users\user\AppData\Local\Temp\autECD5.tmp

Download File

Process:	C:\Users\user\Desktop\UF7jzc7ETP.exe
File Type:	data
Category:	dropped
Size (bytes):	14604
Entropy (8bit):	7.625423479113949
Encrypted:	false
SSDEEP:	384:ITYznw6siKOPIyznfvWME9lMYIWy7HKNr:IAw6si7nfvWL8m
MD5:	94E38DAB49785FF2CC4FAFE9D444D6B4
SHA1:	535F1CA4DCC1F03B79F5CFFD3CB72D2074238410
SHA-256:	23977A8B2374B54EF05B8F83BFED14A508354D0C9A8CF096B3CC1047CBDF0DDF
SHA-512:	E4DEBDB5D7943325F33F244B50C4DA605105243B8D2901DB6CDD103D16FBD8F59376B52801BEC9EF1F7B8B0DE12568EFC79637178FD7715F132A37BD462ECE9D
Malicious:	false
Reputation:	low
Preview:	EA06..0..[.....+x..f....... .V......71...@.x..L........`......8............`.......Z\|3@...@.........K.X@0.2.Z..Z>)..w.e....l !..m..;...\| !.....;....;.....l.;.0./.<.;...m..rd.....@->.....4....f.C.5..;.............r.....X.<>`.O..p.........!.........h.=..........<\|3.....c...h.. -...... ...X.Z?......(...(.G..4.h....x....M@N.......Z?.I.......N@R... ...5.(..,.._...k`........R...._.K..?d...B.... 7W.......n.../.~.....)...@...!K....h\|!._....ga._.5.1.....`v/.......NA...,...7.7.,..!6.b...Z?.K(-...0.h..&.._....' -.............-..........G.6.....d_.T......"....d_.(M..57....n.....`...L....K.L..6.s.A.?..L.......Bg>...w.36.... !...L...}....\|V.4..r......$............r..9....>.....2... ...b....`......k.(.....!`....,......V1`..f....X.>i.v'.3c.........G.4....E.?......9..X.......7...l.`..."...\.61*........f.....\|.`.O.......,`........nl,....C.`....p...Y......`....@n?..;g....0...d...l ...P.?'....}...........0...4.X...>y.....1......x...L.\.i.....)...@n?............b...@.>y...

C:\Users\user\AppData\Local\Temp\quinquenniad

Download File

Process:	C:\Users\user\Desktop\UF7jzc7ETP.exe
File Type:	data
Category:	dropped
Size (bytes):	93184
Entropy (8bit):	6.845898413962198
Encrypted:	false
SSDEEP:	1536:4Vc1E0rCKZA8D4154uV9UwLxWzEGN1UXd4pNYwhVkidZLXM7FII61KfK48H7ewZe:N1341wAzGFZwEj/9lvu
MD5:	148E15087BBE2023648303A7F8E301CC
SHA1:	CE961FA056E006B98A1B55E07F4B2D16E55C1B3F
SHA-256:	FFBF464B66A5A6AD6F184B82C853588652941F7E0C53096242EA1FC6C23DBBC1
SHA-512:	DE5F11F5F319952652E31A773F236E9AB8B71EBFFE28AF16B03CE71BF4369BF7371BF774D8B294279F9C105DB503501BC9915F07107E83C8A3ACAD09297106ED
Malicious:	false
Reputation:	low
Preview:	{..Q:RDI4JTQ..WX.IAS6B8QyRDI0JTQI2WXXIAS6B8Q9RDI0JTQI2WXXIAS.B8Q7M.G0.].h.V..h.;_1.!K=#;Q't2(\97,i#6.0M?.;it..q$]3=vDLY.B8Q9RDI`.TQ.3TX.'..6B8Q9RDI.JVPB3.XX+@S6J8Q9RDI..UQI.WXX.@S6BxQ9rDI0HTQM2WXXIAS0B8Q9RDI0.UQI0WXXIAS4BX.9RTI0ZTQI2GXXYAS6B8Q)RDI0JTQI2WX.6@SyB8Q9.EI.OTQI2WXXIAS6B8Q9RDI0.UQE2WXXIAS6B8Q9RDI0JTQI2WXXIAS6B8Q9RDI0JTQI2WXXIAS6B8Q9rDI8JTQI2WXXIAS>b8QqRDI0JTQI2WXv=$+BB8Q}2EI0jTQIPVXXKAS6B8Q9RDI0JTQi2W8v;2!UB8Q.WDI0.UQI4WXX-@S6B8Q9RDI0JTQ.2W.v;$?Y!8Q5RDI0.UQI0WXX#@S6B8Q9RDI0JTQ.2W.XIAS6B8Q9RDI0JTQi.VXXIAS~B8Q;RAIL.TQ9.WX[IASlB8W..DI.JTQI2WXXIAS6B8Q9RDI0JTQI2WXXIAS6B8Q9RDI0JTQ.O.W...:E..Q9RDI0KVRM4_PXIAS6B8QGRDIvJTQ.2WXoIAS.B8QTRDI.JTQ72WX&IASRB8QKRDIQJTQ.2WX7IASXB8QGRDI.H\|NI2]r~IC{.B8[9x.:.JT[.3WX\:cS6H.S9R@:.JT[.1WX\:eS6H.U9R@:.JT[.7WX\c.S5..W9R_&.JT[I1.M^IAH.d8S.kDI:J~wI1.M^IAH.`8S.[DI4`."T2W^p.AS<61Q9P.C0JP{W0..XIKy.<+Q9VoI.hEI2SsXcc-#B8U.RnkN\TQM.Wrz7VS6F.Q.Tn+08.]IBT79IAU..8Q3z.I0LT{s2)VXIEQY.8Q3tns0b.QI4Wp.IAU6h.QGaDI4fS/z2W\s_?b6B<.?*DI69.QI8r.kIAW..8Q3Rn.0b.QI4Wp.IAU

C:\Users\user\AppData\Local\Temp\subpredication

Download File

Process:	C:\Users\user\Desktop\UF7jzc7ETP.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	143378
Entropy (8bit):	2.993257378900886
Encrypted:	false
SSDEEP:	96:AIXLr44+F05BDKoPH70FlkvjA6/c8vGcu29IwyJuv35rWVjjYqnBaAJZdjureb3T:H3Ljwk6wGcu29IwyJuv35rWVgqnBaA
MD5:	CDDED546A8CE05B0FB40E59661D1B353
SHA1:	32B42112FC93507FD9B01CF233911C0EF44B76ED
SHA-256:	3B5E8D7932DDB8359078B3C51D60C2ABCC6CF981867398D4F9B9FF1DA7E04728
SHA-512:	35B812AF354DE5C0C3E96883D3EBAEEAAB6B07CDB1E66DA87F93A712C64D3EEC419F440C0E951F938F2F6637412E6807700F9CAEF6C89B67D390DA2CA682EA44
Malicious:	false
Reputation:	low
Preview:	dowp0dowpxdowp5dowp5dowp8dowpbdowpedowpcdowp8dowp1dowpedowpcdowpcdowpcdowp0dowp2dowp0dowp0dowp0dowp0dowp5dowp6dowp5dowp7dowpbdowp8dowp6dowpbdowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp4dowp5dowp8dowp4dowpbdowp9dowp6dowp5dowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp4dowpddowp8dowp6dowpbdowpadowp7dowp2dowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp5dowp5dowp8dowp8dowpbdowp8dowp6dowpedowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp4dowp5dowp8dowpadowpbdowp9dowp6dowp5dowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp4dowpddowp8dowpcdowpbdowpadowp6dowpcdowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp5dowp5dowp8dowpedowpbdowp8dowp3dowp3dowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp4dowp5dowp9dowp0dowpbdowp9dowp3dowp2dowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp4dowpddowp9dowp2dowpbdowpadowp2dowpedowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp5dowp5dowp9dowp4dowpbdowp8dowp6dowp4dowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.853828482825834
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	UF7jzc7ETP.exe
File size:	969'216 bytes
MD5:	84271c44d2e9f203b8e21364c2c0a235
SHA1:	cfc39b474fd8d0301308fedaffb43574ba1a7f14
SHA256:	f232220fdf23a7eb11d3a20c989fd8f4db2cbc4bff1ecdaf05ffccbb0efce49b
SHA512:	0434d6457c21fdfac19e8500644761f35721e147569394677fc66fa1d933a752b38db839c4ab09fcb6e87b8624d85d68e56dd9f384efd0157254c3a8ec8105d0
SSDEEP:	24576:Ku6J33O0c+JY5UZ+XC0kGso6FaJc7N2a0nWY:8u0c++OCvkGs9FaJG2azY
TLSH:	4625AE2273DDC360CB669173BF6AB7016EBF3C610630B95B2F980D7DA950162162D7A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x427dcd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6757BF40 [Tue Dec 10 04:10:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007FD7ED2984FAh
jmp 00007FD7ED28B2C4h
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FD7ED28B44Ah
cmp edi, eax
jc 00007FD7ED28B7AEh
bt dword ptr [004C31FCh], 01h
jnc 00007FD7ED28B449h
rep movsb
jmp 00007FD7ED28B75Ch
cmp ecx, 00000080h
jc 00007FD7ED28B614h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FD7ED28B450h
bt dword ptr [004BE324h], 01h
jc 00007FD7ED28B920h
bt dword ptr [004C31FCh], 00000000h
jnc 00007FD7ED28B5EDh
test edi, 00000003h
jne 00007FD7ED28B5FEh
test esi, 00000003h
jne 00007FD7ED28B5DDh
bt edi, 02h
jnc 00007FD7ED28B44Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FD7ED28B453h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FD7ED28B4A5h
bt esi, 03h
jnc 00007FD7ED28B4F8h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x240b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xec000	0x711c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dcc4	0x8de00	d28a820a1d9ff26cda02d12b888ba4b4	False	0.5728679102422908	data	6.676118058520316	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	79b14b254506b0dbc8cd0ad67fb70ad9	False	0.33535526761517614	OpenPGP Public Key	5.76010872795207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	9f9d6f746f1a415a63de45f8b7983d33	False	0.1017530487804878	data	1.198745897703538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0x240b0	0x24200	a6e5c170458924e9e20a577e7a675884	False	0.8168049848615917	data	7.590696093482988	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xec000	0x711c	0x7200	6fcae3cbbf6bfbabf5ec5bbe7cf612c3	False	0.7650767543859649	data	6.779031650454199	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc75a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc76d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc77f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc7920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc7c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc7d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc8bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc9480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc99e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xcbf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xcd038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xcd4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xcd4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcda84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xce110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xce5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xceb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcf1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcf660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcf7b8	0x1b378	data			1.000367778973807
RT_GROUP_ICON	0xeab30	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xeaba8	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xeabbc	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xeabd0	0x14	data	English	Great Britain	1.25
RT_VERSION	0xeabe4	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xeacc0	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T22:41:44.426183+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49730	132.226.8.169	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:41:43.212487936 CET	49730	80	192.168.2.4	132.226.8.169
Jan 10, 2025 22:41:43.217457056 CET	80	49730	132.226.8.169	192.168.2.4
Jan 10, 2025 22:41:43.217708111 CET	49730	80	192.168.2.4	132.226.8.169
Jan 10, 2025 22:41:43.218023062 CET	49730	80	192.168.2.4	132.226.8.169
Jan 10, 2025 22:41:43.222841024 CET	80	49730	132.226.8.169	192.168.2.4
Jan 10, 2025 22:41:44.062942982 CET	80	49730	132.226.8.169	192.168.2.4
Jan 10, 2025 22:41:44.083390951 CET	49730	80	192.168.2.4	132.226.8.169
Jan 10, 2025 22:41:44.088211060 CET	80	49730	132.226.8.169	192.168.2.4
Jan 10, 2025 22:41:44.383567095 CET	80	49730	132.226.8.169	192.168.2.4
Jan 10, 2025 22:41:44.392978907 CET	49731	443	192.168.2.4	104.21.48.1
Jan 10, 2025 22:41:44.393038034 CET	443	49731	104.21.48.1	192.168.2.4
Jan 10, 2025 22:41:44.393131971 CET	49731	443	192.168.2.4	104.21.48.1
Jan 10, 2025 22:41:44.404597044 CET	49731	443	192.168.2.4	104.21.48.1
Jan 10, 2025 22:41:44.404634953 CET	443	49731	104.21.48.1	192.168.2.4
Jan 10, 2025 22:41:44.426182985 CET	49730	80	192.168.2.4	132.226.8.169
Jan 10, 2025 22:41:44.891807079 CET	443	49731	104.21.48.1	192.168.2.4
Jan 10, 2025 22:41:44.892108917 CET	49731	443	192.168.2.4	104.21.48.1
Jan 10, 2025 22:41:44.897555113 CET	49731	443	192.168.2.4	104.21.48.1
Jan 10, 2025 22:41:44.897581100 CET	443	49731	104.21.48.1	192.168.2.4
Jan 10, 2025 22:41:44.898046970 CET	443	49731	104.21.48.1	192.168.2.4
Jan 10, 2025 22:41:44.941929102 CET	49731	443	192.168.2.4	104.21.48.1
Jan 10, 2025 22:41:44.952514887 CET	49731	443	192.168.2.4	104.21.48.1
Jan 10, 2025 22:41:44.995340109 CET	443	49731	104.21.48.1	192.168.2.4
Jan 10, 2025 22:41:45.069464922 CET	443	49731	104.21.48.1	192.168.2.4
Jan 10, 2025 22:41:45.069611073 CET	443	49731	104.21.48.1	192.168.2.4
Jan 10, 2025 22:41:45.069684029 CET	49731	443	192.168.2.4	104.21.48.1
Jan 10, 2025 22:41:45.075757980 CET	49731	443	192.168.2.4	104.21.48.1
Jan 10, 2025 22:42:49.382963896 CET	80	49730	132.226.8.169	192.168.2.4
Jan 10, 2025 22:42:49.383225918 CET	49730	80	192.168.2.4	132.226.8.169
Jan 10, 2025 22:43:24.397562027 CET	49730	80	192.168.2.4	132.226.8.169
Jan 10, 2025 22:43:24.402407885 CET	80	49730	132.226.8.169	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:41:43.164236069 CET	50426	53	192.168.2.4	1.1.1.1
Jan 10, 2025 22:41:43.171276093 CET	53	50426	1.1.1.1	192.168.2.4
Jan 10, 2025 22:41:44.385262012 CET	63336	53	192.168.2.4	1.1.1.1
Jan 10, 2025 22:41:44.392345905 CET	53	63336	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 22:41:43.164236069 CET	192.168.2.4	1.1.1.1	0xda22	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:41:44.385262012 CET	192.168.2.4	1.1.1.1	0x257	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:41:43.171276093 CET	1.1.1.1	192.168.2.4	0xda22	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:41:43.171276093 CET	1.1.1.1	192.168.2.4	0xda22	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:41:43.171276093 CET	1.1.1.1	192.168.2.4	0xda22	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:41:43.171276093 CET	1.1.1.1	192.168.2.4	0xda22	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:41:43.171276093 CET	1.1.1.1	192.168.2.4	0xda22	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:41:43.171276093 CET	1.1.1.1	192.168.2.4	0xda22	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:41:44.392345905 CET	1.1.1.1	192.168.2.4	0x257	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:41:44.392345905 CET	1.1.1.1	192.168.2.4	0x257	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:41:44.392345905 CET	1.1.1.1	192.168.2.4	0x257	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:41:44.392345905 CET	1.1.1.1	192.168.2.4	0x257	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:41:44.392345905 CET	1.1.1.1	192.168.2.4	0x257	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:41:44.392345905 CET	1.1.1.1	192.168.2.4	0x257	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:41:44.392345905 CET	1.1.1.1	192.168.2.4	0x257	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	132.226.8.169	80	7360	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:41:43.218023062 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 22:41:44.062942982 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:41:43 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 22:41:44.083390951 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 22:41:44.383567095 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:41:44 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	104.21.48.1	443	7360	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 21:41:44 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-10 21:41:45 UTC	859	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 21:41:45 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1860094 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lBKJnpwLhluKwVqdjVn7vw1aVanAP%2Ba1FaC89dHaitwQjvGTHzGolqWLTcNd%2BQUNvXO1I%2FmKHkVcL%2F8kJ5iYPikEiOA2L0zx%2FHMyEKnbxuKkuRt2rsWhG0yoL8dnPq6NOlEkkU2M"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fffd53c4e3c42e9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1756&min_rtt=1755&rtt_var=661&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1651583&cwnd=240&unsent_bytes=0&cid=fc1edd86fc058a3d&ts=193&x=0"
2025-01-10 21:41:45 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Target ID:	0
Start time:	16:41:41
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\UF7jzc7ETP.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\UF7jzc7ETP.exe"
Imagebase:	0xed0000
File size:	969'216 bytes
MD5 hash:	84271C44D2E9F203B8E21364C2C0A235
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000000.00000002.1712329342.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1712329342.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1712329342.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1712329342.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000000.00000002.1712329342.0000000003DE0000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:41:42
Start date:	10/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\UF7jzc7ETP.exe"
Imagebase:	0x8f0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000001.00000002.2945279225.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2945279225.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000002.2945279225.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000001.00000002.2945279225.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2948623327.0000000002D85000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	1.4%
Signature Coverage:	5.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	166

Executed Functions

Function 00ED3B3A Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00ED3B68
IsDebuggerPresent.KERNEL32 ref: 00ED3B7A
GetFullPathNameW.KERNEL32(00007FFF,?,?,00F952F8,00F952E0,?,?), ref: 00ED3BEB

Part of subcall function 00ED7BCC: _memmove.LIBCMT ref: 00ED7C06

Part of subcall function 00EE092D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00ED3C14,00F952F8,?,?,?), ref: 00EE096E

SetCurrentDirectoryW.KERNEL32(?), ref: 00ED3C6F
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00F87770,00000010), ref: 00F0D281
SetCurrentDirectoryW.KERNEL32(?,00F952F8,?,?,?), ref: 00F0D2B9
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00F84260,00F952F8,?,?,?), ref: 00F0D33F
ShellExecuteW.SHELL32(00000000,?,?), ref: 00F0D346

Part of subcall function 00ED3A46: GetSysColorBrush.USER32(0000000F), ref: 00ED3A50
Part of subcall function 00ED3A46: LoadCursorW.USER32(00000000,00007F00), ref: 00ED3A5F
Part of subcall function 00ED3A46: LoadIconW.USER32(00000063), ref: 00ED3A76
Part of subcall function 00ED3A46: LoadIconW.USER32(000000A4), ref: 00ED3A88
Part of subcall function 00ED3A46: LoadIconW.USER32(000000A2), ref: 00ED3A9A
Part of subcall function 00ED3A46: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00ED3AC0
Part of subcall function 00ED3A46: RegisterClassExW.USER32(?), ref: 00ED3B16

Part of subcall function 00ED39D5: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00ED3A03
Part of subcall function 00ED39D5: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00ED3A24
Part of subcall function 00ED39D5: ShowWindow.USER32(00000000,?,?), ref: 00ED3A38
Part of subcall function 00ED39D5: ShowWindow.USER32(00000000,?,?), ref: 00ED3A41

Part of subcall function 00ED434A: _memset.LIBCMT ref: 00ED4370
Part of subcall function 00ED434A: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00ED4415

Strings

runas, xrefs: 00F0D33A
This is a third-party compiled AutoIt script., xrefs: 00F0D279

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-3287110873
Opcode ID: 80be15f2fbd3888349bc61a9868ca5c48a2ecead757955ddc39d1a071c98032b
Instruction ID: 2b5758d55811e46b5416571133f75483a7cf871cac6aa687bfb6b5499229e39d
Opcode Fuzzy Hash: 80be15f2fbd3888349bc61a9868ca5c48a2ecead757955ddc39d1a071c98032b
Instruction Fuzzy Hash: 46510870D0824CAEDF12EBB4DC05EEDBBB4EB45750F005067F551B22A2DA709606FB22

Function 00ED49A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00ED49CD

Part of subcall function 00ED7BCC: _memmove.LIBCMT ref: 00ED7C06

GetCurrentProcess.KERNEL32(?,00F5FAEC,00000000,00000000,?), ref: 00ED4A9A
IsWow64Process.KERNEL32(00000000), ref: 00ED4AA1
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00ED4AE7
FreeLibrary.KERNEL32(00000000), ref: 00ED4AF2
GetSystemInfo.KERNEL32(00000000), ref: 00ED4B23
GetSystemInfo.KERNEL32(00000000), ref: 00ED4B2F

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 6ef1fdffbd5118812aa9c90c3f9971e2ff3d3e863a3f13b607a1701a3e8e311d
Instruction ID: ecc98092b43bb02f533ce0403c167a3addf03800b99bc013aa9e9e77cc26d930
Opcode Fuzzy Hash: 6ef1fdffbd5118812aa9c90c3f9971e2ff3d3e863a3f13b607a1701a3e8e311d
Instruction Fuzzy Hash: 1A91C3719897C4DFC731DB6885501AABFF5AF3A300B4859AFD0C7A3B81E230A509E759

Function 00ED4E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00ED4D8E,?,?,00000000,00000000), ref: 00ED4E99
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00ED4D8E,?,?,00000000,00000000), ref: 00ED4EB0
LoadResource.KERNEL32(?,00000000,?,?,00ED4D8E,?,?,00000000,00000000,?,?,?,?,?,?,00ED4E2F), ref: 00F0D937
SizeofResource.KERNEL32(?,00000000,?,?,00ED4D8E,?,?,00000000,00000000,?,?,?,?,?,?,00ED4E2F), ref: 00F0D94C
LockResource.KERNEL32(00ED4D8E,?,?,00ED4D8E,?,?,00000000,00000000,?,?,?,?,?,?,00ED4E2F,00000000), ref: 00F0D95F

Strings

SCRIPT, xrefs: 00ED4EA6

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: bf246876096f3a595cb635bc322313061b6569d81261b17f8ae7d36a6a7bea91
Instruction ID: 568ee854ab60a10dc987e4c06a6dab963d8f0cc152c17f925db2558d9163754d
Opcode Fuzzy Hash: bf246876096f3a595cb635bc322313061b6569d81261b17f8ae7d36a6a7bea91
Instruction Fuzzy Hash: 7911A0B4200704BFD7208B65EC48F677BBAFBC5B12F2042ADF905DA290DB72EC059661

Function 00F3445A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00F0E398), ref: 00F3446A
FindFirstFileW.KERNELBASE(?,?), ref: 00F3447B
FindClose.KERNEL32(00000000), ref: 00F3448B

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 3cf411d1edd4194d962647e4af14c6aacefb3077df62339913a64ddef706e4d8
Instruction ID: 659d93d385d72bb2a59e247afa32e2f972ce8e4d2dac07d57616a8ad631609c6
Opcode Fuzzy Hash: 3cf411d1edd4194d962647e4af14c6aacefb3077df62339913a64ddef706e4d8
Instruction Fuzzy Hash: 74E0D873810604A75210AB38EC0D4E97B5C9F05336F100765FE35C20E0E7747904B696

Function 00EE09D0 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00EE0A5B
timeGetTime.WINMM ref: 00EE0D16
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00EE0E53
Sleep.KERNEL32(0000000A), ref: 00EE0E61
LockWindowUpdate.USER32(00000000,?,?), ref: 00EE0EFA
DestroyWindow.USER32 ref: 00EE0F06
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00EE0F20
Sleep.KERNEL32(0000000A,?,?), ref: 00F14E83
TranslateMessage.USER32(?), ref: 00F15C60
DispatchMessageW.USER32(?), ref: 00F15C6E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00F15C82

Strings

@GUI_CTRLID, xrefs: 00F14F3A
@COM_EVENTOBJ, xrefs: 00F154F0
@TRAY_ID, xrefs: 00F1578F
@GUI_CTRLHANDLE, xrefs: 00F14FE4
@GUI_WINHANDLE, xrefs: 00F14F8F

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Message$PeekSleepWindow$DestroyDispatchLockTimeTranslateUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4212290369-3242690629
Opcode ID: 995cbf1e31119003f0568009e81ff54c821a3545a78e93af35e85e019fb2d96a
Instruction ID: c8d579e25d5ea360e30eafef08f32f7c35b8b9662d2797098e92dfd9b48b5dfa
Opcode Fuzzy Hash: 995cbf1e31119003f0568009e81ff54c821a3545a78e93af35e85e019fb2d96a
Instruction Fuzzy Hash: 2FB21470608785DFDB24DF24C884BAAB7E0FF84714F14491EE599A72A1C770E8C5EB82

Function 00F39155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F38F5F: __time64.LIBCMT ref: 00F38F69

Part of subcall function 00ED4EE5: _fseek.LIBCMT ref: 00ED4EFD

__wsplitpath.LIBCMT ref: 00F39234

Part of subcall function 00EF40FB: __wsplitpath_helper.LIBCMT ref: 00EF413B

_wcscpy.LIBCMT ref: 00F39247
_wcscat.LIBCMT ref: 00F3925A
__wsplitpath.LIBCMT ref: 00F3927F
_wcscat.LIBCMT ref: 00F39295
_wcscat.LIBCMT ref: 00F392A8

Part of subcall function 00F38FA5: _memmove.LIBCMT ref: 00F38FDE
Part of subcall function 00F38FA5: _memmove.LIBCMT ref: 00F38FED

_wcscmp.LIBCMT ref: 00F391EF

Part of subcall function 00F39734: _wcscmp.LIBCMT ref: 00F39824
Part of subcall function 00F39734: _wcscmp.LIBCMT ref: 00F39837

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00F39452
_wcsncpy.LIBCMT ref: 00F394C5
DeleteFileW.KERNEL32(?,?), ref: 00F394FB
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00F39511
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00F39522
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00F39534

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 351723bb52757ed866eac33b266d3d274d80a5a93194ff648f79321a414e30a5
Instruction ID: 69c4382914032e12bc90243c346b0ed38482d19182018b7e15f5a603257387ac
Opcode Fuzzy Hash: 351723bb52757ed866eac33b266d3d274d80a5a93194ff648f79321a414e30a5
Instruction Fuzzy Hash: 67C14CB1D04219ABDF21DFA4CC85EEEB7BCEF55310F0040AAF609E6251DB709A859F61

Function 00ED3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00ED3074
RegisterClassExW.USER32(00000030), ref: 00ED309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00ED30AF
InitCommonControlsEx.COMCTL32(?), ref: 00ED30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00ED30DC
LoadIconW.USER32(000000A9), ref: 00ED30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00ED3101

Strings

TaskbarCreated, xrefs: 00ED30A4
+, xrefs: 00ED305D
AutoIt v3 GUI, xrefs: 00ED3090
0, xrefs: 00ED3056

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: b13e2c32276727bfc8df1c167add6f1a7a4a116b1dbb7092aa481fdf5849e569
Instruction ID: 874631ccd3d3a92ae96bba3e954f42b074b2613a4e182c41dfba61e5eb628cb3
Opcode Fuzzy Hash: b13e2c32276727bfc8df1c167add6f1a7a4a116b1dbb7092aa481fdf5849e569
Instruction Fuzzy Hash: 35314771841309AFDB01CFA4EC89ADEBBF0FB09711F1445AEE680E62A0D3B50589DF91

Function 00ED3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00ED3074
RegisterClassExW.USER32(00000030), ref: 00ED309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00ED30AF
InitCommonControlsEx.COMCTL32(?), ref: 00ED30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00ED30DC
LoadIconW.USER32(000000A9), ref: 00ED30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00ED3101

Strings

TaskbarCreated, xrefs: 00ED30A4
+, xrefs: 00ED305D
AutoIt v3 GUI, xrefs: 00ED3090
0, xrefs: 00ED3056

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 052662d08b965b4f86ca901b5a2d2f552f20eb04a5b1af9b9079abd6279851dc
Instruction ID: cb0ecf1d0d29063ce2f8bec0bce4c6a246780af13dce9d46727e3f7680956971
Opcode Fuzzy Hash: 052662d08b965b4f86ca901b5a2d2f552f20eb04a5b1af9b9079abd6279851dc
Instruction Fuzzy Hash: 0621B4B191171CAFDB01DFA4E849ADDBBF4FB08B11F04416AFA11A62A0D7B14548AF91

Function 00ED708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00ED4706: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00F952F8,?,00ED37AE,?), ref: 00ED4724

Part of subcall function 00EF050B: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00ED7165), ref: 00EF052D

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00ED71A8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00F0E8C8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00F0E909
RegCloseKey.ADVAPI32(?), ref: 00F0E947
_wcscat.LIBCMT ref: 00F0E9A0

Strings

Include, xrefs: 00F0E8BF, 00F0E900
\, xrefs: 00F0E9C3
Software\AutoIt v3\AutoIt, xrefs: 00ED719E
\Include\, xrefs: 00ED7165

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 44e2a78b37aba01812f0efc7c84779b529ba7ff01b49bdd003ac8c549e59f789
Instruction ID: 2bf7aad51b00c15ad5053780fe87ae25728bbc80399de0625e25cbd7988f536f
Opcode Fuzzy Hash: 44e2a78b37aba01812f0efc7c84779b529ba7ff01b49bdd003ac8c549e59f789
Instruction Fuzzy Hash: FB718D725083059ECB00EF25EC419ABBBE8FF89350F40192FF585D72A1EB719949EB52

Function 00ED3A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00ED3A50
LoadCursorW.USER32(00000000,00007F00), ref: 00ED3A5F
LoadIconW.USER32(00000063), ref: 00ED3A76
LoadIconW.USER32(000000A4), ref: 00ED3A88
LoadIconW.USER32(000000A2), ref: 00ED3A9A
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00ED3AC0
RegisterClassExW.USER32(?), ref: 00ED3B16

Part of subcall function 00ED3041: GetSysColorBrush.USER32(0000000F), ref: 00ED3074
Part of subcall function 00ED3041: RegisterClassExW.USER32(00000030), ref: 00ED309E
Part of subcall function 00ED3041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00ED30AF
Part of subcall function 00ED3041: InitCommonControlsEx.COMCTL32(?), ref: 00ED30CC
Part of subcall function 00ED3041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00ED30DC
Part of subcall function 00ED3041: LoadIconW.USER32(000000A9), ref: 00ED30F2
Part of subcall function 00ED3041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00ED3101

Strings

AutoIt v3, xrefs: 00ED3B05
0, xrefs: 00ED3AF4
#, xrefs: 00ED3AFB

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: f3f72b16d16bd157899ecc90bfbfb6253ef1667997993e196449754af5e692ba
Instruction ID: 06be64372311c4ddf6d0936de577fa4c1e6fc1c5f76f75d121263ee63dcc7035
Opcode Fuzzy Hash: f3f72b16d16bd157899ecc90bfbfb6253ef1667997993e196449754af5e692ba
Instruction Fuzzy Hash: 6F2128B1D0070CAFEB12DFA4EC49B9D7BB4FB08B11F1001ABF604A62A1D3B55654AF94

Function 00ED3633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00ED36D2
KillTimer.USER32(?,00000001), ref: 00ED36FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00ED371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00ED372A
CreatePopupMenu.USER32 ref: 00ED373E
PostQuitMessage.USER32(00000000), ref: 00ED374D

Strings

TaskbarCreated, xrefs: 00ED3725

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 95a1718429287f1f6236177c1d03b0ab700d449902e99b7b028366d151c9c559
Instruction ID: e126c13b066a10d7e8a37cebad7fda85f9da9a3593cdd7102f549b1ed04b59da
Opcode Fuzzy Hash: 95a1718429287f1f6236177c1d03b0ab700d449902e99b7b028366d151c9c559
Instruction Fuzzy Hash: 02412BB1500A09BBDF15AF74EC09BBA3B94EB04701F102127F601B63E2CA719E46B763

Function 00ED3766 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 00ED37AE
CMDLINERAW, xrefs: 00ED37FB
CMDLINE, xrefs: 00ED3822
/AutoIt3OutputDebug, xrefs: 00ED3892
/ErrorStdOut, xrefs: 00ED387D
/AutoIt3ExecuteLine, xrefs: 00ED38A7
/AutoIt3ExecuteScript, xrefs: 00ED38BC

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 1825951767-3513169116
Opcode ID: 794c381c9860cd6c488910baab6cca8639471ca25ad0518b5d833c89e07274c5
Instruction ID: adc706b2f275c6cc8103ef57912234199ff32ebb176e982b7bdc03f83a39e8d6
Opcode Fuzzy Hash: 794c381c9860cd6c488910baab6cca8639471ca25ad0518b5d833c89e07274c5
Instruction Fuzzy Hash: 2BA17F7191021D9ADF05EBA4DC51AEEB7B9FF14310F00242BF815B7292EF749A0ADB61

Function 017EB930 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 017EBA01
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 017EBC27

Memory Dump Source

Source File: 00000000.00000002.1711926957.00000000017E9000.00000040.00000020.00020000.00000000.sdmp, Offset: 017E9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17e9000_UF7jzc7ETP.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: e3e00bf9dbafeb2e33b0b1731302cb2fbf5584eb46f22b1b855d3d8c7a9348fe
Instruction ID: 0b7eb5b84b1b4fee76f7e832833fa426dff15e37bf4f1a5db677b52f1a6fecce
Opcode Fuzzy Hash: e3e00bf9dbafeb2e33b0b1731302cb2fbf5584eb46f22b1b855d3d8c7a9348fe
Instruction Fuzzy Hash: E7A1F874E00209EBDF14CFA4C998BAEFBF5BF48305F208599E211BB284D7759A41CB95

Function 00ED39D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00ED3A03
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00ED3A24
ShowWindow.USER32(00000000,?,?), ref: 00ED3A38
ShowWindow.USER32(00000000,?,?), ref: 00ED3A41

Strings

AutoIt v3, xrefs: 00ED39FB, 00ED3A00, 00ED3A01
edit, xrefs: 00ED3A1E

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 3778d1151b6a14f16cce2d10f32c6eac27acfe5f1d4850530d04f9ead6a93d7d
Instruction ID: f10f2b8264f7680ee7bd35e6f5cdc1ce4a258b8d25fde9532590f9552b4e6554
Opcode Fuzzy Hash: 3778d1151b6a14f16cce2d10f32c6eac27acfe5f1d4850530d04f9ead6a93d7d
Instruction Fuzzy Hash: 5CF03A705006987EEB3257636C08E2B3E7DD7CBF51B00006ABA00A21B0C2611805EBB0

Function 017EB6D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 154
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 017EB5C0: Sleep.KERNELBASE(000001F4), ref: 017EB5D1

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 017EB81C

Strings

6B8Q9RDI0JTQI2WXXIAS, xrefs: 017EB87F, 017EB882

Memory Dump Source

Source File: 00000000.00000002.1711926957.00000000017E9000.00000040.00000020.00020000.00000000.sdmp, Offset: 017E9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17e9000_UF7jzc7ETP.jbxd

Similarity

API ID: CreateFileSleep
String ID: 6B8Q9RDI0JTQI2WXXIAS
API String ID: 2694422964-103329262
Opcode ID: d744fedd13d87b78a5bcd4802c91be0219913a17528fb69cc9c4716d6b741dfa
Instruction ID: 3996034df019db0f14791b029c8b4696600aba9246cad417fee2451a588bebb9
Opcode Fuzzy Hash: d744fedd13d87b78a5bcd4802c91be0219913a17528fb69cc9c4716d6b741dfa
Instruction Fuzzy Hash: F5517270D14248DBEF11DBE4C858BEEBBB9AF18304F104199E608BB2C1D7B95B45CBA5

Function 00ED407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00F0D3D7

Part of subcall function 00ED7BCC: _memmove.LIBCMT ref: 00ED7C06

_memset.LIBCMT ref: 00ED40FC
_wcscpy.LIBCMT ref: 00ED4150
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00ED4160

Strings

Line: , xrefs: 00F0D400

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 32f47cedb0793aff59c35e9f0f1f916a4e2bb0975a1c809decb7472886951a73
Instruction ID: 295e46c5b24e8872f64a8d7c3de87ef351d8de2cb2dc10386ed3bdedc519277b
Opcode Fuzzy Hash: 32f47cedb0793aff59c35e9f0f1f916a4e2bb0975a1c809decb7472886951a73
Instruction Fuzzy Hash: A631ED71008708AFD321EB60DC46BEB77D8EB54300F10151FF284A22E2EB70A64ADB83

Function 00EF541D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00EF547B
_memcpy_s.LIBCMT ref: 00EF54ED
__read_nolock.LIBCMT ref: 00EF554B
__filbuf.LIBCMT ref: 00EF556E
_memset.LIBCMT ref: 00EF55B2

Part of subcall function 00EF8B28: __getptd_noexit.LIBCMT ref: 00EF8B28

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction ID: bc777cb815d198b260199374b3e51be1e91865961acf5988622adb87a6702322
Opcode Fuzzy Hash: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction Fuzzy Hash: E451D972A00B0DDBCB248FA9DC406BE77A2AF61325F249729FB35B62D0D7709D509B40

Function 00ED686A Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00ED4DDD: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00F952F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00ED4E0F

_free.LIBCMT ref: 00F0E263
_free.LIBCMT ref: 00F0E2AA

Part of subcall function 00ED6A8C: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00ED6BAD

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00F0E039
Bad directive syntax error, xrefs: 00F0E292

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: 98d57ec5f45b1b7d3f91054875750d4489a2c871445d201c950ebe7071ea267a
Instruction ID: 346dcb266c6940fac749946203bbe38ce550e5e67ea67b23abd0188fd65d7fc4
Opcode Fuzzy Hash: 98d57ec5f45b1b7d3f91054875750d4489a2c871445d201c950ebe7071ea267a
Instruction Fuzzy Hash: C8916D71D04219AFCF14EFA4CC819EDB7B8FF14310B10486AF815BB2A1DB74A906EB50

Function 00ED35B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00ED35A1,SwapMouseButtons,00000004,?), ref: 00ED35D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,00ED35A1,SwapMouseButtons,00000004,?,?,?,?,00ED2754), ref: 00ED35F5
RegCloseKey.KERNELBASE(00000000,?,?,00ED35A1,SwapMouseButtons,00000004,?,?,?,?,00ED2754), ref: 00ED3617

Strings

Control Panel\Mouse, xrefs: 00ED35D2

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: d0cc4b8f7c03efaf093b15a4f048d2eda5bbd1a2aa6d8434e75010384cef9c07
Instruction ID: 544e81d99fe056564ea4e4d4c0f456ec8bdffaf20db245db9c580cb7ec479b4e
Opcode Fuzzy Hash: d0cc4b8f7c03efaf093b15a4f048d2eda5bbd1a2aa6d8434e75010384cef9c07
Instruction Fuzzy Hash: 28113675910208BADB20CF64DC40EAABBA8EF04744F0054AAA905E7250D2719E46A761

Function 017EA5C0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 017EADED
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 017EAE11
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 017EAE33

Memory Dump Source

Source File: 00000000.00000002.1711926957.00000000017E9000.00000040.00000020.00020000.00000000.sdmp, Offset: 017E9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17e9000_UF7jzc7ETP.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 9a8a17a12fb03160a4a55839945f9e7e1859a6c72d72ca89e8ed8c326fc6e5c7
Instruction ID: f26e45c41e673cc493fceb7b1b190149be5dbdd6c19b87373907681b97b44f57
Opcode Fuzzy Hash: 9a8a17a12fb03160a4a55839945f9e7e1859a6c72d72ca89e8ed8c326fc6e5c7
Instruction Fuzzy Hash: 06620D30A14258DBEB24CFA4C854BDEB7B6EF58300F1091A9D10DEB394E7769E81CB59

Function 00F3955B Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00ED4EE5: _fseek.LIBCMT ref: 00ED4EFD

Part of subcall function 00F39734: _wcscmp.LIBCMT ref: 00F39824
Part of subcall function 00F39734: _wcscmp.LIBCMT ref: 00F39837

_free.LIBCMT ref: 00F396A2
_free.LIBCMT ref: 00F396A9
_free.LIBCMT ref: 00F39714

Part of subcall function 00EF2D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00EF9A24), ref: 00EF2D69
Part of subcall function 00EF2D55: GetLastError.KERNEL32(00000000,?,00EF9A24), ref: 00EF2D7B

_free.LIBCMT ref: 00F3971C

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 83a1bf45cb5b46f0fbbb2b282febcfcf75e63ad05b5baa694a85d9b23f0f737c
Instruction ID: 84514a6350e170be3073c7e2b470f046256e9fac3bd5fb3e6f6c9d47dcc61d47
Opcode Fuzzy Hash: 83a1bf45cb5b46f0fbbb2b282febcfcf75e63ad05b5baa694a85d9b23f0f737c
Instruction Fuzzy Hash: CB514EB1D04218ABDF259F64CC81AAEBBB9EF48310F10049EF609A7391DB715A81CF58

Function 00EF470A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00EF47A0
__flush.LIBCMT ref: 00EF47C0
__write.LIBCMT ref: 00EF47F3
__flsbuf.LIBCMT ref: 00EF4821

Part of subcall function 00EF8B28: __getptd_noexit.LIBCMT ref: 00EF8B28

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction ID: a399547b3d98ef312eb3382aaa059331d2b4bc6b20e906d6f20c44f945e9e450
Opcode Fuzzy Hash: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction Fuzzy Hash: 2A41C5B5B0078D9BDB1C9E69C8809BB7BA5EF413A4B14917EF619A76C0D770DD408B40

Function 00ED7285 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F0EA39
GetOpenFileNameW.COMDLG32(?), ref: 00F0EA83

Part of subcall function 00ED4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00ED4743,?,?,00ED37AE,?), ref: 00ED4770

Part of subcall function 00EF0791: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00EF07B0

Strings

X, xrefs: 00F0EA51

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 4ef4b5105806c74500136919f1e071373a8fa131d3acfbc0a579c541c0990b47
Instruction ID: 6f1d31f1e65934a142adefd935e3411bc5b1dd4ac2cd91d22be16e67cb3141bb
Opcode Fuzzy Hash: 4ef4b5105806c74500136919f1e071373a8fa131d3acfbc0a579c541c0990b47
Instruction Fuzzy Hash: 2221C670A002489BCB119F94CC45BEE7BF9AF48710F00405AE548B7382DBB4594A9F91

Function 00F38D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F38DAC
__fread_nolock.LIBCMT ref: 00F38DC1

Strings

EA06, xrefs: 00F38DF3

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: e935a250548ede965de484b58d1bc1c6037aa25bfe5202cecbf576dfa681bdd1
Instruction ID: f694df873f1759e8c5e4e7fc3450f3e5ee720d4274b4aae713d622b10da5cc8b
Opcode Fuzzy Hash: e935a250548ede965de484b58d1bc1c6037aa25bfe5202cecbf576dfa681bdd1
Instruction Fuzzy Hash: 0A01B972D042187EDF18DAA8CC56EFE7BF8DB15311F00459AF652D2181E979E6049760

Function 00F398E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00F398F8
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00F3990F

Strings

aut, xrefs: 00F39909

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: e3fda4ce9cc9c718ec1a7eb92819fe8e2fe9c9b2ceaa497ba05e93d3a5915714
Instruction ID: 3bcb7057e8d1523c06517883477d2cc5e44e2f0ba05f4d9f730d768eb727253b
Opcode Fuzzy Hash: e3fda4ce9cc9c718ec1a7eb92819fe8e2fe9c9b2ceaa497ba05e93d3a5915714
Instruction Fuzzy Hash: B5D05EB958030DABDB50ABA0DC0EFDA773CE704701F4002F1BB54960A1EAB095999B92

Function 00F4CADD Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a8a936551cc7c7c401ffcc7a0e416858085783c672dc4330bf93edeb222d3b2
Instruction ID: d8e46cb842382c23ddc3347daac6b513f364cfa2269a393c763b207c5052906c
Opcode Fuzzy Hash: 2a8a936551cc7c7c401ffcc7a0e416858085783c672dc4330bf93edeb222d3b2
Instruction Fuzzy Hash: 0CF16E71A083009FC754DF28C880A6ABBE5FF88324F14992EF8999B351D735E945DF92

Function 00EDF76F Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 00EF0162: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00EF0193
Part of subcall function 00EF0162: MapVirtualKeyW.USER32(00000010,00000000), ref: 00EF019B
Part of subcall function 00EF0162: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00EF01A6
Part of subcall function 00EF0162: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00EF01B1
Part of subcall function 00EF0162: MapVirtualKeyW.USER32(00000011,00000000), ref: 00EF01B9
Part of subcall function 00EF0162: MapVirtualKeyW.USER32(00000012,00000000), ref: 00EF01C1

Part of subcall function 00EE60F9: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00EDF930), ref: 00EE6154

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00EDF9CD
OleInitialize.OLE32(00000000), ref: 00EDFA4A
CloseHandle.KERNEL32(00000000), ref: 00F145C8

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 3359e37bf7d3900c749b7510db90e3243170022823469321da84049a368f3369
Instruction ID: e08acadd7403fdeade80d8642b3d9882f1bd2e9c4e5e1caa0038f7282c100df5
Opcode Fuzzy Hash: 3359e37bf7d3900c749b7510db90e3243170022823469321da84049a368f3369
Instruction Fuzzy Hash: 9581F0B0905A48CFC7C6DF7EA9606197BE6FB88B06750812BD518CB332E7704489EF12

Function 00ED434A Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00ED4370
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00ED4415
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00ED4432

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: b63ddb0cab6231b59a6e170e981e777e0957058b6e602941e47042764b702491
Instruction ID: f6aaf6c13f55c623ebbe43e2aa62441f622fc4bef2acf958e4390969d66e33e9
Opcode Fuzzy Hash: b63ddb0cab6231b59a6e170e981e777e0957058b6e602941e47042764b702491
Instruction Fuzzy Hash: E131BFB05047018FC721EF24D88469BBBF8FB58708F00092FE69A96391E770A945DB92

Function 00EF571C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00EF5733

Part of subcall function 00EFA16B: __NMSG_WRITE.LIBCMT ref: 00EFA192
Part of subcall function 00EFA16B: __NMSG_WRITE.LIBCMT ref: 00EFA19C

__NMSG_WRITE.LIBCMT ref: 00EF573A

Part of subcall function 00EFA1C8: GetModuleFileNameW.KERNEL32(00000000,00F933BA,00000104,?,00000001,00000000), ref: 00EFA25A
Part of subcall function 00EFA1C8: ___crtMessageBoxW.LIBCMT ref: 00EFA308

Part of subcall function 00EF309F: ___crtCorExitProcess.LIBCMT ref: 00EF30A5
Part of subcall function 00EF309F: ExitProcess.KERNEL32 ref: 00EF30AE

Part of subcall function 00EF8B28: __getptd_noexit.LIBCMT ref: 00EF8B28

RtlAllocateHeap.NTDLL(01780000,00000000,00000001,00000000,?,?,?,00EF0DD3,?), ref: 00EF575F

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: d1f1c14eb3d1d41fe9340adafb32f4d212a8c6b4f2de24ae2d9d2c0cc57aa4f2
Instruction ID: 695cddb7472ea1c0bc0e18efda0584585a1dd643b45b91ba351dbeb5bd70e09a
Opcode Fuzzy Hash: d1f1c14eb3d1d41fe9340adafb32f4d212a8c6b4f2de24ae2d9d2c0cc57aa4f2
Instruction Fuzzy Hash: 3F01D276301B0DDAD6153734EC42A7E73888B62366F112427F719BB1C2DE7099005660

Function 00F398A2 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00F39548,?,?,?,?,?,00000004), ref: 00F398BB
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00F39548,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00F398D1
CloseHandle.KERNEL32(00000000,?,00F39548,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00F398D8

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 60698224a4db88f92cab26f8bb60b7a920d3f8a1602e34a4299b41bf0e9d65a7
Instruction ID: 20379ac0a52250a3045cb75d7c0508f3bcca5c5cec0bd86167907ad0b6f9b0ec
Opcode Fuzzy Hash: 60698224a4db88f92cab26f8bb60b7a920d3f8a1602e34a4299b41bf0e9d65a7
Instruction Fuzzy Hash: 7DE08632141718B7E7212B54EC09FCA7B19AB06771F104120FB14A90E087B11515A7D8

Function 00F38D0D Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F38D1B

Part of subcall function 00EF2D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00EF9A24), ref: 00EF2D69
Part of subcall function 00EF2D55: GetLastError.KERNEL32(00000000,?,00EF9A24), ref: 00EF2D7B

_free.LIBCMT ref: 00F38D2C
_free.LIBCMT ref: 00F38D3E

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
Instruction ID: 90e8abbe168ee9191aecbef0f468b5a669aae7b0f8c84f2701fa4caeae6f65d6
Opcode Fuzzy Hash: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
Instruction Fuzzy Hash: 64E012A1A0170946CB24A578A941AA353DC4F583B2B14191DB60DE7186CF68F8439124

Function 00EDA9C3 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 00F0FC01

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 6d8ad1b91bed51d4fc16736556a6f5e451e8857aea96fce2c3a6015ec297ee9b
Instruction ID: 528b7e2af66eea44686a543234b8ed379ec55ad08094dfb1421d89c83ad5eff6
Opcode Fuzzy Hash: 6d8ad1b91bed51d4fc16736556a6f5e451e8857aea96fce2c3a6015ec297ee9b
Instruction Fuzzy Hash: DC225A70508301DFCB24DF14C450A6AB7E1FF84314F19996EE88AAB362D735ED86DB82

Function 00ED4C70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00ED4CBA

Strings

EA06, xrefs: 00F0D8CC

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: 8471d457aa9bbd1a76073677909cf297708990271cf7e55d2eb88b750cc9c270
Instruction ID: d2892cead58faf0a36faa85cee668e8680c8e97be74bd086cff7043d44097cb7
Opcode Fuzzy Hash: 8471d457aa9bbd1a76073677909cf297708990271cf7e55d2eb88b750cc9c270
Instruction Fuzzy Hash: D3415CA1A0415C6BDF219B548891BFE7FE3DB65300F286477EC82BB3C2D6319D4693A1

Function 00ED47D0 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00ED4834

Part of subcall function 00EF336C: __lock.LIBCMT ref: 00EF3372
Part of subcall function 00EF336C: DecodePointer.KERNEL32(00000001,?,00ED4849,00F27C74), ref: 00EF337E
Part of subcall function 00EF336C: EncodePointer.KERNEL32(?,?,00ED4849,00F27C74), ref: 00EF3389

Part of subcall function 00ED48FD: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00ED4915
Part of subcall function 00ED48FD: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00ED492A

Part of subcall function 00ED3B3A: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00ED3B68
Part of subcall function 00ED3B3A: IsDebuggerPresent.KERNEL32 ref: 00ED3B7A
Part of subcall function 00ED3B3A: GetFullPathNameW.KERNEL32(00007FFF,?,?,00F952F8,00F952E0,?,?), ref: 00ED3BEB
Part of subcall function 00ED3B3A: SetCurrentDirectoryW.KERNEL32(?), ref: 00ED3C6F

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00ED4874

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: f1399e52a107fe467621fdd3ef54ff9140da671453535e05e7eff02998232807
Instruction ID: cb6e1c63f96e8405cf447d9aae044c26d7c84c9ce3e3b6102a199c39d6357225
Opcode Fuzzy Hash: f1399e52a107fe467621fdd3ef54ff9140da671453535e05e7eff02998232807
Instruction Fuzzy Hash: E6119D719083499BC700EF79EC0590ABFE8EF99B50F10451FF040A32B1DB719549EB92

Function 00ED5C99 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,00ED5821,?,?,?,?), ref: 00ED5CC7
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,00ED5821,?,?,?,?), ref: 00F0DD73

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e4c27ba9106fa8cfab9ae9b603e80f5fa327e39c501802ccad0968bafb28f509
Instruction ID: 70530dcef080fc3f6e0f4a71e7124a5fb250b0889e08f716ea718cc06cef1eaf
Opcode Fuzzy Hash: e4c27ba9106fa8cfab9ae9b603e80f5fa327e39c501802ccad0968bafb28f509
Instruction Fuzzy Hash: 90018471244708BEF7200E24CC8AF7676DCEB01768F148316BBD5AA2E0C6B51C4A9B50

Function 00EF0DB6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00EF571C: __FF_MSGBANNER.LIBCMT ref: 00EF5733
Part of subcall function 00EF571C: __NMSG_WRITE.LIBCMT ref: 00EF573A
Part of subcall function 00EF571C: RtlAllocateHeap.NTDLL(01780000,00000000,00000001,00000000,?,?,?,00EF0DD3,?), ref: 00EF575F

std::exception::exception.LIBCMT ref: 00EF0DEC
__CxxThrowException@8.LIBCMT ref: 00EF0E01

Part of subcall function 00EF859B: RaiseException.KERNEL32(?,?,?,00F89E78,00000000,?,?,?,?,00EF0E06,?,00F89E78,?,00000001), ref: 00EF85F0

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 7790e26a17c83aea79a0fdabc465a7387a977a882901c5587edb10ebcdfe139e
Instruction ID: 1f362db2de49e407b6377c3a6fc20dcba0bad41077e07e9114d53c8404cd8c63
Opcode Fuzzy Hash: 7790e26a17c83aea79a0fdabc465a7387a977a882901c5587edb10ebcdfe139e
Instruction Fuzzy Hash: 9AF0A43190021E67CB10BAA4ED019FE7BEC9F01355F105426FB14B6183EFB19A40D6D1

Function 00EF55FD Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00EF562C
__lock_file.LIBCMT ref: 00EF564D

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 3252858b05c768c55781ee39c68c8aef14c047f93c279e5124aec4c17b6ce946
Instruction ID: 67107672b9e73fa2ae7f667d3221db29361a151a198e28d02a510c12df297688
Opcode Fuzzy Hash: 3252858b05c768c55781ee39c68c8aef14c047f93c279e5124aec4c17b6ce946
Instruction Fuzzy Hash: CC01FC72800A0CEBCF12AF648D024BE7BA1AFA0321F419115F73476151DB318611DF91

Function 00EF53A6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00EF8B28: __getptd_noexit.LIBCMT ref: 00EF8B28

__lock_file.LIBCMT ref: 00EF53EB

Part of subcall function 00EF6C11: __lock.LIBCMT ref: 00EF6C34

__fclose_nolock.LIBCMT ref: 00EF53F6

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 96dea23721edc34a72e306a9564c7d77a4efcc7eed577b68ab26ee440c5706c0
Instruction ID: 9d9f2fb540ec3fb4de13feeb293503fe977077c06cb5f411bba59e7d271efe5a
Opcode Fuzzy Hash: 96dea23721edc34a72e306a9564c7d77a4efcc7eed577b68ab26ee440c5706c0
Instruction Fuzzy Hash: ADF09632901A0C9ADB116F799D017BD66E06F51374F20A105A764BB1C5CBFC89416B52

Function 00ED8061 Relevance: 2.6, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000001,00000000,00000000,?,?,?,00ED542F,?,?,?,?,?), ref: 00ED807A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000001,00000000,?,?,?,00ED542F,?,?,?,?,?), ref: 00ED80AD

Part of subcall function 00ED774D: _memmove.LIBCMT ref: 00ED7789

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ByteCharMultiWide$_memmove
String ID:
API String ID: 3033907384-0
Opcode ID: 652715a19cfe19b7715ec0a1f06dba04f8852f1ebb8851e530fbb57879a3da65
Instruction ID: 76cb6d61e126157e88d198d0f437ddf248dd5f01800b2d5dde75ca7ef62e122c
Opcode Fuzzy Hash: 652715a19cfe19b7715ec0a1f06dba04f8852f1ebb8851e530fbb57879a3da65
Instruction Fuzzy Hash: D201A271201208BFEB246B21DD46F7B3BADEF85360F10802AFA05EE291DE319801D661

Function 017EA5BD Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 017EADED
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 017EAE11
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 017EAE33

Memory Dump Source

Source File: 00000000.00000002.1711926957.00000000017E9000.00000040.00000020.00020000.00000000.sdmp, Offset: 017E9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17e9000_UF7jzc7ETP.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 935c44ad8318b3af66d252774f477c9026677184fbf87e93bc0843909b837ee7
Instruction ID: 708aa393089385ff22805fdc91c38c1f1262c5c3d75db57ec70ed54ec3b120fc
Opcode Fuzzy Hash: 935c44ad8318b3af66d252774f477c9026677184fbf87e93bc0843909b837ee7
Instruction Fuzzy Hash: 7412DD24E24658C6EB24DF64D8547DEB272EF68300F1090E9910DEB7A4E77A4F81CF5A

Function 00EE1FC3 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ae04c95201d12811f2796a6e34b0a1accb9a3dc4ce8c324843d82d44b291463
Instruction ID: 04fb14de1c115786ded4d64bf7ace95abecbdfa49838a4fcd979cbc532d4592b
Opcode Fuzzy Hash: 1ae04c95201d12811f2796a6e34b0a1accb9a3dc4ce8c324843d82d44b291463
Instruction Fuzzy Hash: 91517E35A00604ABCF14EF68C991EAE77EAAF45324F149169F906BB392DB30ED01DB51

Function 00ED5AEE Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 00ED5B96

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 668b75c9aef594633b175fe781dedaefb3274175c46b6f7d7031e271712998db
Instruction ID: 22bcf5b9a9bb203978480a20e40725e2b4c73caa59fb955193d3194e0c83cbd2
Opcode Fuzzy Hash: 668b75c9aef594633b175fe781dedaefb3274175c46b6f7d7031e271712998db
Instruction Fuzzy Hash: CC313C32A00A09AFCB18DF6CC480AADF7B5FF44314F14962BD815A7750D770B991CB90

Function 00EF0C08 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00EF0CB7

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: de01eca886c0d1fe7843b9017b02257ffe957a32f26a6d32d96838476727f10f
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: B231F3B4A001099BC718DF08C484A79F7A6FB49314B24A7A5E90AEB356D731EDC1DBC0

Function 00F0FCAC Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00F0FCB7

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: c4ffd7c0912fd3f7691291a8cae1351d62abd357f03ef0924fdcb9253831888e
Instruction ID: 1a753de0146947791323f4e3965ff51a09f160c1f547dd8877074aa169276a9c
Opcode Fuzzy Hash: c4ffd7c0912fd3f7691291a8cae1351d62abd357f03ef0924fdcb9253831888e
Instruction Fuzzy Hash: 49412574A04341CFDB24CF24C444B1ABBE1FF45318F0998ADE9999B762C731E84ACB42

Function 00ED59B9 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00ED5A01

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: ec35f47816db9e71a135f70dcd9762ac2a40af231b5cfde1e8723787a431fb1a
Instruction ID: 7001f5e7e83079d9556c5ef38094c820b9c645e3ba0c3098cd023a42c5bc05ff
Opcode Fuzzy Hash: ec35f47816db9e71a135f70dcd9762ac2a40af231b5cfde1e8723787a431fb1a
Instruction Fuzzy Hash: 60210272904A08EBEB149F91E8806BA7FB8FF40310F21C86AE485E6191EBB094D0F751

Function 00EDC5A7 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00EDC5DD

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: _wcscmp
String ID:
API String ID: 856254489-0
Opcode ID: f5555ede9017fb9406ffcb3e947b0acc3db2da6d343fa3e0934f287257943d4e
Instruction ID: 5261055ce547346b7c04d1fbaa58f4ea2ac7c14d3a6a96842956fd0849a7d8c3
Opcode Fuzzy Hash: f5555ede9017fb9406ffcb3e947b0acc3db2da6d343fa3e0934f287257943d4e
Instruction Fuzzy Hash: 6911D232900119DBCF14EB69DC419EEB7B8FF90360F105117F825B7290EA319D06DB90

Function 00ED4DDD Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED4BB5: FreeLibrary.KERNEL32(00000000,?), ref: 00ED4BEF

Part of subcall function 00EF525B: __wfsopen.LIBCMT ref: 00EF5266

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00F952F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00ED4E0F

Part of subcall function 00ED4B6A: FreeLibrary.KERNEL32(00000000), ref: 00ED4BA4

Part of subcall function 00ED4C70: _memmove.LIBCMT ref: 00ED4CBA

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: bc5f77cb0570b77f9e17afc7fa37d37761596f5dc8ec3c64f0170085dec25a22
Instruction ID: 6c5332a8795e9fe3fed5f3c8e805e530168bf71b94f691cc5b2c4537050c5c66
Opcode Fuzzy Hash: bc5f77cb0570b77f9e17afc7fa37d37761596f5dc8ec3c64f0170085dec25a22
Instruction Fuzzy Hash: F4119471600209BBCF15BFB0C816FAD77E5EF64710F10842AF945BB2C1EA719A06A751

Function 00F0FD85 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00F0FD91

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: ecbd88a73bcc5c10b05ee5a01690539cfc81c80dbefbb362eb9ace0d8fba2d74
Instruction ID: d98c2ea0cfe410088b215b108a4b641a78bea562d53a842582127637da15c864
Opcode Fuzzy Hash: ecbd88a73bcc5c10b05ee5a01690539cfc81c80dbefbb362eb9ace0d8fba2d74
Instruction Fuzzy Hash: 2E213774908305DFCB14DF24C444A1ABBE1FF84314F099969E98967722D731E809DB52

Function 00ED5BC0 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,00ED56A7,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00ED5C16

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 5a3db421508fc3614c5a3e60d1452561c9305296a57b15fd041830d78f45abb2
Instruction ID: 61bc6e24f286a500d359a4851e444e96682d46db780da4e115c1833b84d74d7c
Opcode Fuzzy Hash: 5a3db421508fc3614c5a3e60d1452561c9305296a57b15fd041830d78f45abb2
Instruction Fuzzy Hash: 6B113A32200B049FD320CF19C880B62B7E4EF44764F10D92FE9AA96A51D771F846CB60

Function 00ED5A7A Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F0DD18

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: a7b9d5836668f83c2a3f51eb8053bbd8b90c3f0a49dd782c3ce1182c41f61193
Instruction ID: 2f5b1c4afa727070b73c17e0f9b13c81c6c9ced12a63857ee29a8d3c6e14613b
Opcode Fuzzy Hash: a7b9d5836668f83c2a3f51eb8053bbd8b90c3f0a49dd782c3ce1182c41f61193
Instruction Fuzzy Hash: 850184B9200901AFC305DB68C451D2AF7E9FF85310714856AF519D7702D735EC22CBE0

Function 00EF4863 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00EF48A6

Part of subcall function 00EF8B28: __getptd_noexit.LIBCMT ref: 00EF8B28

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: 2e6e3f2659f0f10772274927403d83e106291718867e9c565c989a737121010b
Instruction ID: 46d53f0ba31b10b0020442a4ac58c09dbd2c93f8d58f6555dac9ff095e89c0f4
Opcode Fuzzy Hash: 2e6e3f2659f0f10772274927403d83e106291718867e9c565c989a737121010b
Instruction Fuzzy Hash: 6AF0FFB190028CABDF15AFB48C063FF36E0AF00364F04A404B624BA1C1DBB88950DB41

Function 00ED4E4A Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00F952F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00ED4E7E

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 18e72594355c58fc4ee6683f0a9fae7badf92ff5cf8cc49f86191635ff95ccf7
Instruction ID: cce5f0f8db13face106f6f52ab19b4c2f994a2c1dfc85f673f416405f60b438e
Opcode Fuzzy Hash: 18e72594355c58fc4ee6683f0a9fae7badf92ff5cf8cc49f86191635ff95ccf7
Instruction Fuzzy Hash: 9DF01CB1501711DFCB349F64D494852B7E1FF24329310997EE6D696750C7319845DB40

Function 00EF0791 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00EF07B0

Part of subcall function 00ED7BCC: _memmove.LIBCMT ref: 00ED7C06

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: ea27893251ea094b39920d0fef037dcedfc40d9c4763ca3e6e9229f7f2127c23
Instruction ID: eb3f41d446ea564d2d7925a7373243ce08fd7804b66e173efae9175a00e409a0
Opcode Fuzzy Hash: ea27893251ea094b39920d0fef037dcedfc40d9c4763ca3e6e9229f7f2127c23
Instruction Fuzzy Hash: 8EE0867690422857C720A6689C05FEA77DDDB887A1F0441B6FD0CD7244D9659C909690

Function 00F38E9F Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00F38EC1

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction ID: 5b17c6ff49197f378dc21ad33780d82e8ae16eb6d5a58c172173447f9af6daa6
Opcode Fuzzy Hash: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction Fuzzy Hash: E6E092B1504B045FD7398A24D800BA373E1AB05325F00085DF6AA93241EB6278869759

Function 00ED5C4E Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,00F0DD42,?,?,00000000), ref: 00ED5C5F

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: f38a94b78dc7fbe3b1c93bcd4b51cac7481f60e6dbcbff23453552b131c0de96
Instruction ID: aaa613e7374e15ea11eeea44bcacf960042ea187fc4a0c80fc0bae020d423339
Opcode Fuzzy Hash: f38a94b78dc7fbe3b1c93bcd4b51cac7481f60e6dbcbff23453552b131c0de96
Instruction Fuzzy Hash: E3D09E7464020CBFE610DB80DC46FAA777CD705711F100194BE049629096B27D549695

Function 00EF525B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00EF5266

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 9b28019e21cc881e5070377bfa499a8c979ff45a1c17a9c5ad721b55429ebafd
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: E9B0927644020C77DE012A82FC02A593F699B51764F808020FB0C28172A673A6649A89

Function 00F3D07B Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 00F3D1FF

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 4713a4360f88a5d743ea82a52e254c43b1583eaf9e19bccf3c393107580cdd1b
Instruction ID: 49d910aa460d2c3ad950b6a3aa1f3f6f4b06a9651b9c8cfc003e710efda75111
Opcode Fuzzy Hash: 4713a4360f88a5d743ea82a52e254c43b1583eaf9e19bccf3c393107580cdd1b
Instruction Fuzzy Hash: 3A7183756043018FD704EF24D491A6EB7E0EF89364F04596EF8969B3A2DB30ED0ADB52

Function 017EB5BC Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 017EB5D1

Memory Dump Source

Source File: 00000000.00000002.1711926957.00000000017E9000.00000040.00000020.00020000.00000000.sdmp, Offset: 017E9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17e9000_UF7jzc7ETP.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction ID: 623c36f5b414e8caee52be5237a7e2697d909cadb98c5f7cbb2f2ba46df0c003
Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction Fuzzy Hash: B2E09A7494010DAFDB00EFA4D54969E7BB4EF04301F1005A1FD05D7681DA309A548A62

Function 017EB5C0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 017EB5D1

Memory Dump Source

Source File: 00000000.00000002.1711926957.00000000017E9000.00000040.00000020.00020000.00000000.sdmp, Offset: 017E9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17e9000_UF7jzc7ETP.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 97e38a5bb54395558ae87229f92467b1662bc9bbf168e9b50fa0370dcdd923c1
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 3EE0BF7494010D9FDB00EFA4D54969E7FF4EF04301F100161FD01D2281D6309A508A62

Non-executed Functions

Function 00F5CABC Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 632windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED2612: GetWindowLongW.USER32(?,000000EB), ref: 00ED2623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00F5CB37
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00F5CB95
GetWindowLongW.USER32(?,000000F0), ref: 00F5CBD6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00F5CC00
SendMessageW.USER32 ref: 00F5CC29
_wcsncpy.LIBCMT ref: 00F5CC95
GetKeyState.USER32(00000011), ref: 00F5CCB6
GetKeyState.USER32(00000009), ref: 00F5CCC3
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00F5CCD9
GetKeyState.USER32(00000010), ref: 00F5CCE3
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00F5CD0C
SendMessageW.USER32 ref: 00F5CD33
SendMessageW.USER32(?,00001030,?,00F5B348), ref: 00F5CE37
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00F5CE4D
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00F5CE60
SetCapture.USER32(?), ref: 00F5CE69
ClientToScreen.USER32(?,?), ref: 00F5CECE
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00F5CEDB
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00F5CEF5
ReleaseCapture.USER32 ref: 00F5CF00
GetCursorPos.USER32(?), ref: 00F5CF3A
ScreenToClient.USER32(?,?), ref: 00F5CF47
SendMessageW.USER32(?,00001012,00000000,?), ref: 00F5CFA3
SendMessageW.USER32 ref: 00F5CFD1
SendMessageW.USER32(?,00001111,00000000,?), ref: 00F5D00E
SendMessageW.USER32 ref: 00F5D03D
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00F5D05E
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00F5D06D
GetCursorPos.USER32(?), ref: 00F5D08D
ScreenToClient.USER32(?,?), ref: 00F5D09A
GetParent.USER32(?), ref: 00F5D0BA
SendMessageW.USER32(?,00001012,00000000,?), ref: 00F5D123
SendMessageW.USER32 ref: 00F5D154
ClientToScreen.USER32(?,?), ref: 00F5D1B2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00F5D1E2
SendMessageW.USER32(?,00001111,00000000,?), ref: 00F5D20C
SendMessageW.USER32 ref: 00F5D22F
ClientToScreen.USER32(?,?), ref: 00F5D281
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00F5D2B5

Part of subcall function 00ED25DB: GetWindowLongW.USER32(?,000000EB), ref: 00ED25EC

GetWindowLongW.USER32(?,000000F0), ref: 00F5D351

Strings

@GUI_DRAGID, xrefs: 00F5CE9C
F, xrefs: 00F5D235

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: f6019c212ff82e2b22390781f8419d83b25c97b53a7a31ad827d72270ae721ac
Instruction ID: 61609895dcb59f2fd3ce9f2ff3fc0f085c60156815dbdffa94ff92abc9e3078c
Opcode Fuzzy Hash: f6019c212ff82e2b22390781f8419d83b25c97b53a7a31ad827d72270ae721ac
Instruction Fuzzy Hash: F542BD34604344AFDB21CF24C844BAABBE5FF89722F140559FB96972B1C731D848EB92

Function 00EE6F9E Relevance: 52.3, APIs: 19, Strings: 8, Instructions: 5018COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00EE71C3
_memset.LIBCMT ref: 00EE7539
_memmove.LIBCMT ref: 00EE76AC

Strings

[:>:]], xrefs: 00EE7492
Q\E, xrefs: 00EE7FCB
_, xrefs: 00F223CB
[:<:]], xrefs: 00EE7479
DEFINE, xrefs: 00F22103
\b(?=\w), xrefs: 00F23769
3c, xrefs: 00F223A0
\b(?<=\w), xrefs: 00F23773

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: _memmove$_memset
String ID: 3c$DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)$_
API String ID: 1357608183-3681475764
Opcode ID: bc33d6403e2491b15b0b41d92404b4105b6f9e90853b026e9e68025d42ce9e70
Instruction ID: 53627836395d1927634fd4d25edb825b5fc78dd6a8e5e6699906f57275201d6b
Opcode Fuzzy Hash: bc33d6403e2491b15b0b41d92404b4105b6f9e90853b026e9e68025d42ce9e70
Instruction Fuzzy Hash: 0493B575E04229DFDB24CF98D881BADB7B1FF48320F25816AE945EB281E7749D81DB40

Function 00ED48D7 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 00ED48DF
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00F0D665
IsIconic.USER32(?), ref: 00F0D66E
ShowWindow.USER32(?,00000009), ref: 00F0D67B
SetForegroundWindow.USER32(?), ref: 00F0D685
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00F0D69B
GetCurrentThreadId.KERNEL32 ref: 00F0D6A2
GetWindowThreadProcessId.USER32(?,00000000), ref: 00F0D6AE
AttachThreadInput.USER32(?,00000000,00000001), ref: 00F0D6BF
AttachThreadInput.USER32(?,00000000,00000001), ref: 00F0D6C7
AttachThreadInput.USER32(00000000,?,00000001), ref: 00F0D6CF
SetForegroundWindow.USER32(?), ref: 00F0D6D2
MapVirtualKeyW.USER32(00000012,00000000), ref: 00F0D6E7
keybd_event.USER32(00000012,00000000), ref: 00F0D6F2
MapVirtualKeyW.USER32(00000012,00000000), ref: 00F0D6FC
keybd_event.USER32(00000012,00000000), ref: 00F0D701
MapVirtualKeyW.USER32(00000012,00000000), ref: 00F0D70A
keybd_event.USER32(00000012,00000000), ref: 00F0D70F
MapVirtualKeyW.USER32(00000012,00000000), ref: 00F0D719
keybd_event.USER32(00000012,00000000), ref: 00F0D71E
SetForegroundWindow.USER32(?), ref: 00F0D721
AttachThreadInput.USER32(?,?,00000000), ref: 00F0D748

Strings

Shell_TrayWnd, xrefs: 00F0D660

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 76ce4ff902b6de19ccdfc1f43803d3ac8530904eaf52728c6904fbf25026575b
Instruction ID: 9280b8fd6204d3c5e419d5c6c6cd0f4dcb6984662eff3d501e2963d85a613afe
Opcode Fuzzy Hash: 76ce4ff902b6de19ccdfc1f43803d3ac8530904eaf52728c6904fbf25026575b
Instruction Fuzzy Hash: 81317071A4031CBBEB206BA19C89F7F7E6CEB44B61F144065FB05EB1D1DAB05901BBA1

Function 00F28310 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00F287E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00F2882B
Part of subcall function 00F287E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00F28858
Part of subcall function 00F287E1: GetLastError.KERNEL32 ref: 00F28865

_memset.LIBCMT ref: 00F28353
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00F283A5
CloseHandle.KERNEL32(?), ref: 00F283B6
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00F283CD
GetProcessWindowStation.USER32 ref: 00F283E6
SetProcessWindowStation.USER32(00000000), ref: 00F283F0
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00F2840A

Part of subcall function 00F281CB: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00F28309), ref: 00F281E0
Part of subcall function 00F281CB: CloseHandle.KERNEL32(?,?,00F28309), ref: 00F281F2

Strings

default, xrefs: 00F28405
, xrefs: 00F28362
winsta0, xrefs: 00F283C8

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: ae9edde71d59e9b7cad0ee27f97c0757b5347c1e06192d71780ce024b7667da5
Instruction ID: 5ddc4c620151544b15ebd58fe8004cb9c9746682ec517343e6ed4a2d9d897b49
Opcode Fuzzy Hash: ae9edde71d59e9b7cad0ee27f97c0757b5347c1e06192d71780ce024b7667da5
Instruction Fuzzy Hash: FC815C71D0221DAFDF11DFA4EC45AEE7BB8EF04364F184169F910A6161DB358E16EB20

Function 00F3C75C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00F3C78D
FindClose.KERNEL32(00000000), ref: 00F3C7E1
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00F3C806
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00F3C81D
FileTimeToSystemTime.KERNEL32(?,?), ref: 00F3C844
__swprintf.LIBCMT ref: 00F3C890
__swprintf.LIBCMT ref: 00F3C8D3

Part of subcall function 00ED7DE1: _memmove.LIBCMT ref: 00ED7E22

__swprintf.LIBCMT ref: 00F3C927

Part of subcall function 00EF3698: __woutput_l.LIBCMT ref: 00EF36F1

__swprintf.LIBCMT ref: 00F3C975

Part of subcall function 00EF3698: __flsbuf.LIBCMT ref: 00EF3713
Part of subcall function 00EF3698: __flsbuf.LIBCMT ref: 00EF372B

__swprintf.LIBCMT ref: 00F3C9C4
__swprintf.LIBCMT ref: 00F3CA13
__swprintf.LIBCMT ref: 00F3CA62

Strings

%4d, xrefs: 00F3C8CD
%02d, xrefs: 00F3C91B, 00F3C925, 00F3C973, 00F3C9C2, 00F3CA11, 00F3CA60
%4d%02d%02d%02d%02d%02d, xrefs: 00F3C88A

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 95c0d114c581450474139125d750e3c11f707adc8832c22fe1868310dcf2a19a
Instruction ID: 7a96485285f989d5573b30427f61f4bdadfb1dbcf6a76cbd4fbd7b6e58e6fd18
Opcode Fuzzy Hash: 95c0d114c581450474139125d750e3c11f707adc8832c22fe1868310dcf2a19a
Instruction Fuzzy Hash: 1AA11FB2404344ABC704EFA4CC85DAFB7ECFF95704F40191AF595D6292EA35DA09CB62

Function 00F3EF95 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00F3EFB6
_wcscmp.LIBCMT ref: 00F3EFCB
_wcscmp.LIBCMT ref: 00F3EFE2
GetFileAttributesW.KERNEL32(?), ref: 00F3EFF4
SetFileAttributesW.KERNEL32(?,?), ref: 00F3F00E
FindNextFileW.KERNEL32(00000000,?), ref: 00F3F026
FindClose.KERNEL32(00000000), ref: 00F3F031
FindFirstFileW.KERNEL32(*.*,?), ref: 00F3F04D
_wcscmp.LIBCMT ref: 00F3F074
_wcscmp.LIBCMT ref: 00F3F08B
SetCurrentDirectoryW.KERNEL32(?), ref: 00F3F09D
SetCurrentDirectoryW.KERNEL32(00F88920), ref: 00F3F0BB
FindNextFileW.KERNEL32(00000000,00000010), ref: 00F3F0C5
FindClose.KERNEL32(00000000), ref: 00F3F0D2
FindClose.KERNEL32(00000000), ref: 00F3F0E4

Strings

*.*, xrefs: 00F3F048

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 625e63268b9242c9e93913c6942f1f37a4628cb0ca00ba996b95b482cef90d1e
Instruction ID: 8c1c72b55e9d9ef1f1145ee38466973233a0888ea9d5bd5ca682ba9e35fbc40d
Opcode Fuzzy Hash: 625e63268b9242c9e93913c6942f1f37a4628cb0ca00ba996b95b482cef90d1e
Instruction Fuzzy Hash: 2F31E772D0020D6ADB14ABB8DC48AEE77AC9F44371F1041B6F915E30A1DB70DA49EB61

Function 00F50857 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F50953
RegCreateKeyExW.ADVAPI32(?,?,00000000,00F5F910,00000000,?,00000000,?,?), ref: 00F509C1
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00F50A09
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00F50A92
RegCloseKey.ADVAPI32(?), ref: 00F50DB2
RegCloseKey.ADVAPI32(00000000), ref: 00F50DBF

Strings

REG_DWORD, xrefs: 00F50C83
REG_MULTI_SZ, xrefs: 00F50B7A
REG_EXPAND_SZ, xrefs: 00F50A2F
REG_QWORD, xrefs: 00F50D00
REG_SZ, xrefs: 00F50AD0
REG_BINARY, xrefs: 00F50D4D

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: bda8ecb494d88a9dda0b7e6caf27fda68a7d3846ca9dcb79977ef6de1a272768
Instruction ID: a11d5d6a4d5fc9abac7931613dbc711d6c6f7a89471c39a16c6a1d063df04789
Opcode Fuzzy Hash: bda8ecb494d88a9dda0b7e6caf27fda68a7d3846ca9dcb79977ef6de1a272768
Instruction Fuzzy Hash: 89026C756046019FCB14EF14C855E2AB7E5FF89724F04845DF999AB3A2DB30EC06DB81

Function 00F3F0F2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00F3F113
_wcscmp.LIBCMT ref: 00F3F128
_wcscmp.LIBCMT ref: 00F3F13F

Part of subcall function 00F34385: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00F343A0

FindNextFileW.KERNEL32(00000000,?), ref: 00F3F16E
FindClose.KERNEL32(00000000), ref: 00F3F179
FindFirstFileW.KERNEL32(*.*,?), ref: 00F3F195
_wcscmp.LIBCMT ref: 00F3F1BC
_wcscmp.LIBCMT ref: 00F3F1D3
SetCurrentDirectoryW.KERNEL32(?), ref: 00F3F1E5
SetCurrentDirectoryW.KERNEL32(00F88920), ref: 00F3F203
FindNextFileW.KERNEL32(00000000,00000010), ref: 00F3F20D
FindClose.KERNEL32(00000000), ref: 00F3F21A
FindClose.KERNEL32(00000000), ref: 00F3F22C

Strings

*.*, xrefs: 00F3F190

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 0d3616ac41d653a814db06e7dd1cc03caa71cbf2d494132e3f45e4f52a6ed34a
Instruction ID: 8b5fdfeb3ed9e008f8a1aff7d0fbd62e9c281682fbf69e5da23ca3eb5992184a
Opcode Fuzzy Hash: 0d3616ac41d653a814db06e7dd1cc03caa71cbf2d494132e3f45e4f52a6ed34a
Instruction Fuzzy Hash: 8231A276D0021DBADB20AAA4EC59AEF77AC9F85371F1041B5E910E20A0DB30DA4DEA54

Function 00F3A1EF Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00F3A20F
__swprintf.LIBCMT ref: 00F3A231
CreateDirectoryW.KERNEL32(?,00000000), ref: 00F3A26E
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00F3A293
_memset.LIBCMT ref: 00F3A2B2
_wcsncpy.LIBCMT ref: 00F3A2EE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00F3A323
CloseHandle.KERNEL32(00000000), ref: 00F3A32E
RemoveDirectoryW.KERNEL32(?), ref: 00F3A337
CloseHandle.KERNEL32(00000000), ref: 00F3A341

Strings

:, xrefs: 00F3A252
\, xrefs: 00F3A247
\??\%s, xrefs: 00F3A22B

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 34c75bdbfff7d51095543224af54617ba0098665a19618c7eb31fc134284a7e6
Instruction ID: 6be5a53c67990fdf0b6550567a9fedb1ed27cdf64edf49342fbfc159752d95b7
Opcode Fuzzy Hash: 34c75bdbfff7d51095543224af54617ba0098665a19618c7eb31fc134284a7e6
Instruction Fuzzy Hash: 9331B2B1900209ABDB21DFA1DC49FEB37BCEF89751F1041B6F608D6160EB7196449B25

Function 00F27CAF Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F28202: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00F2821E
Part of subcall function 00F28202: GetLastError.KERNEL32(?,00F27CE2,?,?,?), ref: 00F28228
Part of subcall function 00F28202: GetProcessHeap.KERNEL32(00000008,?,?,00F27CE2,?,?,?), ref: 00F28237
Part of subcall function 00F28202: HeapAlloc.KERNEL32(00000000,?,00F27CE2,?,?,?), ref: 00F2823E
Part of subcall function 00F28202: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00F28255

Part of subcall function 00F2829F: GetProcessHeap.KERNEL32(00000008,00F27CF8,00000000,00000000,?,00F27CF8,?), ref: 00F282AB
Part of subcall function 00F2829F: HeapAlloc.KERNEL32(00000000,?,00F27CF8,?), ref: 00F282B2
Part of subcall function 00F2829F: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00F27CF8,?), ref: 00F282C3

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00F27D13
_memset.LIBCMT ref: 00F27D28
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00F27D47
GetLengthSid.ADVAPI32(?), ref: 00F27D58
GetAce.ADVAPI32(?,00000000,?), ref: 00F27D95
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00F27DB1
GetLengthSid.ADVAPI32(?), ref: 00F27DCE
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00F27DDD
HeapAlloc.KERNEL32(00000000), ref: 00F27DE4
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00F27E05
CopySid.ADVAPI32(00000000), ref: 00F27E0C
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00F27E3D
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00F27E63
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00F27E77

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 3a8b5d97af3ebc37fe73be33d2e10a5f111d8e2d94541c4cfd35988f23599215
Instruction ID: 524736c7442bb585b3e37d53e32fcbcd212ecfffe5a4573aba687e1e332d8ab7
Opcode Fuzzy Hash: 3a8b5d97af3ebc37fe73be33d2e10a5f111d8e2d94541c4cfd35988f23599215
Instruction Fuzzy Hash: 8F616C71900619AFDF00DFA0EC44AEEBB79FF04311F0481A9E915A72A1DB359A05EB60

Function 00EE66E1 Relevance: 20.9, Strings: 16, Instructions: 889COMMON

Download Yara Rule

Strings

LF), xrefs: 00F212A4
ANY), xrefs: 00F212DE
UCP), xrefs: 00F2110D
UTF16), xrefs: 00F210CF
CR), xrefs: 00F21287
UTF), xrefs: 00F210FA
LIMIT_RECURSION=, xrefs: 00F211FC
CRLF), xrefs: 00F212C1
_, xrefs: 00F21465, 00F2150C, 00F215B4
ANYCRLF), xrefs: 00F212FB
BSR_ANYCRLF), xrefs: 00F2131E
3c, xrefs: 00EE68FF
NO_AUTO_POSSESS), xrefs: 00F2112E
BSR_UNICODE), xrefs: 00F21338
LIMIT_MATCH=, xrefs: 00F21170
NO_START_OPT), xrefs: 00F2114F

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID:
String ID: 3c$ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)$_
API String ID: 0-4228276721
Opcode ID: 0c8ade00b1f7dea8dbb79976ffb709fbacdeb7db542345f5bf60f1bb7bcab87e
Instruction ID: 7a7647d1f90ea7f8023c1e45dbfd0ef32ee4e86e1f57e2f17fee425c73206876
Opcode Fuzzy Hash: 0c8ade00b1f7dea8dbb79976ffb709fbacdeb7db542345f5bf60f1bb7bcab87e
Instruction Fuzzy Hash: C2727F71E00269DBDB24CF59D8807AEB7B5FF58310F24816AE809FB291D7709E81DB94

Function 00F3001C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00F30097
SetKeyboardState.USER32(?), ref: 00F30102
GetAsyncKeyState.USER32(000000A0), ref: 00F30122
GetKeyState.USER32(000000A0), ref: 00F30139
GetAsyncKeyState.USER32(000000A1), ref: 00F30168
GetKeyState.USER32(000000A1), ref: 00F30179
GetAsyncKeyState.USER32(00000011), ref: 00F301A5
GetKeyState.USER32(00000011), ref: 00F301B3
GetAsyncKeyState.USER32(00000012), ref: 00F301DC
GetKeyState.USER32(00000012), ref: 00F301EA
GetAsyncKeyState.USER32(0000005B), ref: 00F30213
GetKeyState.USER32(0000005B), ref: 00F30221

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: eb48c75a31932a4e4b0adba787c9abc7cc1dcb7412fe583e5bf54b37d498b650
Instruction ID: 43e1bfdf3ba1e18d16bff74c0a5a448530c1c94c2dddb654b42023fcc090111f
Opcode Fuzzy Hash: eb48c75a31932a4e4b0adba787c9abc7cc1dcb7412fe583e5bf54b37d498b650
Instruction Fuzzy Hash: 8051DC60D0478819FB35EBA488647EABFB49F013B0F08459FD9C1575C2DE649B8CE761

Function 00F503DA Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F50E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F4FDAD,?,?), ref: 00F50E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F504AC

Part of subcall function 00ED9837: __itow.LIBCMT ref: 00ED9862
Part of subcall function 00ED9837: __swprintf.LIBCMT ref: 00ED98AC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00F5054B
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00F505E3
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00F50822
RegCloseKey.ADVAPI32(00000000), ref: 00F5082F

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: b49b4699b1c8b98fcbe56d9f20e24e199b298f89ecf4c1a2653304021328ffc4
Instruction ID: 35cce75331dde083322195e72560771ef7fab7f03e2ebb9e50db51797800237d
Opcode Fuzzy Hash: b49b4699b1c8b98fcbe56d9f20e24e199b298f89ecf4c1a2653304021328ffc4
Instruction Fuzzy Hash: AAE15F71604214AFCB14DF28C891E2ABBE4FF89715F04856DF94ADB2A2DB30ED05DB91

Function 00F483BB Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED9837: __itow.LIBCMT ref: 00ED9862
Part of subcall function 00ED9837: __swprintf.LIBCMT ref: 00ED98AC

CoInitialize.OLE32 ref: 00F48403
CoUninitialize.OLE32 ref: 00F4840E
CoCreateInstance.OLE32(?,00000000,00000017,00F62BEC,?), ref: 00F4846E
IIDFromString.OLE32(?,?), ref: 00F484E1
VariantInit.OLEAUT32(?), ref: 00F4857B
VariantClear.OLEAUT32(?), ref: 00F485DC

Strings

NULL Pointer assignment, xrefs: 00F484B3
Failed to create object, xrefs: 00F48479, 00F4852F
Invalid parameter, xrefs: 00F484FA

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 4ccd6ceef0fa419da9204c46b953e035de8c95e32012b0a960b5e70567796db7
Instruction ID: b09cd797fc6ca085c3ce190a5ff2d89ad5d8cc1c0f7c64ad9835f9233e3c5b55
Opcode Fuzzy Hash: 4ccd6ceef0fa419da9204c46b953e035de8c95e32012b0a960b5e70567796db7
Instruction Fuzzy Hash: 496190716083129FC710DF14C848F6EBBE8AF457A4F044459FD859B2A1CB70ED4AEB92

Function 00F44164 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00F4418B
EmptyClipboard.USER32 ref: 00F44191
GlobalAlloc.KERNEL32(00000002,?), ref: 00F441A6
CloseClipboard.USER32 ref: 00F44245

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 060d4ebbe5f1d3e79943fe499631f89dc9fa8e9027f08cc87966024e415ea330
Instruction ID: 485044dd575535ba322cc40ef261068cb3ad01cd0a389fe5a21f5acc4c0d56b2
Opcode Fuzzy Hash: 060d4ebbe5f1d3e79943fe499631f89dc9fa8e9027f08cc87966024e415ea330
Instruction Fuzzy Hash: 1A21B5756002149FDB11AF64EC09B6E7BA8FF44721F10806AFE46EB2A1DB70BD41EB54

Function 00F337EF Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00ED4743,?,?,00ED37AE,?), ref: 00ED4770

Part of subcall function 00F34A31: GetFileAttributesW.KERNEL32(?,00F3370B), ref: 00F34A32

FindFirstFileW.KERNEL32(?,?), ref: 00F338A3
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00F3394B
MoveFileW.KERNEL32(?,?), ref: 00F3395E
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00F3397B
FindNextFileW.KERNEL32(00000000,00000010), ref: 00F3399D
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00F339B9

Strings

\*.*, xrefs: 00F3384E, 00F33857, 00F3386C

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: aa0664fd7a7875eddcb8db3b51e069c2287c848a568ef5247661be8782e1688d
Instruction ID: 8e41d5c27722d707659b0ebfe69d39a672cbc2028556d9f7c27ca30c01c603de
Opcode Fuzzy Hash: aa0664fd7a7875eddcb8db3b51e069c2287c848a568ef5247661be8782e1688d
Instruction Fuzzy Hash: 1A51917280514C9ACF01EBA4C992DEDB7B9EF14320F6000AAE44277291EF316F0EDB61

Function 00F3F3F3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED7DE1: _memmove.LIBCMT ref: 00ED7E22

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00F3F440
Sleep.KERNEL32(0000000A), ref: 00F3F470
_wcscmp.LIBCMT ref: 00F3F484
_wcscmp.LIBCMT ref: 00F3F49F
FindNextFileW.KERNEL32(?,?), ref: 00F3F53D
FindClose.KERNEL32(00000000), ref: 00F3F553

Strings

*.*, xrefs: 00F3F425

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: f52a7afc3a822f72b12be035d25300cdd6e78f51b874cad4af0859c160f2b094
Instruction ID: 22966fcf1acaf5ae2948b878e46da529dec0b312d9a4c610c7c847139ae9a400
Opcode Fuzzy Hash: f52a7afc3a822f72b12be035d25300cdd6e78f51b874cad4af0859c160f2b094
Instruction Fuzzy Hash: 6C415C72D0021AAFCF54EF64DC55AEEBBB4FF05320F144466E855A3291EB309E49EB50

Function 00EE3030 Relevance: 11.1, APIs: 4, Strings: 2, Instructions: 587COMMON

Download Yara Rule

Strings

_, xrefs: 00EE3322
3c, xrefs: 00EE3225

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: __itow__swprintf
String ID: 3c$_
API String ID: 674341424-4099079164
Opcode ID: 9ff63cc2ac11df4a6f4f105336f40bfbd6874cdca41539fdefcc57bd8d661206
Instruction ID: 2982017ba8f62e4baac605d47b03655930465c16485f9c8ef281e4f8785ecc0f
Opcode Fuzzy Hash: 9ff63cc2ac11df4a6f4f105336f40bfbd6874cdca41539fdefcc57bd8d661206
Instruction Fuzzy Hash: 0F22BC716083449FC724DF25C881BAEB7E4EF84714F00592DF99AA7392EB31E945CB92

Function 00EE5760 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00EE58A5
_memmove.LIBCMT ref: 00EE58F5
_memmove.LIBCMT ref: 00EE595B

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 7e46800c35a369c8afd00e420733fc889b90f7d927cf627af9a988fc7199af7d
Instruction ID: eec38a59269f32e16b6cc63a3df647523ef4f03922b710d0c0a456815c365171
Opcode Fuzzy Hash: 7e46800c35a369c8afd00e420733fc889b90f7d927cf627af9a988fc7199af7d
Instruction Fuzzy Hash: A812B971A00619DFDF04DFA5D981AEEB7F5FF48304F10952AE806B7292EB36A911CB50

Function 00F33B12 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00ED4743,?,?,00ED37AE,?), ref: 00ED4770

Part of subcall function 00F34A31: GetFileAttributesW.KERNEL32(?,00F3370B), ref: 00F34A32

FindFirstFileW.KERNEL32(?,?), ref: 00F33B89
DeleteFileW.KERNEL32(?,?,?,?), ref: 00F33BD9
FindNextFileW.KERNEL32(00000000,00000010), ref: 00F33BEA
FindClose.KERNEL32(00000000), ref: 00F33C01
FindClose.KERNEL32(00000000), ref: 00F33C0A

Strings

\*.*, xrefs: 00F33B5B

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 0adfd9692dc3e45e2af080a8cd6ff93786f8c1a138141250b848e042c2193bd9
Instruction ID: 618c285c0316cc8ac124e1ab029f3e26eb5bfd16781d7d4791af81bed18989fa
Opcode Fuzzy Hash: 0adfd9692dc3e45e2af080a8cd6ff93786f8c1a138141250b848e042c2193bd9
Instruction Fuzzy Hash: 75317E714083859FC301EF24D8918AFB7E8AE95324F405D6EF4E5A2291EB21DA0ED763

Function 00F351BD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00F287E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00F2882B
Part of subcall function 00F287E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00F28858
Part of subcall function 00F287E1: GetLastError.KERNEL32 ref: 00F28865

ExitWindowsEx.USER32(?,00000000), ref: 00F351F9

Strings

, xrefs: 00F351E7
@, xrefs: 00F351EC
SeShutdownPrivilege, xrefs: 00F351C9

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 9451ccf81bf24ae853be861e2bdf0085e4b15a15ce6463bfd07c013764ad9e30
Instruction ID: 1cc384a564c4ecce767480e34c5ac64cc7019d58a0d1fc3106c8cd6962cf134e
Opcode Fuzzy Hash: 9451ccf81bf24ae853be861e2bdf0085e4b15a15ce6463bfd07c013764ad9e30
Instruction Fuzzy Hash: A8012B32B916156BF7287268AC8AFBB7258DB85B71F240460F903E20D2DA51DC05B590

Function 00F46283 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006), ref: 00F462DC
WSAGetLastError.WSOCK32(00000000), ref: 00F462EB
bind.WSOCK32(00000000,?,00000010), ref: 00F46307
listen.WSOCK32(00000000,00000005), ref: 00F46316
WSAGetLastError.WSOCK32(00000000), ref: 00F46330
closesocket.WSOCK32(00000000), ref: 00F46344

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 1f6bc309907326292a717a79a88b407daab77b68744bbd362cc48dc42163bf95
Instruction ID: e9465f496db65f2a189ccc08ad2f4c646a530dfe3cc063f79e8596bbace5b440
Opcode Fuzzy Hash: 1f6bc309907326292a717a79a88b407daab77b68744bbd362cc48dc42163bf95
Instruction Fuzzy Hash: 0D21DD356002049FCB00AF64DC45A3EBBE8EF49721F14415AE916E73D2C770AC05EB51

Function 00EE5520 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00EF0DB6: std::exception::exception.LIBCMT ref: 00EF0DEC
Part of subcall function 00EF0DB6: __CxxThrowException@8.LIBCMT ref: 00EF0E01

_memmove.LIBCMT ref: 00F20258
_memmove.LIBCMT ref: 00F2036D
_memmove.LIBCMT ref: 00F20414

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: e02dd09419b582307439513274901d9d6a85b90dcf971b4c84ed336b141ac80e
Instruction ID: c617093a41ba8fd4869d35099677ec592bc845bbd41167cfc825f3cfa830353a
Opcode Fuzzy Hash: e02dd09419b582307439513274901d9d6a85b90dcf971b4c84ed336b141ac80e
Instruction Fuzzy Hash: 4B02CFB1A00219DBCF04DF64D981ABEBBF5EF44310F14806AE806EB296EB31DD51DB91

Function 00ED1287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00ED2612: GetWindowLongW.USER32(?,000000EB), ref: 00ED2623

DefDlgProcW.USER32(?,?,?,?,?), ref: 00ED19FA
GetSysColor.USER32(0000000F), ref: 00ED1A4E
SetBkColor.GDI32(?,00000000), ref: 00ED1A61

Part of subcall function 00ED1290: DefDlgProcW.USER32(?,00000020,?), ref: 00ED12D8

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 9339eb75fc04b412e347d11f1d9d5b200fa54cd9e4b76da3a0f2b964c7e06dd3
Instruction ID: dc708f54f32bf1bd0a75d51a9bb30f02f663c04fd1d458c936437db4283eb779
Opcode Fuzzy Hash: 9339eb75fc04b412e347d11f1d9d5b200fa54cd9e4b76da3a0f2b964c7e06dd3
Instruction Fuzzy Hash: 11A15C71106558BEEA28AB284C54EBF359CDB42356F14115FFA02F53D6CA28DD03B3B2

Function 00F3BCBC Relevance: 7.6, APIs: 5, Instructions: 143fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00F3BCE6
_wcscmp.LIBCMT ref: 00F3BD16
_wcscmp.LIBCMT ref: 00F3BD2B
FindNextFileW.KERNEL32(00000000,?), ref: 00F3BD3C
FindClose.KERNEL32(00000000,00000001,00000000), ref: 00F3BD6C

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: 2843623b6145918d329d26d8dbe85a67b5c4af727aa3669323548522975410b7
Instruction ID: 8a6e8664dfff5e57bf795e30254cb7c398a072e8279c10b4e89374ed44ee72e7
Opcode Fuzzy Hash: 2843623b6145918d329d26d8dbe85a67b5c4af727aa3669323548522975410b7
Instruction Fuzzy Hash: 1D51AD75A046029FC718DF28C8A1EAAB3E4EF49320F00465EEA56973A1DB30ED05DB91

Function 00F46747 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00F47D8B: inet_addr.WSOCK32(00000000), ref: 00F47DB6

socket.WSOCK32(00000002,00000002,00000011), ref: 00F4679E
WSAGetLastError.WSOCK32(00000000), ref: 00F467C7
bind.WSOCK32(00000000,?,00000010), ref: 00F46800
WSAGetLastError.WSOCK32(00000000), ref: 00F4680D
closesocket.WSOCK32(00000000), ref: 00F46821

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 6b159979e0d8d779fb75d44bfd486acc8a7ef30f4661c197900860ca93fcc881
Instruction ID: 66db8a4c81f1d1cf08fd5203e63ad12707c65f79de8eb378b86bb6039d421736
Opcode Fuzzy Hash: 6b159979e0d8d779fb75d44bfd486acc8a7ef30f4661c197900860ca93fcc881
Instruction Fuzzy Hash: BD41C275A00214AFDB10BF68DC86F2E77E8DF09B24F048459FA15AB3D3CA749D019792

Function 00F55376 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00F553C5
IsWindowEnabled.USER32 ref: 00F553D3
GetForegroundWindow.USER32(?,?,00000001), ref: 00F553E0
IsIconic.USER32 ref: 00F553EE
IsZoomed.USER32 ref: 00F553FC

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: b74cc6ee8afac74ae50acbafc010d3f4a258ebf873d84f659c1775fb998221c4
Instruction ID: 4e55134f24e6357f8faff0e7f5c7ec3aac2b3a2c42e3c108435235944501b881
Opcode Fuzzy Hash: b74cc6ee8afac74ae50acbafc010d3f4a258ebf873d84f659c1775fb998221c4
Instruction Fuzzy Hash: 35110431700A14AFDB216F26DC64A2E7B9AEF44BA2B444029FE49D7241DB70DC06A6A0

Function 00F280A9 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00F280C0
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00F280CA
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00F280D9
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00F280E0
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00F280F6

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: c2a30cd30549c3daa72a9e202d71ff800bf2c8453f3129a0f2c3a37d00764346
Instruction ID: e03fb1ae6e5cf79c85004e83fe1da9f2970fa065c90964a9c7afc86e6f8f0c06
Opcode Fuzzy Hash: c2a30cd30549c3daa72a9e202d71ff800bf2c8453f3129a0f2c3a37d00764346
Instruction Fuzzy Hash: 8FF06231246318AFEB100FA5EC8DE6B3BACEF497A6B040065FA45C7190CB619C56EA60

Function 00ED4B37 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00ED4AD0), ref: 00ED4B45
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00ED4B57

Strings

GetNativeSystemInfo, xrefs: 00ED4B51
kernel32.dll, xrefs: 00ED4B40

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 8f2c202f5df78076c0b6a840f2b43f9bc9e15e058236a97f90a369bf878c4acf
Instruction ID: 83c5c3738465c56322bc51e75cb784f73fe245d86fe0032370397a8435fdc76d
Opcode Fuzzy Hash: 8f2c202f5df78076c0b6a840f2b43f9bc9e15e058236a97f90a369bf878c4acf
Instruction Fuzzy Hash: 23D0C270A00B17DFC7209F31D818B0276D4AF52346B10887B99C1D6290E670D488D655

Function 00F4EE0D Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00F4EE3D
Process32FirstW.KERNEL32(00000000,?), ref: 00F4EE4B

Part of subcall function 00ED7DE1: _memmove.LIBCMT ref: 00ED7E22

Process32NextW.KERNEL32(00000000,?), ref: 00F4EF0B
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00F4EF1A

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 60370ee3686e083f2d76954f8af6428867aaf229f280bfa08377e49a9b1c0228
Instruction ID: 8d15dab1b9333a2553ecb49bf6e21a4657ae7e9d16114e7dd4509e241fd22c91
Opcode Fuzzy Hash: 60370ee3686e083f2d76954f8af6428867aaf229f280bfa08377e49a9b1c0228
Instruction Fuzzy Hash: 825171715047159FD310EF24DC81E6BBBE8FF94710F10582EF995972A1EB709909CB92

Function 00EDFCE0 Relevance: 5.5, APIs: 3, Instructions: 1040COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: 366b68506fde20a3de7cf827e5c3306037007b2bcc6d6419298bc65a3b96c059
Instruction ID: c559046b2e4d7cf259eaf4478ebbf66b501eaa963080d74703dc0cf8ff339b67
Opcode Fuzzy Hash: 366b68506fde20a3de7cf827e5c3306037007b2bcc6d6419298bc65a3b96c059
Instruction Fuzzy Hash: D1927C70A083858FD720DF15C480B6AB7E1FF85314F14992DE88AAB352D7B5EC85DB92

Function 00F2E616 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00F2E628

Strings

(, xrefs: 00F2E66E
|, xrefs: 00F2E658

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 5ef953ebb6ddf106d86b43a71d326f4c93727fb114152f63cf1dd20629569584
Instruction ID: 86331dfbefa13cdf97c5268a85c21f9fdaad6af4a3d760d1a532cad739c2af9a
Opcode Fuzzy Hash: 5ef953ebb6ddf106d86b43a71d326f4c93727fb114152f63cf1dd20629569584
Instruction Fuzzy Hash: 9E323775A007159FDB28CF59D481AAAB7F0FF48320B25C46EE89ADB3A1D770E941CB40

Function 00F422EE Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00F4180A,00000000), ref: 00F423E1
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00F42418

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 01f866ca1bbca3f721b87394c9d83586a0df5347defa71f804f709e34a52c252
Instruction ID: 6966324227132ccef0e1ba28e52f7ceeb39c0a9988b64c77fff3d91e3b029122
Opcode Fuzzy Hash: 01f866ca1bbca3f721b87394c9d83586a0df5347defa71f804f709e34a52c252
Instruction Fuzzy Hash: 4E41F372904209BFEB50DE95DC81FBBBBBCEB40324F50407AFE45A6152EA749E41B660

Function 00F3B3FB Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00F3B40B
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00F3B465
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00F3B4B2

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 31e9bf9f2d7790151a66eca2c6304ecaf62ed122c872e8afba3d4aa6fcbe63ff
Instruction ID: 4310f7dd76113acce9c2c9944fd39023296a82db641397f3a6f9e35d17ca4bf1
Opcode Fuzzy Hash: 31e9bf9f2d7790151a66eca2c6304ecaf62ed122c872e8afba3d4aa6fcbe63ff
Instruction Fuzzy Hash: 87215135A00608DFCB00EFA5DC80AEDBBB8FF49314F1480AAE905EB352CB319915DB50

Function 00F287E1 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00EF0DB6: std::exception::exception.LIBCMT ref: 00EF0DEC
Part of subcall function 00EF0DB6: __CxxThrowException@8.LIBCMT ref: 00EF0E01

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00F2882B
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00F28858
GetLastError.KERNEL32 ref: 00F28865

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: f9476d0f81a11d29ffc85669b14102e6df0751b663d93c6f6e59ad7c9c078789
Instruction ID: 0734dc62a12eb113429989905775b795cfa7cd27075f1f19f813200ca2739af2
Opcode Fuzzy Hash: f9476d0f81a11d29ffc85669b14102e6df0751b663d93c6f6e59ad7c9c078789
Instruction Fuzzy Hash: FB11BFB2804308AFE718DFA4EC85D6BB7F8EB04311B24856EF55593241EB30BC018B60

Function 00F2874B Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00F28774
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00F2878B
FreeSid.ADVAPI32(?), ref: 00F2879B

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 8735c310e99ceedc6ef6185c38dc5143e7eac9892e7dce3381ffcd0ef4548cb2
Instruction ID: 1919a47b44f1e4bde25cd780212901492c5951e9f3bdeaefd6132ad6d6ba08ea
Opcode Fuzzy Hash: 8735c310e99ceedc6ef6185c38dc5143e7eac9892e7dce3381ffcd0ef4548cb2
Instruction Fuzzy Hash: D4F04F7591130CBFDF00DFF4DC89AAEB7BCEF08311F1044A9AA01E2181D6715A089B50

Function 00F34C7F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 00F34CB3

Strings

DOWN, xrefs: 00F34C98

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: mouse_event
String ID: DOWN
API String ID: 2434400541-711622031
Opcode ID: 6a91134b6e1fdbc42196577956edeb6ab81679feaa31584e4dd8ec01605ffb75
Instruction ID: 6561690969e792872deee8efec52d62175a755ee4894568487c4dede240b39ac
Opcode Fuzzy Hash: 6a91134b6e1fdbc42196577956edeb6ab81679feaa31584e4dd8ec01605ffb75
Instruction Fuzzy Hash: 88E046221AD72238A9042958BC03EF7128C8B12371B20224AFA10E54C1EE807C8275B9

Function 00F3C6D1 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00F3C6FB
FindClose.KERNEL32(00000000), ref: 00F3C72B

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: fa4d2db3ddc26859d41a59f17bb653f1619b91c74e50bded628bf58e9658d276
Instruction ID: 66daca8049b54c1f6f1e31df180aa21198e0665b0f604361518e9df0feec1e0c
Opcode Fuzzy Hash: fa4d2db3ddc26859d41a59f17bb653f1619b91c74e50bded628bf58e9658d276
Instruction Fuzzy Hash: 48118E766002049FDB10EF29DC45A2AF7E8EF85325F00851EF9A9D73A1DB30A805DB81

Function 00F3A06A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00F49468,?,00F5FB84,?), ref: 00F3A097
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00F49468,?,00F5FB84,?), ref: 00F3A0A9

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 07a5a95624c145b021e4538ef70e91a35145b9f321b6760260a6bff5d7cda734
Instruction ID: 9fb5b6da2e06bc5f3974788c4f6ae21fdb1184c92fd6f3634b2f550a7f8a91f7
Opcode Fuzzy Hash: 07a5a95624c145b021e4538ef70e91a35145b9f321b6760260a6bff5d7cda734
Instruction Fuzzy Hash: 5CF0E23610432DABDB20AFA4CC48FEA736CFF08361F0041A6F948D3180D6309904DBA1

Function 00F281CB Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00F28309), ref: 00F281E0
CloseHandle.KERNEL32(?,?,00F28309), ref: 00F281F2

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 1dae80882df0469395b601b7d2ccfbe073edeedab793fae453da930d12c86b1f
Instruction ID: 70b363aab868733c7f963803a82a6d1cecad1131fa1cd08075e33dfcb70666ab
Opcode Fuzzy Hash: 1dae80882df0469395b601b7d2ccfbe073edeedab793fae453da930d12c86b1f
Instruction Fuzzy Hash: 68E08631001610AFEB212B20FC04D7377E9EF00311714886DF55580471CB215C91EB10

Function 00EFA155 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00EF8D57,?,?,?,00000001), ref: 00EFA15A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00EFA163

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 57a7fca5790c5fc255ee38962d903c779b39291ad0c992a999068a9a14712872
Instruction ID: 773c7e12cdaa0b973ac8cb3be7ec47e3d8291cafbdc3c1e0424e9d5612caf2d8
Opcode Fuzzy Hash: 57a7fca5790c5fc255ee38962d903c779b39291ad0c992a999068a9a14712872
Instruction Fuzzy Hash: 9FB0923105430CABEA002F91ED09B893F68EB46AA3F4040A0F70D84070CB625454AA91

Function 00EDE6A0 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00F13E62

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: 54870f9e0bdd01e84540200ab61d1ebbddfc7b5594663b755a4d7c4c23f74ef3
Instruction ID: 2bfa8256ebb9ebd3e7cc46a97f1d4afbc01aec6af3bf731577d378f9503c035e
Opcode Fuzzy Hash: 54870f9e0bdd01e84540200ab61d1ebbddfc7b5594663b755a4d7c4c23f74ef3
Instruction Fuzzy Hash: F0A28D75A00209CFCB24DF58C884AAEB7B2FF59314F24905AE816AF351D775ED82DB90

Function 00EFF1D9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 973b818caf853693d0abb8b596f240d48de94d18c6ac64689341cded386dfcc0
Instruction ID: 86ef890d6e9fc176fb77bff4d2e6e00188c0198ae5b43abdcd3b958aa2355bd6
Opcode Fuzzy Hash: 973b818caf853693d0abb8b596f240d48de94d18c6ac64689341cded386dfcc0
Instruction Fuzzy Hash: 43321721D29F494DD723A634D832335A248AFF73D8F15D737F829B5AAAEB68C4835100

Function 00F0242E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 327ecc85c2e7882bea7a083c8916d354587f037da265b539810d70441146f086
Instruction ID: b2d063f057b0c07ad353ce43728dacf1b95d2c76df70a9a185174e396a5dff27
Opcode Fuzzy Hash: 327ecc85c2e7882bea7a083c8916d354587f037da265b539810d70441146f086
Instruction Fuzzy Hash: 58B12130D2AF444DD32396398836336B64CAFBB2C5F51D71BFC2670E62EB6285836641

Function 00F38889 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00F3889B

Part of subcall function 00EF520A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00F38F6E,00000000,?,?,?,?,00F3911F,00000000,?), ref: 00EF5213
Part of subcall function 00EF520A: __aulldiv.LIBCMT ref: 00EF5233

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: 49b2e9c5917fd49cb74793c75d9c84f993cf17591cec9884df7d94996addab3a
Instruction ID: 2b8db80169412e2c97880db0942db08bac38b9757f6c13ef73d2efe7123103db
Opcode Fuzzy Hash: 49b2e9c5917fd49cb74793c75d9c84f993cf17591cec9884df7d94996addab3a
Instruction Fuzzy Hash: 9021B432A35610CBC729CF25D841A52B3E1EFA5321F698E6DE1F5CB2D0CA34B905DB54

Function 00F287B1 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00F28389), ref: 00F287D1

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 3454ffed5b3edd72482db6cd30441e7d62085984008ae028e550d629f3d3742a
Instruction ID: 013e373cf8746083044adfe4071c1e41d614ab43da31d205dfa4d477e084761f
Opcode Fuzzy Hash: 3454ffed5b3edd72482db6cd30441e7d62085984008ae028e550d629f3d3742a
Instruction Fuzzy Hash: BDD05E3226060EABEF018EA4DC01EAE3B69EB04B01F408111FE15C50A1C775D835AB60

Function 00EFA124 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00EFA12A

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: bf5207311d2b60265796e3f27ac954f50d9a7fd08137d139bfc0c44e3aac9018
Instruction ID: 5d3543bef3d88f02f8532f3fd0c043d72cacc9ea476df9fd2ccdc93b3ea7ad5e
Opcode Fuzzy Hash: bf5207311d2b60265796e3f27ac954f50d9a7fd08137d139bfc0c44e3aac9018
Instruction Fuzzy Hash: F7A0123000020CA78A002F41EC044447F5CD7011917004060F50C40031873254105580

Function 00EE8808 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1553b90280301759e4476f6f46f6e1222df5113213de57256db7c47e741b5193
Instruction ID: d131ee106b710f70e48a0757fb4b791a78483e32039a5d9bd5b91b43b96fad80
Opcode Fuzzy Hash: 1553b90280301759e4476f6f46f6e1222df5113213de57256db7c47e741b5193
Instruction Fuzzy Hash: 7A227831D049AACBDF388B56E59437C77A1FB40318F28906BD84EAB492DB70DC91E741

Function 00EF21C5 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 5742148dc02cf7023f59d9eeaa5c73558b55bd538db995048de2e13b1a79b0c6
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: DDC1A83220509B4ADF2D463A843403EFBA15EA27B631A279DD6B3EB1D4EF10CA25D610

Function 00EF25FA Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 3e6b04c5aad3dd803b6165c12df29f8d88e99a286fab83e5a42c3956769ecbaf
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 43C1783220519B49DF2D463AC43413EFAA15EE27B631A279DD6B3EF1D4EF10CA25D610

Function 00EF1978 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: c310c53acd42416dad9c0144caa73035bc6c56270554d2d5189b98763fdbaf59
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 75C1863220519F89DF2D463AC47413EFBA15EA27B631A27DDD5B3EB1C4EE10CA25D620

Function 017EC950 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711926957.00000000017E9000.00000040.00000020.00020000.00000000.sdmp, Offset: 017E9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17e9000_UF7jzc7ETP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction ID: de889cbfc89724d064fbd9fa87e11ed3297e69bf132bdfacac182adc6c848ba7
Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction Fuzzy Hash: F841C271D1051CEBCF48CFADC991AAEFBF2AF88201F548299D516AB345D730AB41DB80

Function 017EC7E0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711926957.00000000017E9000.00000040.00000020.00020000.00000000.sdmp, Offset: 017E9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17e9000_UF7jzc7ETP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction ID: 309c5466bc226a3165c0526581966fd0204fe5b8f029220f5348501c502336b7
Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction Fuzzy Hash: CC018078A00209EFCB49DF98C6949AEF7F5FB48310F208599D819A7345D730AE51DB80

Function 017EC840 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711926957.00000000017E9000.00000040.00000020.00020000.00000000.sdmp, Offset: 017E9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17e9000_UF7jzc7ETP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction ID: 3c4fd34f8f55c57b0c483759ad6d55fa8f8d4de00cf54c50e299751a8a9c3cc7
Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction Fuzzy Hash: DD018078A01209EFCB45DF98C6949AEF7F5FB48310F208599D819A7705D730AE51DB80

Function 017EB190 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1711926957.00000000017E9000.00000040.00000020.00020000.00000000.sdmp, Offset: 017E9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_17e9000_UF7jzc7ETP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48

Function 00F47806 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00F4785B
DeleteObject.GDI32(00000000), ref: 00F4786D
DestroyWindow.USER32 ref: 00F4787B
GetDesktopWindow.USER32 ref: 00F47895
GetWindowRect.USER32(00000000), ref: 00F4789C
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00F479DD
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00F479ED
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F47A35
GetClientRect.USER32(00000000,?), ref: 00F47A41
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00F47A7B
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F47A9D
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F47AB0
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F47ABB
GlobalLock.KERNEL32(00000000), ref: 00F47AC4
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F47AD3
GlobalUnlock.KERNEL32(00000000), ref: 00F47ADC
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F47AE3
GlobalFree.KERNEL32(00000000), ref: 00F47AEE
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F47B00
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00F62CAC,00000000), ref: 00F47B16
GlobalFree.KERNEL32(00000000), ref: 00F47B26
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00F47B4C
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00F47B6B
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F47B8D
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00F47D7A

Strings

AutoIt v3, xrefs: 00F47A2D
DISPLAY, xrefs: 00F47BDD
, xrefs: 00F47D00
static, xrefs: 00F47A75, 00F47BCC

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: dd77b723e23522debaa17d345052e911fef477240036f6a9478543120cc84b35
Instruction ID: c665709e45d2d59509f1f557ebd67359fa58f835bf1b600e2fc06681580e438c
Opcode Fuzzy Hash: dd77b723e23522debaa17d345052e911fef477240036f6a9478543120cc84b35
Instruction Fuzzy Hash: 1F027E71900219EFDB14EFA4DC89EAE7BB9FF48311F148159FA15AB2A1C730AD05DB60

Function 00F5356B Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00F5F910), ref: 00F53627
IsWindowVisible.USER32(?), ref: 00F5364B

Strings

GETLINECOUNT, xrefs: 00F538C6
DELSTRING, xrefs: 00F53749
UNCHECK, xrefs: 00F53883
SETCURRENTSELECTION, xrefs: 00F537B6
GETLINE, xrefs: 00F5399B
EDITPASTE, xrefs: 00F5395F
GETSELECTED, xrefs: 00F538A3
ISCHECKED, xrefs: 00F53839
GETCURRENTSELECTION, xrefs: 00F537E3
GETCURRENTLINE, xrefs: 00F538ED
CURRENTTAB, xrefs: 00F536BD
CHECK, xrefs: 00F5386D
SHOWDROPDOWN, xrefs: 00F536E0
TABRIGHT, xrefs: 00F5369D
ADDSTRING, xrefs: 00F53716
HIDEDROPDOWN, xrefs: 00F53700
ISENABLED, xrefs: 00F5366B
FINDSTRING, xrefs: 00F53776
SENDCOMMANDID, xrefs: 00F539DA
SELECTSTRING, xrefs: 00F53806
TABLEFT, xrefs: 00F53687
GETCURRENTCOL, xrefs: 00F53928
ISVISIBLE, xrefs: 00F53637

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 3a25c8d4470e740de31a64f1b2e33e6bd8ac0fba00dd39d3ae43067f34e361d5
Instruction ID: 788e48ca71aa3c34d745072d3380e8a5a3ed4fd55bb5b65fb6566a6bfa98d824
Opcode Fuzzy Hash: 3a25c8d4470e740de31a64f1b2e33e6bd8ac0fba00dd39d3ae43067f34e361d5
Instruction Fuzzy Hash: 97D19E356087019BCB04EF14C951AAE7BE1AF94395F084459FD826B3A3DB35EE0EEB41

Function 00F5A5DA Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00F5A630
GetSysColorBrush.USER32(0000000F), ref: 00F5A661
GetSysColor.USER32(0000000F), ref: 00F5A66D
SetBkColor.GDI32(?,000000FF), ref: 00F5A687
SelectObject.GDI32(?,00000000), ref: 00F5A696
InflateRect.USER32(?,000000FF,000000FF), ref: 00F5A6C1
GetSysColor.USER32(00000010), ref: 00F5A6C9
CreateSolidBrush.GDI32(00000000), ref: 00F5A6D0
FrameRect.USER32(?,?,00000000), ref: 00F5A6DF
DeleteObject.GDI32(00000000), ref: 00F5A6E6
InflateRect.USER32(?,000000FE,000000FE), ref: 00F5A731
FillRect.USER32(?,?,00000000), ref: 00F5A763
GetWindowLongW.USER32(?,000000F0), ref: 00F5A78E

Part of subcall function 00F5A8CA: GetSysColor.USER32(00000012), ref: 00F5A903
Part of subcall function 00F5A8CA: SetTextColor.GDI32(?,?), ref: 00F5A907
Part of subcall function 00F5A8CA: GetSysColorBrush.USER32(0000000F), ref: 00F5A91D
Part of subcall function 00F5A8CA: GetSysColor.USER32(0000000F), ref: 00F5A928
Part of subcall function 00F5A8CA: GetSysColor.USER32(00000011), ref: 00F5A945
Part of subcall function 00F5A8CA: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00F5A953
Part of subcall function 00F5A8CA: SelectObject.GDI32(?,00000000), ref: 00F5A964
Part of subcall function 00F5A8CA: SetBkColor.GDI32(?,00000000), ref: 00F5A96D
Part of subcall function 00F5A8CA: SelectObject.GDI32(?,?), ref: 00F5A97A
Part of subcall function 00F5A8CA: InflateRect.USER32(?,000000FF,000000FF), ref: 00F5A999
Part of subcall function 00F5A8CA: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00F5A9B0
Part of subcall function 00F5A8CA: GetWindowLongW.USER32(00000000,000000F0), ref: 00F5A9C5
Part of subcall function 00F5A8CA: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00F5A9ED

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: 3c63428c3c509ca01e133685ae0b8182893c00060a7781387894d9a3af609f65
Instruction ID: dcca96bb4e8f8f904f3e495457182dfe40d6d8c359663e710dae1d808d056f48
Opcode Fuzzy Hash: 3c63428c3c509ca01e133685ae0b8182893c00060a7781387894d9a3af609f65
Instruction Fuzzy Hash: 16917D72408705AFC7119F64DC08A5B7BA9FF88332F140B69FA62961E1D731D948EB52

Function 00ED2C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00ED2CA2
DeleteObject.GDI32(00000000), ref: 00ED2CE8
DeleteObject.GDI32(00000000), ref: 00ED2CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00ED2CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00ED2D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 00F0C43B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00F0C474
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00F0C89D

Part of subcall function 00ED1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00ED2036,?,00000000,?,?,?,?,00ED16CB,00000000,?), ref: 00ED1B9A

SendMessageW.USER32(?,00001053), ref: 00F0C8DA
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00F0C8F1
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00F0C907
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00F0C912

Strings

0, xrefs: 00F0C731

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: fd16281c25545c8b932112085750fbe229e113b2634d7405620b7244785da084
Instruction ID: c23ccd68e8c678293a32772646e3368ce2d55434f42e03fc22f27144217a5302
Opcode Fuzzy Hash: fd16281c25545c8b932112085750fbe229e113b2634d7405620b7244785da084
Instruction Fuzzy Hash: 56129E30600201DFDB21CF24C884BA9BBE1FF54311F58466AEA59DB2A2C731EC46FB91

Function 00F474AB Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00F474DE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00F4759D
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00F475DB
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00F475ED
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00F47633
GetClientRect.USER32(00000000,?), ref: 00F4763F
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00F47683
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00F47692
GetStockObject.GDI32(00000011), ref: 00F476A2
SelectObject.GDI32(00000000,00000000), ref: 00F476A6
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00F476B6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00F476BF
DeleteDC.GDI32(00000000), ref: 00F476C8
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00F476F4
SendMessageW.USER32(00000030,00000000,00000001), ref: 00F4770B
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00F47746
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00F4775A
SendMessageW.USER32(00000404,00000001,00000000), ref: 00F4776B
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00F4779B
GetStockObject.GDI32(00000011), ref: 00F477A6
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00F477B1
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00F477BB

Strings

AutoIt v3, xrefs: 00F4762B
DISPLAY, xrefs: 00F47688
msctls_progress32, xrefs: 00F4773C
static, xrefs: 00F4767D, 00F47795

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: a2352f3989a069cdcafa377936ab1f5c70e0b5e4da0d737792b9d6ef5b4649d3
Instruction ID: 20bcf0fdc79cc9a1f20776158d111ae4a5e0311cfe8f8fa112085e409f0bc808
Opcode Fuzzy Hash: a2352f3989a069cdcafa377936ab1f5c70e0b5e4da0d737792b9d6ef5b4649d3
Instruction Fuzzy Hash: EFA1AFB1A00609BFEB14DBA4DC4AFAE7BB9EB08711F004155FA14EB2E0C770AD05DB60

Function 00F3AD10 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00F3AD1E
GetDriveTypeW.KERNEL32(?,00F5FAC0,?,\\.\,00F5F910), ref: 00F3ADFB
SetErrorMode.KERNEL32(00000000,00F5FAC0,?,\\.\,00F5F910), ref: 00F3AF59

Strings

ATAPI, xrefs: 00F3AECD
Fixed, xrefs: 00F3AE43
Unknown, xrefs: 00F3AE1B, 00F3AEBF
SAS, xrefs: 00F3AF05
SATA, xrefs: 00F3AF0C
iSCSI, xrefs: 00F3AEFE
RAMDisk, xrefs: 00F3AE25
SSD, xrefs: 00F3AE86
Network, xrefs: 00F3AE39
Virtual, xrefs: 00F3AF21
Removable, xrefs: 00F3AE4D
Fibre, xrefs: 00F3AEE9
SCSI, xrefs: 00F3AEC6
MMC, xrefs: 00F3AF1A
ATA, xrefs: 00F3AED4
PhysicalDrive, xrefs: 00F3ADA7
CDROM, xrefs: 00F3AE2F
\\.\, xrefs: 00F3AD70
RAID, xrefs: 00F3AEF7
SSA, xrefs: 00F3AEE2
USB, xrefs: 00F3AEF0
1394, xrefs: 00F3AEDB
FileBackedVirtual, xrefs: 00F3AF28

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: ccbbfcb5371e837972e8c8d76d991653b60477d6ae3f318ccb5ec5b1e113a226
Instruction ID: 039532551d7fc32b62c0d15cede40d66c1a7b7d091aaf868fbb3651ce2bb6cb5
Opcode Fuzzy Hash: ccbbfcb5371e837972e8c8d76d991653b60477d6ae3f318ccb5ec5b1e113a226
Instruction Fuzzy Hash: 515190B5A44209AB8B14EB22CD82DBD73A1EF48770F604157E487A72D1DA35DD42FB43

Function 00ED68DC Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00ED6931
__wcsnicmp.LIBCMT ref: 00ED6949
__wcsnicmp.LIBCMT ref: 00ED6961
__wcsnicmp.LIBCMT ref: 00ED6979
__wcsnicmp.LIBCMT ref: 00ED6991
__wcsnicmp.LIBCMT ref: 00ED69A9
__wcsnicmp.LIBCMT ref: 00ED69C1
__wcsnicmp.LIBCMT ref: 00ED69D5
__wcsnicmp.LIBCMT ref: 00ED6A16
__wcsnicmp.LIBCMT ref: 00ED6A2A
__wcsnicmp.LIBCMT ref: 00ED6A3E
__wcsnicmp.LIBCMT ref: 00ED6A52

Strings

#comments-end, xrefs: 00ED6A38
#OnAutoItStartRegister, xrefs: 00ED6973
Cannot parse #include, xrefs: 00F0E3F0
#include-once, xrefs: 00ED698B
#notrayicon, xrefs: 00ED6943
Bad directive syntax error, xrefs: 00F0E31A
#requireadmin, xrefs: 00ED695B
#include, xrefs: 00ED69A3
#comments-start, xrefs: 00ED69BB, 00ED6A10
Unterminated group of comments, xrefs: 00F0E403
#ce, xrefs: 00ED6A4C
#pragma compile, xrefs: 00ED692B
#cs, xrefs: 00ED69CF, 00ED6A24

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 8c7ff98f2a6ed37f0b5fcc6dc8e9e7d75ae4d291e231b2aaaca11ac268de2ab6
Instruction ID: 51636642f1f08f029c2ba03d87cafc5aa8742f4fd1cd291ea873586be6dde8d1
Opcode Fuzzy Hash: 8c7ff98f2a6ed37f0b5fcc6dc8e9e7d75ae4d291e231b2aaaca11ac268de2ab6
Instruction Fuzzy Hash: E88107B1640219AACF20AB60DC52FBF3BA8EF05750F046026FD457B2D2EB71DA46E251

Function 00F5A8CA Relevance: 39.2, APIs: 26, Instructions: 187windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00F5A903
SetTextColor.GDI32(?,?), ref: 00F5A907
GetSysColorBrush.USER32(0000000F), ref: 00F5A91D
GetSysColor.USER32(0000000F), ref: 00F5A928
CreateSolidBrush.GDI32(?), ref: 00F5A92D
GetSysColor.USER32(00000011), ref: 00F5A945
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00F5A953
SelectObject.GDI32(?,00000000), ref: 00F5A964
SetBkColor.GDI32(?,00000000), ref: 00F5A96D
SelectObject.GDI32(?,?), ref: 00F5A97A
InflateRect.USER32(?,000000FF,000000FF), ref: 00F5A999
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00F5A9B0
GetWindowLongW.USER32(00000000,000000F0), ref: 00F5A9C5
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00F5A9ED
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00F5AA14
InflateRect.USER32(?,000000FD,000000FD), ref: 00F5AA32
DrawFocusRect.USER32(?,?), ref: 00F5AA3D
GetSysColor.USER32(00000011), ref: 00F5AA4B
SetTextColor.GDI32(?,00000000), ref: 00F5AA53
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00F5AA67
SelectObject.GDI32(?,00F5A5FA), ref: 00F5AA7E
DeleteObject.GDI32(?), ref: 00F5AA89
SelectObject.GDI32(?,?), ref: 00F5AA8F
DeleteObject.GDI32(?), ref: 00F5AA94
SetTextColor.GDI32(?,?), ref: 00F5AA9A
SetBkColor.GDI32(?,?), ref: 00F5AAA4

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 95c15a89dd9e9d83e0832d487901dfae72c92baf045858c8d7842d2de4e63356
Instruction ID: e37e7a08b51009787c210c0d1c6ca4acb2861d06fa4f9aa7f9789321cdcbc3dc
Opcode Fuzzy Hash: 95c15a89dd9e9d83e0832d487901dfae72c92baf045858c8d7842d2de4e63356
Instruction Fuzzy Hash: 6F516C71800618EFDF109FA4DC48EAE7BB9FF08322F154265FA11AB2A1D7719954EF90

Function 00F589D5 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00F58AC1
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00F58AD2
CharNextW.USER32(0000014E), ref: 00F58B01
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00F58B42
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00F58B58
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00F58B69
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00F58B86
SetWindowTextW.USER32(?,0000014E), ref: 00F58BD8
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00F58BEE
SendMessageW.USER32(?,00001002,00000000,?), ref: 00F58C1F
_memset.LIBCMT ref: 00F58C44
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00F58C8D
_memset.LIBCMT ref: 00F58CEC
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00F58D16
SendMessageW.USER32(?,00001074,?,00000001), ref: 00F58D6E
SendMessageW.USER32(?,0000133D,?,?), ref: 00F58E1B
InvalidateRect.USER32(?,00000000,00000001), ref: 00F58E3D
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00F58E87
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00F58EB4
DrawMenuBar.USER32(?), ref: 00F58EC3
SetWindowTextW.USER32(?,0000014E), ref: 00F58EEB

Strings

0, xrefs: 00F58E55

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 141f117c43dcb53337b6dd63f590b991c37c4b9d391f7123be87658980f7e952
Instruction ID: 09843a742c9766f547d53ac88c7be10267275bb14f848bfbd508572cf8bf929e
Opcode Fuzzy Hash: 141f117c43dcb53337b6dd63f590b991c37c4b9d391f7123be87658980f7e952
Instruction Fuzzy Hash: 4CE15171900208EBDB119F50CC84EEE7BB9EF09761F108156FE15BA191DB748A8AEF61

Function 00F5488F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00F549CA
GetDesktopWindow.USER32 ref: 00F549DF
GetWindowRect.USER32(00000000), ref: 00F549E6
GetWindowLongW.USER32(?,000000F0), ref: 00F54A48
DestroyWindow.USER32(?), ref: 00F54A74
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00F54A9D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00F54ABB
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00F54AE1
SendMessageW.USER32(?,00000421,?,?), ref: 00F54AF6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00F54B09
IsWindowVisible.USER32(?), ref: 00F54B29
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00F54B44
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00F54B58
GetWindowRect.USER32(?,?), ref: 00F54B70
MonitorFromPoint.USER32(?,?,00000002), ref: 00F54B96
GetMonitorInfoW.USER32(00000000,?), ref: 00F54BB0
CopyRect.USER32(?,?), ref: 00F54BC7
SendMessageW.USER32(?,00000412,00000000), ref: 00F54C32

Strings

(, xrefs: 00F54BA3
tooltips_class32, xrefs: 00F54A96
0, xrefs: 00F54975

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 860f2798ec989d7150b347101c543fbbb3e5ba716e7e14a4f870bff18f0f9177
Instruction ID: 24a5e9bd9dfd4197e4a8a6675a12668eee49440f5556abe9b1b944a851f0df1c
Opcode Fuzzy Hash: 860f2798ec989d7150b347101c543fbbb3e5ba716e7e14a4f870bff18f0f9177
Instruction Fuzzy Hash: BDB1BD71604340AFDB04DF64C849B6ABBE4FF88315F00891DFA99AB2A1D770EC49DB95

Function 00ED27D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00ED28BC
GetSystemMetrics.USER32(00000007), ref: 00ED28C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00ED28EF
GetSystemMetrics.USER32(00000008), ref: 00ED28F7
GetSystemMetrics.USER32(00000004), ref: 00ED291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00ED2939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00ED2949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00ED297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00ED2990
GetClientRect.USER32(00000000,000000FF), ref: 00ED29AE
GetStockObject.GDI32(00000011), ref: 00ED29CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 00ED29D5

Part of subcall function 00ED2344: GetCursorPos.USER32(?), ref: 00ED2357
Part of subcall function 00ED2344: ScreenToClient.USER32(00F957B0,?), ref: 00ED2374
Part of subcall function 00ED2344: GetAsyncKeyState.USER32(00000001), ref: 00ED2399
Part of subcall function 00ED2344: GetAsyncKeyState.USER32(00000002), ref: 00ED23A7

SetTimer.USER32(00000000,00000000,00000028,00ED1256), ref: 00ED29FC

Strings

AutoIt v3 GUI, xrefs: 00ED2974

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 0cffbf61b1f6b2534c5a7b17f5386a975a4987bebcad1865dba7836dca84c0cc
Instruction ID: 8abd7512aa76764d0759d64d2bbb31f0bf1a14112497f1f4d75e37850e6b2c01
Opcode Fuzzy Hash: 0cffbf61b1f6b2534c5a7b17f5386a975a4987bebcad1865dba7836dca84c0cc
Instruction Fuzzy Hash: D3B18D71A0020AEFDB15DFA8DC45BAE7BB4FB18711F10422AFA15E72E0DB749841EB50

Function 00F0A8CB Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 211COMMONLIBRARYCODE

Download Yara Rule

APIs

_copy_environ.LIBCMT ref: 00F0A92B
___wtomb_environ.LIBCMT ref: 00F0A94D

Part of subcall function 00EF8B28: __getptd_noexit.LIBCMT ref: 00EF8B28

__malloc_crt.LIBCMT ref: 00F0A975
__malloc_crt.LIBCMT ref: 00F0A992
_free.LIBCMT ref: 00F0A9C9
__recalloc_crt.LIBCMT ref: 00F0AA02
__recalloc_crt.LIBCMT ref: 00F0AA47
_strlen.LIBCMT ref: 00F0AA73
__calloc_crt.LIBCMT ref: 00F0AA7D
_strlen.LIBCMT ref: 00F0AA8C
SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000), ref: 00F0AABA
_free.LIBCMT ref: 00F0AAD4
_free.LIBCMT ref: 00F0AAE1
_free.LIBCMT ref: 00F0AAF3
__invoke_watson.LIBCMT ref: 00F0AB0D

Strings

{n, xrefs: 00F0AAAD
{n, xrefs: 00F0A932

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
String ID: {n${n
API String ID: 884005220-1873021148
Opcode ID: d1f54f43c2e65488c7fd0fc4e73b835869e22d3995ac28741120e0afdc1e4dba
Instruction ID: 98161f1d27803cdaac4c8e0fb5f1ed2c1aca7d55eaf92bf7d8b93b65dfd9ad2e
Opcode Fuzzy Hash: d1f54f43c2e65488c7fd0fc4e73b835869e22d3995ac28741120e0afdc1e4dba
Instruction Fuzzy Hash: 2C61E472E00309EFDB119F64DD0277A77A4EF00771F21511AE901AB1E1EB799941F792

Function 00F2A439 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00F2A47A
__swprintf.LIBCMT ref: 00F2A51B
_wcscmp.LIBCMT ref: 00F2A52E
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00F2A583
_wcscmp.LIBCMT ref: 00F2A5BF
GetClassNameW.USER32(?,?,00000400), ref: 00F2A5F6
GetDlgCtrlID.USER32(?), ref: 00F2A648
GetWindowRect.USER32(?,?), ref: 00F2A67E
GetParent.USER32(?), ref: 00F2A69C
ScreenToClient.USER32(00000000), ref: 00F2A6A3
GetClassNameW.USER32(?,?,00000100), ref: 00F2A71D
_wcscmp.LIBCMT ref: 00F2A731
GetWindowTextW.USER32(?,?,00000400), ref: 00F2A757
_wcscmp.LIBCMT ref: 00F2A76B

Part of subcall function 00EF362C: _iswctype.LIBCMT ref: 00EF3634

Strings

%s%u, xrefs: 00F2A515

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 2ca2e545bdc47e9b8cfe8db89c625f1805b8a25828a3c0d5931641eb31f746ab
Instruction ID: 6ab719b3486bf431f1caeea862001902d0cbe1c14f360090f297abf6a78bf40f
Opcode Fuzzy Hash: 2ca2e545bdc47e9b8cfe8db89c625f1805b8a25828a3c0d5931641eb31f746ab
Instruction Fuzzy Hash: B9A10271604726BFC714DF60D884FAAB7E8FF44320F008529FA99D6190EB30E955DB92

Function 00F2AED4 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00F2AF18
_wcscmp.LIBCMT ref: 00F2AF29
GetWindowTextW.USER32(00000001,?,00000400), ref: 00F2AF51
CharUpperBuffW.USER32(?,00000000), ref: 00F2AF6E
_wcscmp.LIBCMT ref: 00F2AF8C
_wcsstr.LIBCMT ref: 00F2AF9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00F2AFD5
_wcscmp.LIBCMT ref: 00F2AFE5
GetWindowTextW.USER32(00000002,?,00000400), ref: 00F2B00C
GetClassNameW.USER32(00000018,?,00000400), ref: 00F2B055
_wcscmp.LIBCMT ref: 00F2B065
GetClassNameW.USER32(00000010,?,00000400), ref: 00F2B08D
GetWindowRect.USER32(00000004,?), ref: 00F2B0F6

Strings

ThumbnailClass, xrefs: 00F2AFE0, 00F2B060
@, xrefs: 00F2AEF9

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 6818b992fbda245e0ea3bca87ed00eee8aea7ee8c5a7c1b37d1fc57f43d4b778
Instruction ID: 85ba45b01cd97f79a53ac7e4aa2312893c2f4f5f1221cf11df72907c3e030424
Opcode Fuzzy Hash: 6818b992fbda245e0ea3bca87ed00eee8aea7ee8c5a7c1b37d1fc57f43d4b778
Instruction Fuzzy Hash: 4A81D1714083199FDB01DF10E985FAA77E8FF84324F04846AFD859A096DB34DD49EB62

Function 00F2ABD4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00F2AC33

Strings

HANDLE=, xrefs: 00F2AC2C
[ACTIVE, xrefs: 00F2AC20
ALL, xrefs: 00F2ACC7
LAST, xrefs: 00F2ABF8
[CLASS:, xrefs: 00F2AC83
[ALL, xrefs: 00F2ACD9
CLASSNAME=, xrefs: 00F2AC70
ACTIVE, xrefs: 00F2AC0E
[REGEXPTITLE:, xrefs: 00F2AC5B
[LAST, xrefs: 00F2ACE0
REGEXP=, xrefs: 00F2AC48
[HANDLE:, xrefs: 00F2AC3F

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: a2871f6db4bbe08c7227b62082ee0cc390f85aba48d31fcd79a0fa569e6e5a1c
Instruction ID: 7a6b08ea88d0acf7f0986e483e66cb3f0a0c78fc4e50d7499a79c4b9fe062c57
Opcode Fuzzy Hash: a2871f6db4bbe08c7227b62082ee0cc390f85aba48d31fcd79a0fa569e6e5a1c
Instruction Fuzzy Hash: 8A31A131988319ABDB04FB60EE43FEE77A49B10760F30101AB451711E1FB65EF04A652

Function 00F44FFD Relevance: 25.6, APIs: 17, Instructions: 110COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 00F45013
LoadCursorW.USER32(00000000,00007F00), ref: 00F4501E
LoadCursorW.USER32(00000000,00007F03), ref: 00F45029
LoadCursorW.USER32(00000000,00007F8B), ref: 00F45034
LoadCursorW.USER32(00000000,00007F01), ref: 00F4503F
LoadCursorW.USER32(00000000,00007F81), ref: 00F4504A
LoadCursorW.USER32(00000000,00007F88), ref: 00F45055
LoadCursorW.USER32(00000000,00007F80), ref: 00F45060
LoadCursorW.USER32(00000000,00007F86), ref: 00F4506B
LoadCursorW.USER32(00000000,00007F83), ref: 00F45076
LoadCursorW.USER32(00000000,00007F85), ref: 00F45081
LoadCursorW.USER32(00000000,00007F82), ref: 00F4508C
LoadCursorW.USER32(00000000,00007F84), ref: 00F45097
LoadCursorW.USER32(00000000,00007F04), ref: 00F450A2
LoadCursorW.USER32(00000000,00007F02), ref: 00F450AD
LoadCursorW.USER32(00000000,00007F89), ref: 00F450B8
GetCursorInfo.USER32(?), ref: 00F450C8

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: 038a6928a623390c8153a5f8ec75cf56e7c9b529f063660c2faa7abfb6162f7e
Instruction ID: c201e9b63a770e3e4bf06fd62b0bbb55e314f8e0e2786a5a008cf269ac8f63ff
Opcode Fuzzy Hash: 038a6928a623390c8153a5f8ec75cf56e7c9b529f063660c2faa7abfb6162f7e
Instruction Fuzzy Hash: 1131F4B1D4831E6BDF109FB68C8995FBFE8FF08750F50452AA50DE7281DA78A5009F91

Function 00F5A1B9 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F5A259
DestroyWindow.USER32(?,?), ref: 00F5A2D3

Part of subcall function 00ED7BCC: _memmove.LIBCMT ref: 00ED7C06

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00F5A34D
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00F5A36F
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00F5A382
DestroyWindow.USER32(00000000), ref: 00F5A3A4
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00ED0000,00000000), ref: 00F5A3DB
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00F5A3F4
GetDesktopWindow.USER32 ref: 00F5A40D
GetWindowRect.USER32(00000000), ref: 00F5A414
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00F5A42C
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00F5A444

Part of subcall function 00ED25DB: GetWindowLongW.USER32(?,000000EB), ref: 00ED25EC

Strings

0, xrefs: 00F5A26F
tooltips_class32, xrefs: 00F5A346, 00F5A3D4

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: 8314df981ca7ed61b4591a89a9a8611f84f9473fcfdeb836a61d9437b4f71fb1
Instruction ID: 5fb2c3f68cd7d0f05df6168742359b9dc4adf2f4a26456e6be2bbd773b4d0c90
Opcode Fuzzy Hash: 8314df981ca7ed61b4591a89a9a8611f84f9473fcfdeb836a61d9437b4f71fb1
Instruction Fuzzy Hash: E371CE70540708AFD721CF28CC49F6A7BE5FB88715F04462DFA85872A0D771E91AEB52

Function 00F5C5FE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED2612: GetWindowLongW.USER32(?,000000EB), ref: 00ED2623

DragQueryPoint.SHELL32(?,?), ref: 00F5C627

Part of subcall function 00F5AB37: ClientToScreen.USER32(?,?), ref: 00F5AB60
Part of subcall function 00F5AB37: GetWindowRect.USER32(?,?), ref: 00F5ABD6
Part of subcall function 00F5AB37: PtInRect.USER32(?,?,00F5C014), ref: 00F5ABE6

SendMessageW.USER32(?,000000B0,?,?), ref: 00F5C690
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00F5C69B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00F5C6BE
_wcscat.LIBCMT ref: 00F5C6EE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00F5C705
SendMessageW.USER32(?,000000B0,?,?), ref: 00F5C71E
SendMessageW.USER32(?,000000B1,?,?), ref: 00F5C735
SendMessageW.USER32(?,000000B1,?,?), ref: 00F5C757
DragFinish.SHELL32(?), ref: 00F5C75E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00F5C851

Strings

@GUI_DRAGID, xrefs: 00F5C7C9
@GUI_DRAGFILE, xrefs: 00F5C800
@GUI_DROPID, xrefs: 00F5C77E

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 66b77c436a9bd018de94b67362487fd58dfe5a5fad153fd4b44c8afb2cc88ab6
Instruction ID: 9f52bee595db24767585e51c8400fbd5e1695dacb4e820bea4ac2f0745eed3c3
Opcode Fuzzy Hash: 66b77c436a9bd018de94b67362487fd58dfe5a5fad153fd4b44c8afb2cc88ab6
Instruction Fuzzy Hash: 0B617F71108305AFC701EF64CC85DAFBBF8EF89751F00092EF695922A1DB719A49DB92

Function 00F54392 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00F54424
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00F5446F

Strings

UNCHECK, xrefs: 00F5464B
GETSELECTED, xrefs: 00F5457F
GETITEMCOUNT, xrefs: 00F54551
EXPAND, xrefs: 00F54521
ISCHECKED, xrefs: 00F545F2
EXISTS, xrefs: 00F544D8
GETTEXT, xrefs: 00F545C2
SELECT, xrefs: 00F54620
CHECK, xrefs: 00F5448F
GETTOTALCOUNT, xrefs: 00F54456
COLLAPSE, xrefs: 00F544B5

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: b759784b6fc916e3d55d09a6f45116851f18c89a437a3618edd2ec840cd71774
Instruction ID: ec2d98be13ab7c0ca31af7ee09a1a096cfb1d10b134a9dddbadb03b7a7df9165
Opcode Fuzzy Hash: b759784b6fc916e3d55d09a6f45116851f18c89a437a3618edd2ec840cd71774
Instruction Fuzzy Hash: 1F918A356047018BCB08EF10C851A6EB7E1AF85754F0448A9FD926B3A3CB34EC4AEB81

Function 00F5B7FE Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00F5B8B4
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00F56B11,?), ref: 00F5B910
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00F5B949
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00F5B98C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00F5B9C3
FreeLibrary.KERNEL32(?), ref: 00F5B9CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00F5B9DF
DestroyIcon.USER32(?), ref: 00F5B9EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00F5BA0B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00F5BA17

Part of subcall function 00EF2EFD: __wcsicmp_l.LIBCMT ref: 00EF2F86

Strings

.exe, xrefs: 00F5B84A
.dll, xrefs: 00F5B86D
.icl, xrefs: 00F5B82A

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: e919103f6db9cf4c8931302223f6036ba1f71b65e380cd9c6c2e8bb7267efa3c
Instruction ID: 7446a3b7abd34b33eecb2b1c6b4ec8b8e6f98fe713b3dea2a13ecc0a4ae52cf7
Opcode Fuzzy Hash: e919103f6db9cf4c8931302223f6036ba1f71b65e380cd9c6c2e8bb7267efa3c
Instruction Fuzzy Hash: B361D071900219BAEB14DF64DC45FBE7BA8FB08722F10411AFF15E61C1DB749989EBA0

Function 00F3A352 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00ED9837: __itow.LIBCMT ref: 00ED9862
Part of subcall function 00ED9837: __swprintf.LIBCMT ref: 00ED98AC

CharLowerBuffW.USER32(?,?), ref: 00F3A3CB
GetDriveTypeW.KERNEL32 ref: 00F3A418
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F3A460
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F3A497
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F3A4C5

Part of subcall function 00ED7BCC: _memmove.LIBCMT ref: 00ED7C06

Strings

closed, xrefs: 00F3A3DF, 00F3A3E8
close cd wait, xrefs: 00F3A4B0
wait, xrefs: 00F3A482
open , xrefs: 00F3A427
set cd door , xrefs: 00F3A466
type cdaudio alias cd wait, xrefs: 00F3A443
open, xrefs: 00F3A3F2
close, xrefs: 00F3A3D1

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: b6c7fe63a0f005acc00086f6dd52f5c25e0ae66090811ba3147485509596c0d1
Instruction ID: 0e4c8606c0df72a427c879b6adbbcd01bdce321cef7885696f85849c60fe5710
Opcode Fuzzy Hash: b6c7fe63a0f005acc00086f6dd52f5c25e0ae66090811ba3147485509596c0d1
Instruction Fuzzy Hash: 7E516E715043059FC704EF21C99186AB3F4EF88768F40886EF89667362DB31ED0ADB52

Function 00F2F8AA Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000000,?,00F0E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000), ref: 00F2F8DF
LoadStringW.USER32(00000000,?,00F0E029,00000001), ref: 00F2F8E8

Part of subcall function 00ED7DE1: _memmove.LIBCMT ref: 00ED7E22

GetModuleHandleW.KERNEL32(00000000,00F95310,?,00000FFF,?,?,00F0E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000,00000001), ref: 00F2F90A
LoadStringW.USER32(00000000,?,00F0E029,00000001), ref: 00F2F90D
__swprintf.LIBCMT ref: 00F2F95D
__swprintf.LIBCMT ref: 00F2F96E
_wprintf.LIBCMT ref: 00F2FA17
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00F2FA2E

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00F2FA12
Line %d (File "%s"):, xrefs: 00F2F957
Line %d:, xrefs: 00F2F968
Error: , xrefs: 00F2F9E5
^ ERROR, xrefs: 00F2F9C3

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: 40cd428a03af35ecbd2bbd67b0595d2bfe5010137dc11057318b02bad198f253
Instruction ID: 1fe7d6aecd3f02c99e0617c3d36a16ec99681597721c29b469231b057499814a
Opcode Fuzzy Hash: 40cd428a03af35ecbd2bbd67b0595d2bfe5010137dc11057318b02bad198f253
Instruction Fuzzy Hash: 0A41617280421DAACF04FBE0DD56DEEB7B9EF18340F500066B505B2192EE355F4ADB61

Function 00F5BA33 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00F5BA56
GetFileSize.KERNEL32(00000000,00000000), ref: 00F5BA6D
GlobalAlloc.KERNEL32(00000002,00000000), ref: 00F5BA78
CloseHandle.KERNEL32(00000000), ref: 00F5BA85
GlobalLock.KERNEL32(00000000), ref: 00F5BA8E
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00F5BA9D
GlobalUnlock.KERNEL32(00000000), ref: 00F5BAA6
CloseHandle.KERNEL32(00000000), ref: 00F5BAAD
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00F5BABE
OleLoadPicture.OLEAUT32(?,00000000,00000000,00F62CAC,?), ref: 00F5BAD7
GlobalFree.KERNEL32(00000000), ref: 00F5BAE7
GetObjectW.GDI32(?,00000018,000000FF), ref: 00F5BB0B
CopyImage.USER32(?,00000000,?,?,00002000), ref: 00F5BB36
DeleteObject.GDI32(00000000), ref: 00F5BB5E
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00F5BB74

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 93ca13e0f72c43f5ceda1f866141e9dd1048156adfe8b3af568e9f5b43fdc06c
Instruction ID: 1506395404ee39b2fab873e1d1fa92c05ceb88b613274f7f31a5f4bf8eac6248
Opcode Fuzzy Hash: 93ca13e0f72c43f5ceda1f866141e9dd1048156adfe8b3af568e9f5b43fdc06c
Instruction Fuzzy Hash: A741FA75900208FFDB119F65DC48EABBBB9EB89722F1040A8FA05D7260D7749945EB60

Function 00F3D899 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00F3DA10
_wcscat.LIBCMT ref: 00F3DA28
_wcscat.LIBCMT ref: 00F3DA3A
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00F3DA4F
SetCurrentDirectoryW.KERNEL32(?), ref: 00F3DA63
GetFileAttributesW.KERNEL32(?), ref: 00F3DA7B
SetFileAttributesW.KERNEL32(?,00000000), ref: 00F3DA95
SetCurrentDirectoryW.KERNEL32(?), ref: 00F3DAA7

Strings

*.*, xrefs: 00F3DAE6

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: d7d4309a1e294d0ea0bc8da16402ced793b3091ed11d9b99f3808a5bb87d7e3e
Instruction ID: 7d109233c77e670717e1138087f611215e01a67da03624918457a3d5a2b2b3b8
Opcode Fuzzy Hash: d7d4309a1e294d0ea0bc8da16402ced793b3091ed11d9b99f3808a5bb87d7e3e
Instruction Fuzzy Hash: AD81B1729043449FCB24EF64D840AAAB7E8FF89734F14482EF889D7251E734E945EB52

Function 00F5C1AC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED2612: GetWindowLongW.USER32(?,000000EB), ref: 00ED2623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00F5C1FC
GetFocus.USER32 ref: 00F5C20C
GetDlgCtrlID.USER32(00000000), ref: 00F5C217
_memset.LIBCMT ref: 00F5C342
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00F5C36D
GetMenuItemCount.USER32(?), ref: 00F5C38D
GetMenuItemID.USER32(?,00000000), ref: 00F5C3A0
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00F5C3D4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00F5C41C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00F5C454
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00F5C489

Strings

0, xrefs: 00F5C33A

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 12da6e8d5ddd8076b9b395895fa5f3578c539468b9a0ab8ddccb395242bcede9
Instruction ID: 33788c27bf700064a3005e1a5603ac4c1903b380a3e13525d7355d51270d5c45
Opcode Fuzzy Hash: 12da6e8d5ddd8076b9b395895fa5f3578c539468b9a0ab8ddccb395242bcede9
Instruction Fuzzy Hash: 07818C716083059FDB11CF14C894E6BBBE8FB88725F00492EFE9697291D770D909EB92

Function 00F4731A Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00F4738F
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00F4739B
CreateCompatibleDC.GDI32(?), ref: 00F473A7
SelectObject.GDI32(00000000,?), ref: 00F473B4
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00F47408
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00F47444
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00F47468
SelectObject.GDI32(00000006,?), ref: 00F47470
DeleteObject.GDI32(?), ref: 00F47479
DeleteDC.GDI32(00000006), ref: 00F47480
ReleaseDC.USER32(00000000,?), ref: 00F4748B

Strings

(, xrefs: 00F47410

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: f4d03be1f5c944fe1301354921230a524ec003944d04171ac0cbe8c55ed7cbf4
Instruction ID: 78bc1643104a48eea15e6f0e6579f61396df4555e9e5bab6f35b429f58e551a7
Opcode Fuzzy Hash: f4d03be1f5c944fe1301354921230a524ec003944d04171ac0cbe8c55ed7cbf4
Instruction Fuzzy Hash: 39514772904309EFCB14DFA8CC84EAEBBB9EF48310F148469FA5AA7251C731A9449B50

Function 00ED6A8C Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00EF0957: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00ED6B0C,?,00008000), ref: 00EF0973

Part of subcall function 00ED4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00ED4743,?,?,00ED37AE,?), ref: 00ED4770

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00ED6BAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00ED6CFA

Part of subcall function 00ED586D: _wcscpy.LIBCMT ref: 00ED58A5

Part of subcall function 00EF363D: _iswctype.LIBCMT ref: 00EF3645

Strings

Unterminated string, xrefs: 00F0E7E4
AU3!, xrefs: 00ED6B61
>>>AUTOIT SCRIPT<<<, xrefs: 00F0E496
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00F0E421
Error opening the file, xrefs: 00F0E43D, 00F0E4B8
Bad directive syntax error, xrefs: 00F0E79D
EA06, xrefs: 00F0E452

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: 50c2768dfdbbf99a614b219ccf74b0ead097be5adddd3ac63e469cb68472289a
Instruction ID: 3bba64475bbdad70dea1da3f3ff8b265d0149680565ec719f1d8617119472609
Opcode Fuzzy Hash: 50c2768dfdbbf99a614b219ccf74b0ead097be5adddd3ac63e469cb68472289a
Instruction Fuzzy Hash: 0802BE715083409FC724EF24C881AAFBBE5EF95314F145C2EF495A72A2DB30D94AEB52

Function 00F32D36 Relevance: 19.7, APIs: 13, Instructions: 214windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F32D50
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00F32DDD
GetMenuItemCount.USER32(00F95890), ref: 00F32E66
DeleteMenu.USER32(00F95890,00000005,00000000,000000F5,?,?), ref: 00F32EF6
DeleteMenu.USER32(00F95890,00000004,00000000), ref: 00F32EFE
DeleteMenu.USER32(00F95890,00000006,00000000), ref: 00F32F06
DeleteMenu.USER32(00F95890,00000003,00000000), ref: 00F32F0E
GetMenuItemCount.USER32(00F95890), ref: 00F32F16
SetMenuItemInfoW.USER32(00F95890,00000004,00000000,00000030), ref: 00F32F4C
GetCursorPos.USER32(?), ref: 00F32F56
SetForegroundWindow.USER32(00000000), ref: 00F32F5F
TrackPopupMenuEx.USER32(00F95890,00000000,?,00000000,00000000,00000000), ref: 00F32F72
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00F32F7E

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: 64f640a56b35af38440f7f32869b13caaefbb4894840617f88b49f54cf403f6c
Instruction ID: a0ac584b532a2a482bb6bf1e07584642ef32664e32673fb9a0e4cb4b49be5487
Opcode Fuzzy Hash: 64f640a56b35af38440f7f32869b13caaefbb4894840617f88b49f54cf403f6c
Instruction Fuzzy Hash: 8271D571A00209BBEB619F64DC46FAABF64FF04734F144216F625AA1E1C771AC54FB90

Function 00F277DC Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED7BCC: _memmove.LIBCMT ref: 00ED7C06

_memset.LIBCMT ref: 00F2786B
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00F278A0
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00F278BC
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00F278D8
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00F27902
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00F2792A
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00F27935
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00F2793A

Strings

\CLSID, xrefs: 00F27822
\IPC$, xrefs: 00F27882
SOFTWARE\Classes\, xrefs: 00F2780C

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: c9ba812d0b50ed6b1ef2f7e56b12836d60d6922d6ca8b9835976b999bb883964
Instruction ID: 9e0bf4242da46cd40a191337f990141de79f5083e59d2b8ef4e7b4aa2430c98c
Opcode Fuzzy Hash: c9ba812d0b50ed6b1ef2f7e56b12836d60d6922d6ca8b9835976b999bb883964
Instruction Fuzzy Hash: 0641E772C1422DAACF11EBA4EC95DEEB7B8FF04310F44406AE955B72A1EA319D05DB90

Function 00F50E1A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F4FDAD,?,?), ref: 00F50E31

Strings

HKEY_CLASSES_ROOT, xrefs: 00F50EC4
HKCU, xrefs: 00F50F21
HKU, xrefs: 00F50F43
HKEY_USERS, xrefs: 00F50F32
HKCC, xrefs: 00F50EFF
HKEY_CURRENT_CONFIG, xrefs: 00F50EEE
HKEY_LOCAL_MACHINE, xrefs: 00F50E9A
HKCR, xrefs: 00F50ED9
HKLM, xrefs: 00F50EAF
HKEY_CURRENT_USER, xrefs: 00F50F10

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 5f6cadc23a880ad9212426862c7fe1efbdec088c9cfed0758d36305c296acf14
Instruction ID: 92b2507a7c97c33f807d1e3a0d6dcf5f12b81b6a0ac6eef86cff9bd96fc5b578
Opcode Fuzzy Hash: 5f6cadc23a880ad9212426862c7fe1efbdec088c9cfed0758d36305c296acf14
Instruction Fuzzy Hash: B4419A3250464A8BCF20EF10D962AFE33A4EF11311F194455FE512B293DB709D1AEBA0

Function 00F2F7A1 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00F0E2A0,00000010,?,Bad directive syntax error,00F5F910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 00F2F7C2
LoadStringW.USER32(00000000,?,00F0E2A0,00000010), ref: 00F2F7C9

Part of subcall function 00ED7DE1: _memmove.LIBCMT ref: 00ED7E22

_wprintf.LIBCMT ref: 00F2F7FC
__swprintf.LIBCMT ref: 00F2F81E
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00F2F88D

Strings

Line %d (File "%s"):, xrefs: 00F2F833
Line %d:, xrefs: 00F2F818
%s (%d) : ==> %s.: %s %s, xrefs: 00F2F7F7
., xrefs: 00F2F873
Error: , xrefs: 00F2F85B

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1506413516-4153970271
Opcode ID: 324c11cfa3421596778ef8ec03413f14aef8e62f67eaed3c769e3e4f96f6ade6
Instruction ID: 5e77f530dcd6f3cc5bbc144f890099583d173828b38f8e2f31a431dd7bd22039
Opcode Fuzzy Hash: 324c11cfa3421596778ef8ec03413f14aef8e62f67eaed3c769e3e4f96f6ade6
Instruction Fuzzy Hash: 57216D3291021EAFCF11EF90CC1AEEEB779FF18301F040466B655761A2EA319619EB51

Function 00F352C7 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00ED7BCC: _memmove.LIBCMT ref: 00ED7C06

Part of subcall function 00ED7924: _memmove.LIBCMT ref: 00ED79AD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00F35330
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00F35346
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F35357
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00F35369
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00F3537A

Strings

alias PlayMe, xrefs: 00F35309
open , xrefs: 00F352DF
status PlayMe mode, xrefs: 00F3532B
play PlayMe, xrefs: 00F35375
play PlayMe wait, xrefs: 00F35364
close PlayMe, xrefs: 00F35341, 00F3536E

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: e1741ade3bd85fdc67da553df72dd1a5cb875b790ae1d1d3706c44cdf3247d71
Instruction ID: 6a41459310bb9fd71772aa47e9e7934bbcb5dedc5084ef40a1029814fee43a3d
Opcode Fuzzy Hash: e1741ade3bd85fdc67da553df72dd1a5cb875b790ae1d1d3706c44cdf3247d71
Instruction Fuzzy Hash: B4118221A9022979D720B765CC5ADFFBBBCEBD5F90F80042AB451A21D1EEA04D06D6A1

Function 00F346B7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00F346D2
gethostname.WSOCK32(?,00000100), ref: 00F346EC
gethostbyname.WSOCK32(?), ref: 00F346F9
_wcscpy.LIBCMT ref: 00F34721
_memmove.LIBCMT ref: 00F34734
inet_ntoa.WSOCK32(?), ref: 00F3473F
_strcat.LIBCMT ref: 00F3474D
_wcscpy.LIBCMT ref: 00F34764
WSACleanup.WSOCK32 ref: 00F34772
_wcscpy.LIBCMT ref: 00F34780

Strings

0.0.0.0, xrefs: 00F3471B

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: dcdace4a1239d5114bd7170486f31d7c9b7540d20afa2a2f0a3b1246e105e5c7
Instruction ID: c96af789b3336a500df0bc3e124a27f2420e2dd0c6a69fd65ed031b4fe5f2d85
Opcode Fuzzy Hash: dcdace4a1239d5114bd7170486f31d7c9b7540d20afa2a2f0a3b1246e105e5c7
Instruction Fuzzy Hash: 8C11D531900218ABCB14AB309C46EEA77BCEF02732F0441BAF645A6091EF71A985AA51

Function 00F34F75 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00F34F7A

Part of subcall function 00EF049F: timeGetTime.WINMM(?,75C0B400,00EE0E7B), ref: 00EF04A3

Sleep.KERNEL32(0000000A), ref: 00F34FA6
EnumThreadWindows.USER32(?,Function_00064F28,00000000), ref: 00F34FCA
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00F34FEC
SetActiveWindow.USER32 ref: 00F3500B
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00F35019
SendMessageW.USER32(00000010,00000000,00000000), ref: 00F35038
Sleep.KERNEL32(000000FA), ref: 00F35043
IsWindow.USER32 ref: 00F3504F
EndDialog.USER32(00000000), ref: 00F35060

Strings

BUTTON, xrefs: 00F34FDE

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 3519a3b012e5b2690632ebd70df3038c18e62d9bbb6dca72bf6c959f83a73ee0
Instruction ID: 9ea7943e55d69e9b2d7612a715775cc1fd8ad89c3a02c37fd6c94ac4242a2bdb
Opcode Fuzzy Hash: 3519a3b012e5b2690632ebd70df3038c18e62d9bbb6dca72bf6c959f83a73ee0
Instruction Fuzzy Hash: 8221A17060070DAFE7215F30EC89B2A3B69EB46B66F0E1025F601C21B5DB729D04BB62

Function 00F3D58D Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED9837: __itow.LIBCMT ref: 00ED9862
Part of subcall function 00ED9837: __swprintf.LIBCMT ref: 00ED98AC

CoInitialize.OLE32(00000000), ref: 00F3D5EA
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00F3D67D
SHGetDesktopFolder.SHELL32(?), ref: 00F3D691
CoCreateInstance.OLE32(00F62D7C,00000000,00000001,00F88C1C,?), ref: 00F3D6DD
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00F3D74C
CoTaskMemFree.OLE32(?,?), ref: 00F3D7A4
_memset.LIBCMT ref: 00F3D7E1
SHBrowseForFolderW.SHELL32(?), ref: 00F3D81D
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00F3D840
CoTaskMemFree.OLE32(00000000), ref: 00F3D847
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00F3D87E
CoUninitialize.OLE32(00000001,00000000), ref: 00F3D880

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: d3c03c19ac97852e974e2a5679a2c92258890e8bcf78c967ba12cdb47982b697
Instruction ID: c893839b5ff86a94e291d93c35dc02fe64dcab3d252f33fd4d8e0a5a37416315
Opcode Fuzzy Hash: d3c03c19ac97852e974e2a5679a2c92258890e8bcf78c967ba12cdb47982b697
Instruction Fuzzy Hash: 3DB1FA75A00209AFDB04DFA4D885DAEBBF9FF48314F1484A9E909EB261DB30ED45DB50

Function 00F2C267 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00F2C283
GetWindowRect.USER32(00000000,?), ref: 00F2C295
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00F2C2F3
GetDlgItem.USER32(?,00000002), ref: 00F2C2FE
GetWindowRect.USER32(00000000,?), ref: 00F2C310
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00F2C364
GetDlgItem.USER32(?,000003E9), ref: 00F2C372
GetWindowRect.USER32(00000000,?), ref: 00F2C383
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00F2C3C6
GetDlgItem.USER32(?,000003EA), ref: 00F2C3D4
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00F2C3F1
InvalidateRect.USER32(?,00000000,00000001), ref: 00F2C3FE

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: d1d74614409854818ca6ac9b4a8f30a306eb1338490fb37d8ace9e9788101579
Instruction ID: ae96f78791427a1ef58bbfaf8f76607bb4687f922ea4fffeb9b62d18cf9a75e9
Opcode Fuzzy Hash: d1d74614409854818ca6ac9b4a8f30a306eb1338490fb37d8ace9e9788101579
Instruction Fuzzy Hash: A9519071F00309AFDB08CFA8DD89AAEBBBAEB88311F14856DF605D7290D7709D049B50

Function 00ED201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00ED2036,?,00000000,?,?,?,?,00ED16CB,00000000,?), ref: 00ED1B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00ED20D3
KillTimer.USER32(-00000001,?,?,?,?,00ED16CB,00000000,?,?,00ED1AE2,?,?), ref: 00ED216E
DestroyAcceleratorTable.USER32(00000000), ref: 00F0BCA6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00ED16CB,00000000,?,?,00ED1AE2,?,?), ref: 00F0BCD7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00ED16CB,00000000,?,?,00ED1AE2,?,?), ref: 00F0BCEE
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00ED16CB,00000000,?,?,00ED1AE2,?,?), ref: 00F0BD0A
DeleteObject.GDI32(00000000), ref: 00F0BD1C

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: d0888eb38808eff462d790f4dd7b17263c9a629fdc560134db129364d451484f
Instruction ID: e0a1be3edb58487fad441124e7e95ce76c16cb9912b3cd63828493c30ddd9371
Opcode Fuzzy Hash: d0888eb38808eff462d790f4dd7b17263c9a629fdc560134db129364d451484f
Instruction Fuzzy Hash: 6061AE30501B08DFDB36AF14D948B2AB7F1FF50716F10952EE642AA6B0C770A886FB50

Function 00ED21A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00ED25DB: GetWindowLongW.USER32(?,000000EB), ref: 00ED25EC

GetSysColor.USER32(0000000F), ref: 00ED21D3

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: f0722e74b44ea3550ade8a860c4d7cd9099711cfe3cbfd3907421535cccfe07d
Instruction ID: d9e745da3c7f3635ecca0e9f74d8e1ea779da000d69f8d2bb5f71af780a186a8
Opcode Fuzzy Hash: f0722e74b44ea3550ade8a860c4d7cd9099711cfe3cbfd3907421535cccfe07d
Instruction Fuzzy Hash: 0441A631404644DFDB255F68EC48BB93B65EB16331F1452AAFF659A2F1C7318C42EB21

Function 00F3A8A7 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00F5F910), ref: 00F3A90B
GetDriveTypeW.KERNEL32(00000061,00F889A0,00000061), ref: 00F3A9D5
_wcscpy.LIBCMT ref: 00F3A9FF

Strings

unknown, xrefs: 00F3A996
network, xrefs: 00F3A969
fixed, xrefs: 00F3A953
ramdisk, xrefs: 00F3A97F
removable, xrefs: 00F3A93D
cdrom, xrefs: 00F3A927
all, xrefs: 00F3A911

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: fd1ce588e8ec53c1800313c3eac428e33aab2d9287a452ccb65d9c6475682ff0
Instruction ID: 120827703bbb9f89d19d93b82145586d5eb6a5b8e8b815d166989edf50e5af9f
Opcode Fuzzy Hash: fd1ce588e8ec53c1800313c3eac428e33aab2d9287a452ccb65d9c6475682ff0
Instruction Fuzzy Hash: 3D51AA325083019BC700EF15C992AAFB7E5EF84760F40586EF9D5A72A2DB31990ADB53

Function 00ED9837 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00ED9862
__swprintf.LIBCMT ref: 00ED98AC
__i64tow.LIBCMT ref: 00F0F5E6

Strings

%.15g, xrefs: 00ED98A6
False, xrefs: 00F0F5AE
True, xrefs: 00F0F5A7
0x%p, xrefs: 00F0F5C8

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: a6dd11e97172bb3b5c8566155d127f968e8e6a9e916875b258883b117097ff22
Instruction ID: 29dd812d217ed42f66eacc83c1fe4de3ec1b0bc86d500a78fb6e12718fc5aec7
Opcode Fuzzy Hash: a6dd11e97172bb3b5c8566155d127f968e8e6a9e916875b258883b117097ff22
Instruction Fuzzy Hash: 2841E475900209AFDB28DF34DC42ABA73E9EF05710F24446EE549E7382EA32D906AB11

Function 00F57152 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F5716A
CreateMenu.USER32 ref: 00F57185
SetMenu.USER32(?,00000000), ref: 00F57194
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F57221
IsMenu.USER32(?), ref: 00F57237
CreatePopupMenu.USER32 ref: 00F57241
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00F5726E
DrawMenuBar.USER32 ref: 00F57276

Strings

0, xrefs: 00F57160
F, xrefs: 00F57262

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 19e0701e874011640e895502e2d1544c1ae9e1f08fc14b0d9cf04f545d2a36fa
Instruction ID: 7581dae208dc2257dca1cf3c1ece0b1a9c5b6ca9b25d5a9a6afef3cabc0754a1
Opcode Fuzzy Hash: 19e0701e874011640e895502e2d1544c1ae9e1f08fc14b0d9cf04f545d2a36fa
Instruction Fuzzy Hash: 50414675A01309AFDB20EF64E844E9ABBB5FB08351F144069FE05A7361D731A918EF90

Function 00F574BB Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00F5755E
CreateCompatibleDC.GDI32(00000000), ref: 00F57565
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00F57578
SelectObject.GDI32(00000000,00000000), ref: 00F57580
GetPixel.GDI32(00000000,00000000,00000000), ref: 00F5758B
DeleteDC.GDI32(00000000), ref: 00F57594
GetWindowLongW.USER32(?,000000EC), ref: 00F5759E
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00F575B2
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00F575BE

Strings

static, xrefs: 00F574F6

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: ae5129247d83e71aa3af98fb7111600689f9bc2707041645713229151b1f1427
Instruction ID: 19e09516d7edf67073eb16908451c97ebe77ec012ff4dfc64588bee2db06d735
Opcode Fuzzy Hash: ae5129247d83e71aa3af98fb7111600689f9bc2707041645713229151b1f1427
Instruction Fuzzy Hash: A7316E72504218BBDF12AF64EC08FDB3F69EF09322F150265FB15961A0D735D819EBA4

Function 00EF6E03 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00EF6E3E

Part of subcall function 00EF8B28: __getptd_noexit.LIBCMT ref: 00EF8B28

__gmtime64_s.LIBCMT ref: 00EF6ED7
__gmtime64_s.LIBCMT ref: 00EF6F0D
__gmtime64_s.LIBCMT ref: 00EF6F2A
__allrem.LIBCMT ref: 00EF6F80
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00EF6F9C
__allrem.LIBCMT ref: 00EF6FB3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00EF6FD1
__allrem.LIBCMT ref: 00EF6FE8
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00EF7006
__invoke_watson.LIBCMT ref: 00EF7077

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction ID: c7bb0298edab578c7532a35a3cfd60aa979dbc00df7d370cb826b88d35998e91
Opcode Fuzzy Hash: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction Fuzzy Hash: FE71E876A0071BABD714DE68DC41BBAB7E8AF04724F145229F654F72C1EB74EE009790

Function 00F32527 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F32542
GetMenuItemInfoW.USER32(00F95890,000000FF,00000000,00000030), ref: 00F325A3
SetMenuItemInfoW.USER32(00F95890,00000004,00000000,00000030), ref: 00F325D9
Sleep.KERNEL32(000001F4), ref: 00F325EB
GetMenuItemCount.USER32(?), ref: 00F3262F
GetMenuItemID.USER32(?,00000000), ref: 00F3264B
GetMenuItemID.USER32(?,-00000001), ref: 00F32675
GetMenuItemID.USER32(?,?), ref: 00F326BA
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00F32700
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F32714
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F32735

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 0ff8dcd23173b311c0507597e50454e8c8eadadacd62ff688cd30913029f8e89
Instruction ID: 689ffdb43d55a6d840712d5d1e7c3ab93025ce82d9d2ad3d7af21a08ac1b9ec2
Opcode Fuzzy Hash: 0ff8dcd23173b311c0507597e50454e8c8eadadacd62ff688cd30913029f8e89
Instruction Fuzzy Hash: C3618DB1900249AFDF51CF64DC89EBE7BB8FF45324F180059E942A7251D731AE05EB21

Function 00F56F23 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00F56FA5
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00F56FA8
GetWindowLongW.USER32(?,000000F0), ref: 00F56FCC
_memset.LIBCMT ref: 00F56FDD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00F56FEF
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00F57067

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: bea6c1709f2858e54177900d6e00bde692c37829d0ef169a18062358172754f5
Instruction ID: ae60550c8d6fdbbb3774bb410bb6403780471be255619a915a7c963e1186936f
Opcode Fuzzy Hash: bea6c1709f2858e54177900d6e00bde692c37829d0ef169a18062358172754f5
Instruction Fuzzy Hash: 91618C71900608AFDB11DFA4DC81EEE77F8EB08710F10019AFA14EB2A1D771AE45EB90

Function 00F26B98 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00F26BBF
SafeArrayAllocData.OLEAUT32(?), ref: 00F26C18
VariantInit.OLEAUT32(?), ref: 00F26C2A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00F26C4A
VariantCopy.OLEAUT32(?,?), ref: 00F26C9D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00F26CB1
VariantClear.OLEAUT32(?), ref: 00F26CC6
SafeArrayDestroyData.OLEAUT32(?), ref: 00F26CD3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00F26CDC
VariantClear.OLEAUT32(?), ref: 00F26CEE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00F26CF9

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 966e7dba52c84f9deec5fb175b072cffb8f2ce543767f749ba39bcad522acca2
Instruction ID: 8a0f383828d502b9de948c76b1ea1b1f8b1bc7d3d6c2793b9b93ba184e4800e8
Opcode Fuzzy Hash: 966e7dba52c84f9deec5fb175b072cffb8f2ce543767f749ba39bcad522acca2
Instruction Fuzzy Hash: 90415275A0022D9FCF04EFA4DC449AEBBB9EF48351F008069E955E7261CB31A945DB90

Function 00F45732 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00F45793
inet_addr.WSOCK32(?), ref: 00F457D8
gethostbyname.WSOCK32(?), ref: 00F457E4
IcmpCreateFile.IPHLPAPI ref: 00F457F2
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00F45862
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00F45878
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00F458ED
WSACleanup.WSOCK32 ref: 00F458F3

Strings

Ping, xrefs: 00F45816

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 92e778559ab4aa8bb0d8cb11af2679b71d1b36a4dab241333e0762fb87ff2275
Instruction ID: 0d91d46aeea83d0535a8e7ea9f2cfc7a2ece79e2982beecd91e42aea081e3b9f
Opcode Fuzzy Hash: 92e778559ab4aa8bb0d8cb11af2679b71d1b36a4dab241333e0762fb87ff2275
Instruction Fuzzy Hash: F6515071A047009FDB10EF25DC45B6A7BE4EF48B20F04496AF956EB2A2DB70ED05EB41

Function 00F3B4C3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00F3B4D0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00F3B546
GetLastError.KERNEL32 ref: 00F3B550
SetErrorMode.KERNEL32(00000000,READY), ref: 00F3B5BD

Strings

READY, xrefs: 00F3B596
UNKNOWN, xrefs: 00F3B575
NOTREADY, xrefs: 00F3B57C
INVALID, xrefs: 00F3B58F
READONLY, xrefs: 00F3B588

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 65eab9d3cc2162c29cb580c0cb1cd54bc046a38e8de760f5e887a69f3a1332f2
Instruction ID: 8f276b47c5b5b09c85af773e8e621efc5ab0d54caa1f68a65b1368ca2976255f
Opcode Fuzzy Hash: 65eab9d3cc2162c29cb580c0cb1cd54bc046a38e8de760f5e887a69f3a1332f2
Instruction Fuzzy Hash: 7F318336A00209EFCB40EB68CC55AAD77B4FF84321F584166E605E7295DB70DA42EB51

Function 00F28F8F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED7DE1: _memmove.LIBCMT ref: 00ED7E22

Part of subcall function 00F2AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00F2AABC

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00F29014
GetDlgCtrlID.USER32 ref: 00F2901F
GetParent.USER32 ref: 00F2903B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00F2903E
GetDlgCtrlID.USER32(?), ref: 00F29047
GetParent.USER32(?), ref: 00F29063
SendMessageW.USER32(00000000,?,?,00000111), ref: 00F29066

Strings

ComboBox, xrefs: 00F28F9C
ListBox, xrefs: 00F28FD1

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 68878c790b807ea13e12b612f87d897bc19abce7f4d6f8884c117c9d4170c0a4
Instruction ID: 0e81c127f29fb159a1e5b0cef622e0a2d1927939c8d32aeda8ce4d1383dbe242
Opcode Fuzzy Hash: 68878c790b807ea13e12b612f87d897bc19abce7f4d6f8884c117c9d4170c0a4
Instruction Fuzzy Hash: 6621F871A00208BBDF04EBA4DC85EFEBBB5EF49310F100156F961972A1DB759819EB21

Function 00F2907A Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED7DE1: _memmove.LIBCMT ref: 00ED7E22

Part of subcall function 00F2AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00F2AABC

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00F290FD
GetDlgCtrlID.USER32 ref: 00F29108
GetParent.USER32 ref: 00F29124
SendMessageW.USER32(00000000,?,00000111,?), ref: 00F29127
GetDlgCtrlID.USER32(?), ref: 00F29130
GetParent.USER32(?), ref: 00F2914C
SendMessageW.USER32(00000000,?,?,00000111), ref: 00F2914F

Strings

ComboBox, xrefs: 00F29087
ListBox, xrefs: 00F290BC

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 12d865194cb20439e2d293d8474b50077918b653de0c75ddc4eeec969957f418
Instruction ID: b3af426b3d7af6167d187d388df1a27f0c47b981c3ff51bc240cc605efda8df4
Opcode Fuzzy Hash: 12d865194cb20439e2d293d8474b50077918b653de0c75ddc4eeec969957f418
Instruction Fuzzy Hash: 9C210775E00208BBDF00ABA4DC85FFEBBB4EF44300F100056FA51A72A1DB798819EB20

Function 00F29163 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00F2916F
GetClassNameW.USER32(00000000,?,00000100), ref: 00F29184
_wcscmp.LIBCMT ref: 00F29196
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00F29211

Strings

smallicons, xrefs: 00F291D9
details, xrefs: 00F291BF
largeicons, xrefs: 00F291A5
list, xrefs: 00F291F3
SHELLDLL_DefView, xrefs: 00F29190

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: 14fb1b3e3307c811b9f7e1aad3796d02a0afd832e6d731cabe03c159bc5aa7b9
Instruction ID: 84ec8e06d150c51cd27edc5c825b80588ac8b76ef471f53eae37d53b66741933
Opcode Fuzzy Hash: 14fb1b3e3307c811b9f7e1aad3796d02a0afd832e6d731cabe03c159bc5aa7b9
Instruction Fuzzy Hash: B011E73664C31BB9EA113664FC0AEB737DC9B15730F30006AFB10E60D2FEA1A8517695

Function 00F488AB Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F488D7
CoInitialize.OLE32(00000000), ref: 00F48904
CoUninitialize.OLE32 ref: 00F4890E
GetRunningObjectTable.OLE32(00000000,?), ref: 00F48A0E
SetErrorMode.KERNEL32(00000001,00000029), ref: 00F48B3B
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00F62C0C), ref: 00F48B6F
CoGetObject.OLE32(?,00000000,00F62C0C,?), ref: 00F48B92
SetErrorMode.KERNEL32(00000000), ref: 00F48BA5
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00F48C25
VariantClear.OLEAUT32(?), ref: 00F48C35

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 6a10b0db0134c5935f98d01bb25411130ecdd4b86877c44de9829d1b73af2f41
Instruction ID: eb84929b0ee79a23dac9962dbd3ce14c236fd5fe875387c497cfdc3c3be37c84
Opcode Fuzzy Hash: 6a10b0db0134c5935f98d01bb25411130ecdd4b86877c44de9829d1b73af2f41
Instruction Fuzzy Hash: ECC115B1608305AFC700EF64C88492BBBE9FF89798F00495DF9899B251DB71ED06DB52

Function 00F37990 Relevance: 15.3, APIs: 10, Instructions: 292COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 00F37A6C

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: 8dc37d0b5316e2dc4973773bc042c4e173028afdd121f79b0544fc4463c8141b
Instruction ID: 73e2e44dab5b17db8d0a92d66641ba662693cbb2c3511ba127bb857f0bc52a9e
Opcode Fuzzy Hash: 8dc37d0b5316e2dc4973773bc042c4e173028afdd121f79b0544fc4463c8141b
Instruction Fuzzy Hash: D8B15DB190831A9FDB20EF94C885BBEB7F4EF49331F245469E601E7251D734A941EBA0

Function 00F311CE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00F311F0
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00F30268,?,00000001), ref: 00F31204
GetWindowThreadProcessId.USER32(00000000), ref: 00F3120B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00F30268,?,00000001), ref: 00F3121A
GetWindowThreadProcessId.USER32(?,00000000), ref: 00F3122C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00F30268,?,00000001), ref: 00F31245
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00F30268,?,00000001), ref: 00F31257
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00F30268,?,00000001), ref: 00F3129C
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00F30268,?,00000001), ref: 00F312B1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00F30268,?,00000001), ref: 00F312BC

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: e609a8aed0e15d6b0ca6441cb55049bc53412327c3a23648f643a3033c99c48f
Instruction ID: 624af44c813777ead45ce03086e87d393ca74456b767754f7510f724ae4cf6c0
Opcode Fuzzy Hash: e609a8aed0e15d6b0ca6441cb55049bc53412327c3a23648f643a3033c99c48f
Instruction Fuzzy Hash: 0B316D75A00308BBDB209F54EC88F6A77A9BB55336F108166FE05D62A0E7B4DD44AF60

Function 00EDFA5D Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00EDFAA6
OleUninitialize.OLE32(?,00000000), ref: 00EDFB45
UnregisterHotKey.USER32(?), ref: 00EDFC9C
DestroyWindow.USER32(?), ref: 00F145D6
FreeLibrary.KERNEL32(?), ref: 00F1463B
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00F14668

Strings

close all, xrefs: 00EDFAA1

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: aacc903924dcbd3808834f3f97ab376f04b5148de077e641ac7bc11dabd2dd59
Instruction ID: b4e00e66ddd5136f258d8dd7a296ca509612d4a8504a8e21abd6bae4c95cb3f1
Opcode Fuzzy Hash: aacc903924dcbd3808834f3f97ab376f04b5148de077e641ac7bc11dabd2dd59
Instruction Fuzzy Hash: 78A16A31701216CFCB18EF14C9A4AA9F3A4EF45714F1452AEE80ABB362DB30AD56DF50

Function 00F2A068 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00F2A439), ref: 00F2A377

Strings

CLASS, xrefs: 00F2A0F6
NAME, xrefs: 00F2A1A9
INSTANCE, xrefs: 00F2A285
REGEXPCLASS, xrefs: 00F2A13C
CLASSNN, xrefs: 00F2A119
TEXT, xrefs: 00F2A2AE

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 33af5cc09ab527c017150774e0c6bc538ae831cc64f4cddbf01e48cbda2308d2
Instruction ID: 1c1417f34ee0cdaeee4a8485b7de3618d2c1b460f299c65dc0e195a2f5635a93
Opcode Fuzzy Hash: 33af5cc09ab527c017150774e0c6bc538ae831cc64f4cddbf01e48cbda2308d2
Instruction Fuzzy Hash: 8C91F731A00A19EBCB08EFA0D441BEDFBB5FF04310F509119D959B7282DF31A999EB91

Function 00ED2E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00ED2EAE

Part of subcall function 00ED1DB3: GetClientRect.USER32(?,?), ref: 00ED1DDC
Part of subcall function 00ED1DB3: GetWindowRect.USER32(?,?), ref: 00ED1E1D
Part of subcall function 00ED1DB3: ScreenToClient.USER32(?,?), ref: 00ED1E45

GetDC.USER32 ref: 00F0CD32
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00F0CD45
SelectObject.GDI32(00000000,00000000), ref: 00F0CD53
SelectObject.GDI32(00000000,00000000), ref: 00F0CD68
ReleaseDC.USER32(?,00000000), ref: 00F0CD70
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00F0CDFB

Strings

U, xrefs: 00F0CCD0

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: e1d2bdd0101b59c3fc0ab0cc3f5b8c94ed2bad8c267a137d0796662954e64b33
Instruction ID: ec9f7fb0e21238401fe622efdeed99dcc82173098d482c8390931e636955ecd4
Opcode Fuzzy Hash: e1d2bdd0101b59c3fc0ab0cc3f5b8c94ed2bad8c267a137d0796662954e64b33
Instruction Fuzzy Hash: 7871C431900209DFCF218F64CC84AEA7BB5FF58325F14436AEE556B2A6C7319842FB90

Function 00F41A15 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00F41A50
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00F41A7C
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00F41ABE
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00F41AD3
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00F41AE0
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00F41B10
InternetCloseHandle.WININET(00000000), ref: 00F41B57

Part of subcall function 00F42483: GetLastError.KERNEL32(?,?,00F41817,00000000,00000000,00000001), ref: 00F42498
Part of subcall function 00F42483: SetEvent.KERNEL32(?,?,00F41817,00000000,00000000,00000001), ref: 00F424AD

Strings

, xrefs: 00F41B01

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: 87f926fb372b02a6b386ddb28345e2bf8b101fb3ba4de1f61fe9c35d36955b2d
Instruction ID: 4e5a5d6ab17c993d8beaa72e1ffcd4ddf11cc09b69373c3afda84085e740dca3
Opcode Fuzzy Hash: 87f926fb372b02a6b386ddb28345e2bf8b101fb3ba4de1f61fe9c35d36955b2d
Instruction Fuzzy Hash: F7416CB1901219BFEB119F50CC89FBA7FACFB48354F00416AFE059A151E7749E84ABA0

Function 00F48C46 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00F5F910), ref: 00F48D28
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00F5F910), ref: 00F48D5C
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00F48ED6
SysFreeString.OLEAUT32(?), ref: 00F48F00

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: be630b99afa230c628483fa667c8afffca89cbb07967210695104703e56f8010
Instruction ID: fd6ec04379e4e4ce752dc3748df011ebf273865baa2e639e6c033cb0cbb3fc7c
Opcode Fuzzy Hash: be630b99afa230c628483fa667c8afffca89cbb07967210695104703e56f8010
Instruction Fuzzy Hash: C9F15C71A00209EFCF14DFA4C884EAEBBB9FF45355F108498F906AB251DB71AE46DB50

Function 00F4F694 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F4F6B5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00F4F848
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00F4F86C
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00F4F8AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00F4F8CE
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00F4FA4A
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00F4FA7C
CloseHandle.KERNEL32(?), ref: 00F4FAAB
CloseHandle.KERNEL32(?), ref: 00F4FB22

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 661fb51fc6a6ccded8f23916fb7d050c529227094b243c7806aaa919b6f18418
Instruction ID: c3825021c1dd10adb5748a5a866ce7723e2825921ad3f5c991f20043b17dcfc9
Opcode Fuzzy Hash: 661fb51fc6a6ccded8f23916fb7d050c529227094b243c7806aaa919b6f18418
Instruction Fuzzy Hash: 38E1C1316043409FC714EF24C881B6ABBE1EF85364F14846DF9899B3A2CB35EC49DB52

Function 00F34CC1 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F3466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00F33697,?), ref: 00F3468B

Part of subcall function 00F3466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00F33697,?), ref: 00F346A4

Part of subcall function 00F34A31: GetFileAttributesW.KERNEL32(?,00F3370B), ref: 00F34A32

lstrcmpiW.KERNEL32(?,?), ref: 00F34D40
_wcscmp.LIBCMT ref: 00F34D5A
MoveFileW.KERNEL32(?,?), ref: 00F34D75

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 8a065ce26263ddab61e321665a93ced1f9425152bc94d32c3527911e45fc2c74
Instruction ID: a2ef7f7af2c4ecffb2b88249f041340f1f7f26f03646f93325d7851484a77824
Opcode Fuzzy Hash: 8a065ce26263ddab61e321665a93ced1f9425152bc94d32c3527911e45fc2c74
Instruction Fuzzy Hash: 8D5143B24083459BC724DBA4DC819DFB3ECAF85360F00092EB689D3151EF35B689D766

Function 00F58645 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00F586FF

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 3d5e68ce69a2bb429c9d3042a938c39f04f127ae84e4f4c3c673d725f3a74f27
Instruction ID: ebe2f96ebf610fee3b6d7f42b15d5b79790cfb6d21b10cbd06ebc00a078f08ec
Opcode Fuzzy Hash: 3d5e68ce69a2bb429c9d3042a938c39f04f127ae84e4f4c3c673d725f3a74f27
Instruction Fuzzy Hash: B151A131900244BFEB209B25DC85F9D3BA4EB057A2F604116FF51F61A1CF71AD8AEB41

Function 00ED2B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00F0C2F7
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00F0C319
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00F0C331
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00F0C34F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00F0C370
DestroyIcon.USER32(00000000), ref: 00F0C37F
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00F0C39C
DestroyIcon.USER32(?), ref: 00F0C3AB

Part of subcall function 00F5A4AF: DeleteObject.GDI32(00000000), ref: 00F5A4E8

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: 367a71520a6ff1d1a0a0c31075858b27301c2bbb2fbdc0916840ed84ed551e56
Instruction ID: c0bb2bd0273be20019cd1a87fddfde585f52b31e310fd37541d3c02f6125ee4a
Opcode Fuzzy Hash: 367a71520a6ff1d1a0a0c31075858b27301c2bbb2fbdc0916840ed84ed551e56
Instruction Fuzzy Hash: F8516E70A10709EFDB20DF64CC45BAA77E5EB54721F10462EFA02A72D0D7B0AD51EB90

Function 00F2966E Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F2A82C: GetWindowThreadProcessId.USER32(?,00000000), ref: 00F2A84C
Part of subcall function 00F2A82C: GetCurrentThreadId.KERNEL32 ref: 00F2A853
Part of subcall function 00F2A82C: AttachThreadInput.USER32(00000000,?,00F29683,?,00000001), ref: 00F2A85A

MapVirtualKeyW.USER32(00000025,00000000), ref: 00F2968E
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00F296AB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00F296AE
MapVirtualKeyW.USER32(00000025,00000000), ref: 00F296B7
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00F296D5
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00F296D8
MapVirtualKeyW.USER32(00000025,00000000), ref: 00F296E1
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00F296F8
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00F296FB

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 2c5346b8ab5c10150e400a6ab55dd529090fc6be296828b6e0ee65403dbec614
Instruction ID: 9de39db2cc269f1162521432e1cfdff60fd53e177695487b536e18dcd114f454
Opcode Fuzzy Hash: 2c5346b8ab5c10150e400a6ab55dd529090fc6be296828b6e0ee65403dbec614
Instruction Fuzzy Hash: 3911A1B1950618BFF6106F60EC89F6A7F6DEB4C752F110465F344AB0A1C9F25C50EAA4

Function 00F28921 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00F2853C,00000B00,?,?), ref: 00F2892A
HeapAlloc.KERNEL32(00000000,?,00F2853C,00000B00,?,?), ref: 00F28931
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00F2853C,00000B00,?,?), ref: 00F28946
GetCurrentProcess.KERNEL32(?,00000000,?,00F2853C,00000B00,?,?), ref: 00F2894E
DuplicateHandle.KERNEL32(00000000,?,00F2853C,00000B00,?,?), ref: 00F28951
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00F2853C,00000B00,?,?), ref: 00F28961
GetCurrentProcess.KERNEL32(00F2853C,00000000,?,00F2853C,00000B00,?,?), ref: 00F28969
DuplicateHandle.KERNEL32(00000000,?,00F2853C,00000B00,?,?), ref: 00F2896C
CreateThread.KERNEL32(00000000,00000000,00F28992,00000000,00000000,00000000), ref: 00F28986

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: d71d1f0de7b5b61047582e69dbd50eb5f99a16cf607d68dad8a910cd36409742
Instruction ID: 786486f8f8891e0b38895635381e60934a72096b1c79d9696e7e884d078f9557
Opcode Fuzzy Hash: d71d1f0de7b5b61047582e69dbd50eb5f99a16cf607d68dad8a910cd36409742
Instruction Fuzzy Hash: B701BBB5240748FFE710ABA5DC4DF6B3BACEB89711F408461FB05DB1A1CA709804DB21

Function 00F49B23 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00F49BA4, 00F49EC8
Not an Object type, xrefs: 00F49B7B

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 785581cff1f3a44efdaf24d2a85784e69717dd9f9dcf9e29f2b1960d951b4d56
Instruction ID: 04260fb2a84360a451f167cc0c2d4bd5f75bf381ee010bde33334c2f860f99d9
Opcode Fuzzy Hash: 785581cff1f3a44efdaf24d2a85784e69717dd9f9dcf9e29f2b1960d951b4d56
Instruction Fuzzy Hash: 2FC17F71F0421A9BDF10DF98D884AAFBBF5EB48314F148469ED05AB281E7B09D45DBA0

Function 00F49113 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F49167
VariantInit.OLEAUT32(?), ref: 00F49238
VariantInit.OLEAUT32(?), ref: 00F49339
VariantClear.OLEAUT32(?), ref: 00F49343
VariantClear.OLEAUT32(?), ref: 00F493A0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00F4931C
Null Object assignment in FOR..IN loop, xrefs: 00F491C8, 00F492F6, 00F493AE

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 4d55b0e93c287fdd0a4209dba617a7a8ac713917abd06f7d946fbf48b8ba045c
Instruction ID: 349b4d9eaf527f5f76952e69ad34972e3dcb526006da00be02afb16c16701725
Opcode Fuzzy Hash: 4d55b0e93c287fdd0a4209dba617a7a8ac713917abd06f7d946fbf48b8ba045c
Instruction Fuzzy Hash: FB919071E04219ABDF24DFA5CC48FAFBBB8EF45720F108159F915AB281D7B09905DBA0

Function 00F4975D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00F2710A: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00F27044,80070057,?,?,?,00F27455), ref: 00F27127
Part of subcall function 00F2710A: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00F27044,80070057,?,?), ref: 00F27142
Part of subcall function 00F2710A: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00F27044,80070057,?,?), ref: 00F27150
Part of subcall function 00F2710A: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00F27044,80070057,?), ref: 00F27160

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00F49806
_memset.LIBCMT ref: 00F49813
_memset.LIBCMT ref: 00F49956
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00F49982
CoTaskMemFree.OLE32(?), ref: 00F4998D

Strings

NULL Pointer assignment, xrefs: 00F499DB

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: ee5a6e09d803754c866d485360bdda6186f5e7db6adbaa0e8b074f6dce70fad1
Instruction ID: 29a1e8e08defe0fcba047de6a88eb49745845bf92f94360572d7cd8ae4c2074b
Opcode Fuzzy Hash: ee5a6e09d803754c866d485360bdda6186f5e7db6adbaa0e8b074f6dce70fad1
Instruction Fuzzy Hash: 87914871D04229EBDB10DFA4DC85EDEBBB9EF08310F10415AF919A7281EB719A45DFA0

Function 00F56D80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00F56E24
SendMessageW.USER32(?,00001036,00000000,?), ref: 00F56E38
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00F56E52
_wcscat.LIBCMT ref: 00F56EAD
SendMessageW.USER32(?,00001057,00000000,?), ref: 00F56EC4
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00F56EF2

Strings

SysListView32, xrefs: 00F56DF6

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: c6ba32903f04d6fef4200f4014aa4ea3cfa68d88747c8b2007b3df7dae423079
Instruction ID: e5eb156e4eb050624bfc664b892eccb0e6426e1438024109b37dfa9654ae17fb
Opcode Fuzzy Hash: c6ba32903f04d6fef4200f4014aa4ea3cfa68d88747c8b2007b3df7dae423079
Instruction Fuzzy Hash: CF41C470A00308ABDB219F64CC45BEE77F8EF08361F50046AFA54E7191D7719D899B60

Function 00F4E933 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00F33C55: CreateToolhelp32Snapshot.KERNEL32 ref: 00F33C7A
Part of subcall function 00F33C55: Process32FirstW.KERNEL32(00000000,?), ref: 00F33C88
Part of subcall function 00F33C55: CloseHandle.KERNEL32(00000000), ref: 00F33D52

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00F4E9A4
GetLastError.KERNEL32 ref: 00F4E9B7
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00F4E9E6
TerminateProcess.KERNEL32(00000000,00000000), ref: 00F4EA63
GetLastError.KERNEL32(00000000), ref: 00F4EA6E
CloseHandle.KERNEL32(00000000), ref: 00F4EAA3

Strings

SeDebugPrivilege, xrefs: 00F4E9C2

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: aaaaa1d9f996e863c48ca1e11ce1554f4f111ba400fba436f284bb98574cfe9c
Instruction ID: e131339287df3690b08ab3817cd46d8d63190f612a2525766a571751830c8eee
Opcode Fuzzy Hash: aaaaa1d9f996e863c48ca1e11ce1554f4f111ba400fba436f284bb98574cfe9c
Instruction Fuzzy Hash: FC41AD316002059FDB14EF14DC95F6DBBE5BF40714F188459FA429B3D2CB79A809EB91

Function 00F32F94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00F33033

Strings

blank, xrefs: 00F32FB5
stop, xrefs: 00F33004
question, xrefs: 00F32FEC
warning, xrefs: 00F3301C
info, xrefs: 00F32FD4

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 9fb628a90009ec513d16e19d44b75ea0cabb7105f256db79b9efa24ffc3b4ef3
Instruction ID: 5a2255e483c212ac6041c6681b3f8eea1fc3e422ee5b07dacddfafc38138921e
Opcode Fuzzy Hash: 9fb628a90009ec513d16e19d44b75ea0cabb7105f256db79b9efa24ffc3b4ef3
Instruction Fuzzy Hash: 3311EB7274C34ABEE719DA54DC82DAB779C9F15374F20002AFB00A6181DB719F4176A5

Function 00F342F8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00F34312
LoadStringW.USER32(00000000), ref: 00F34319
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00F3432F
LoadStringW.USER32(00000000), ref: 00F34336
_wprintf.LIBCMT ref: 00F3435C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00F3437A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00F34357

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 06f931074cb853644bf275858341b8d1a814947033b5094ff6dcbb76c32b5b94
Instruction ID: 2973691e5f1ed445b9d92fc1b742cff49005283f32b02eeaa7d355f5242c0bfa
Opcode Fuzzy Hash: 06f931074cb853644bf275858341b8d1a814947033b5094ff6dcbb76c32b5b94
Instruction Fuzzy Hash: 66014FF290030CBFE711A7A0DD89EEB776CDB08311F4005E1BB45E2052EA75AE896B71

Function 00F5D43E Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED2612: GetWindowLongW.USER32(?,000000EB), ref: 00ED2623

GetSystemMetrics.USER32(0000000F), ref: 00F5D47C
GetSystemMetrics.USER32(0000000F), ref: 00F5D49C
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00F5D6D7
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00F5D6F5
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00F5D716
ShowWindow.USER32(00000003,00000000), ref: 00F5D735
InvalidateRect.USER32(?,00000000,00000001), ref: 00F5D75A
DefDlgProcW.USER32(?,00000005,?,?), ref: 00F5D77D

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 6ea38879a2057f642981a671b2c151d1ade9ca5eb561ecc8d13f0096a296a90c
Instruction ID: 642124abd1cd324cee9076ca3013b8b0a7fcda4d7c9c8768fa54b778d37d52e5
Opcode Fuzzy Hash: 6ea38879a2057f642981a671b2c151d1ade9ca5eb561ecc8d13f0096a296a90c
Instruction Fuzzy Hash: 2FB18B71A01219EBDF24CF68C9857AD7BB1FF08712F088069EE489F295D734A958EB50

Function 00ED2A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00F0C1C7,00000004,00000000,00000000,00000000), ref: 00ED2ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00F0C1C7,00000004,00000000,00000000,00000000,000000FF), ref: 00ED2B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00F0C1C7,00000004,00000000,00000000,00000000), ref: 00F0C21A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00F0C1C7,00000004,00000000,00000000,00000000), ref: 00F0C286

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: d9ad93563581b9c9a18b76d0642180f9f820b763c59cd50280039c75d942f43d
Instruction ID: 418dd8fad0f06b611e1bc2f02ae74789ef1b661987b6239addf138b1ed63b9f8
Opcode Fuzzy Hash: d9ad93563581b9c9a18b76d0642180f9f820b763c59cd50280039c75d942f43d
Instruction Fuzzy Hash: DB4148307087809ACB359B28CC8CBAF7B92EB65314F54A91FE347A67A0C6719847F750

Function 00F370C6 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00F370DD

Part of subcall function 00EF0DB6: std::exception::exception.LIBCMT ref: 00EF0DEC
Part of subcall function 00EF0DB6: __CxxThrowException@8.LIBCMT ref: 00EF0E01

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00F37114
EnterCriticalSection.KERNEL32(?), ref: 00F37130
_memmove.LIBCMT ref: 00F3717E
_memmove.LIBCMT ref: 00F3719B
LeaveCriticalSection.KERNEL32(?), ref: 00F371AA
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00F371BF
InterlockedExchange.KERNEL32(?,000001F6), ref: 00F371DE

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: d468fd899d684189b86e03d2632c944aaae21fd99784532840c7952d6bc7a98b
Instruction ID: b718438e4608bc418f31ba4641a30a4848afe20da231df53e1dd4d76435b9acd
Opcode Fuzzy Hash: d468fd899d684189b86e03d2632c944aaae21fd99784532840c7952d6bc7a98b
Instruction Fuzzy Hash: 13316176900209EBCF10EFA4DC859AFBBB8EF45711F1441B5FA04AB256DB709E14DBA0

Function 00F561D3 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00F561EB
GetDC.USER32(00000000), ref: 00F561F3
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00F561FE
ReleaseDC.USER32(00000000,00000000), ref: 00F5620A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00F56246
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00F56257
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00F5902A,?,?,000000FF,00000000,?,000000FF,?), ref: 00F56291
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00F562B1

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 1d2ff3aef39e84addea8533b3102df8ab0b9f64a298d173e611f22399203d93e
Instruction ID: 2633672f313dc4d0a3edd2eb57e32ac9d34ece87fed01c3143d0ab300615ef58
Opcode Fuzzy Hash: 1d2ff3aef39e84addea8533b3102df8ab0b9f64a298d173e611f22399203d93e
Instruction Fuzzy Hash: 5D315C72101214BFEF118F508C8AFAB3BA9EF49766F0440A5FF08DA192C6759845DB60

Function 00F2BBAF Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00F2BBC4
_memcmp.LIBCMT ref: 00F2BBE6
_memcmp.LIBCMT ref: 00F2BBFE
_memcmp.LIBCMT ref: 00F2BC11
_memcmp.LIBCMT ref: 00F2BC2B
_memcmp.LIBCMT ref: 00F2BC3E
_memcmp.LIBCMT ref: 00F2BC56
_memcmp.LIBCMT ref: 00F2BC71

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 9840b574a6c8bf15b376bcf6ba748677dcdd40a72dabb31535d01db2ccfa122a
Instruction ID: c581ad40d82043ac9b37c06e3f61493883e311f7565db2e9235c5a8f28d72f72
Opcode Fuzzy Hash: 9840b574a6c8bf15b376bcf6ba748677dcdd40a72dabb31535d01db2ccfa122a
Instruction Fuzzy Hash: B3219C71A4162E77E6046611BD42FFB775D9E90378F044020FE0466687EB54DF11B1A1

Function 00F3EB23 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00ED9837: __itow.LIBCMT ref: 00ED9862
Part of subcall function 00ED9837: __swprintf.LIBCMT ref: 00ED98AC

Part of subcall function 00EEFC86: _wcscpy.LIBCMT ref: 00EEFCA9

_wcstok.LIBCMT ref: 00F3EC94
_wcscpy.LIBCMT ref: 00F3ED23
_memset.LIBCMT ref: 00F3ED56

Strings

X, xrefs: 00F3ED93

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: ad606f43a1c1d1f91d9a582feb701b91e76e8b0e05dbb6b157c0acf1d9e503c2
Instruction ID: 2acf14aea22cec242d77aaab2d2cf158d2b920b5dac261fdfcca874220b75fbf
Opcode Fuzzy Hash: ad606f43a1c1d1f91d9a582feb701b91e76e8b0e05dbb6b157c0acf1d9e503c2
Instruction Fuzzy Hash: 25C171715087419FC714EF24C885A6AB7E0FF85320F11592EF999A73A2DB70EC46DB42

Function 00ED1424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be931bf582bd021c159e7976570e16ad9e39afc91f4f72da5ede64e33d6f5688
Instruction ID: 607f56f80038d6fa2462703e639a6a971254d267e70fa9005f5dd5cf41e4ee40
Opcode Fuzzy Hash: be931bf582bd021c159e7976570e16ad9e39afc91f4f72da5ede64e33d6f5688
Instruction Fuzzy Hash: D1714D30900119FFCB149F98CC45ABEBB79FF85325F14819AF915AB291C734AA52DBA0

Function 00F46B76 Relevance: 10.7, APIs: 7, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a6129a9405a388d18eb60861f58758127cd23074a00774a3d3977e3f7852a70
Instruction ID: 78ad9771f06360d4aaaffe7a026df9f31941b908adf9fb29ad7d76e848d342fd
Opcode Fuzzy Hash: 1a6129a9405a388d18eb60861f58758127cd23074a00774a3d3977e3f7852a70
Instruction Fuzzy Hash: 5761AF72604300ABC710EB24DC92E6BBBF8EF85724F10591EF955AB292DB709D05D752

Function 00F5B351 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01796450), ref: 00F5B3EB
IsWindowEnabled.USER32(01796450), ref: 00F5B3F7
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 00F5B4DB
SendMessageW.USER32(01796450,000000B0,?,?), ref: 00F5B512
IsDlgButtonChecked.USER32(?,?), ref: 00F5B54F
GetWindowLongW.USER32(01796450,000000EC), ref: 00F5B571
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00F5B589

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: fe890a6f4b5bfbe53622416c161e965920273f771a9fcbced73ddfe84d2c8394
Instruction ID: 3f644fefe14eca17fb4cf79d88da82bf9f4f385c5df5be972e44a7b38e0912c7
Opcode Fuzzy Hash: fe890a6f4b5bfbe53622416c161e965920273f771a9fcbced73ddfe84d2c8394
Instruction Fuzzy Hash: C3718E34A04608AFDF35DF54C894FBABBA5FF09322F144059EF46972A2C731A949EB50

Function 00F4F41E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F4F448
_memset.LIBCMT ref: 00F4F511
ShellExecuteExW.SHELL32(?), ref: 00F4F556

Part of subcall function 00ED9837: __itow.LIBCMT ref: 00ED9862
Part of subcall function 00ED9837: __swprintf.LIBCMT ref: 00ED98AC

Part of subcall function 00EEFC86: _wcscpy.LIBCMT ref: 00EEFCA9

GetProcessId.KERNEL32(00000000), ref: 00F4F5CD
CloseHandle.KERNEL32(00000000), ref: 00F4F5FC

Strings

@, xrefs: 00F4F525

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 0ae3cb70c11e86add922db96e7fb0d62d423e6a78ba1d6f58ab2b8177709e3e6
Instruction ID: c2b8b0109cdb16657657a5ef7e88bd8061349534a1479801c64e61deda50a4f1
Opcode Fuzzy Hash: 0ae3cb70c11e86add922db96e7fb0d62d423e6a78ba1d6f58ab2b8177709e3e6
Instruction Fuzzy Hash: F6617E75E006199FCB14EF64C8819AEBBF5FF49320F14806AE859BB361CB31AD45DB90

Function 00F30F4D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00F30F8C
GetKeyboardState.USER32(?), ref: 00F30FA1
SetKeyboardState.USER32(?), ref: 00F31002
PostMessageW.USER32(?,00000101,00000010,?), ref: 00F31030
PostMessageW.USER32(?,00000101,00000011,?), ref: 00F3104F
PostMessageW.USER32(?,00000101,00000012,?), ref: 00F31095
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00F310B8

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: f37887d4409e05bd1faba481cfa108e9fd26fc352ffb9157b43d0889283ab60a
Instruction ID: b6a4bdfa84d236b97b0385f646ab9d99e1ad6e766d9820b896e2ad8551957260
Opcode Fuzzy Hash: f37887d4409e05bd1faba481cfa108e9fd26fc352ffb9157b43d0889283ab60a
Instruction Fuzzy Hash: D851E5A09047D53DFB3642348C15BBABEA96B06334F08858AE1D5468D3C6D9DCC8F751

Function 00F30D66 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00F30DA5
GetKeyboardState.USER32(?), ref: 00F30DBA
SetKeyboardState.USER32(?), ref: 00F30E1B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00F30E47
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00F30E64
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00F30EA8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00F30EC9

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 8500d8b455b45fa0a3f996a0b7f31971ac6325429d56f1f450ec999539bef0c0
Instruction ID: 5247d08dc320b86c4622c7bdd8886b2a635b1fe0f3e3870de238eee9e9158a43
Opcode Fuzzy Hash: 8500d8b455b45fa0a3f996a0b7f31971ac6325429d56f1f450ec999539bef0c0
Instruction Fuzzy Hash: E251D6A0A447D57DFB3683748C65B7A7EA96B06330F08888AE1D4464C2DB95ECD8F750

Function 00F355FD Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00F3560A
_wcsncpy.LIBCMT ref: 00F3563F
_wcsncpy.LIBCMT ref: 00F35671
_wcsncpy.LIBCMT ref: 00F356A4
_wcsncpy.LIBCMT ref: 00F356E6
_wcsncpy.LIBCMT ref: 00F35720
_wcsncpy.LIBCMT ref: 00F3574F

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 5606dd58f83386146577aacbf66d28c13cd209456486e2df2e86d18f1ec0f4f0
Instruction ID: 5c8b7f8f4e99025040688845f3f2fa6e8899077c95846e667946ddc3fa45522f
Opcode Fuzzy Hash: 5606dd58f83386146577aacbf66d28c13cd209456486e2df2e86d18f1ec0f4f0
Instruction Fuzzy Hash: 69419265C1161C76CB11EBF4984A9EFB3F8AF44710F509956EB08F3221EB34A345C7AA

Function 00F33671 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F3466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00F33697,?), ref: 00F3468B

Part of subcall function 00F3466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00F33697,?), ref: 00F346A4

lstrcmpiW.KERNEL32(?,?), ref: 00F336B7
_wcscmp.LIBCMT ref: 00F336D3
MoveFileW.KERNEL32(?,?), ref: 00F336EB
_wcscat.LIBCMT ref: 00F33733
SHFileOperationW.SHELL32(?), ref: 00F3379F

Strings

\*.*, xrefs: 00F3372D

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 9bac5f31a596e227babe3b951df384dd0cf9c53559ae47c95f8c4ed6b0999bd0
Instruction ID: 486b5fddca599cd307dee2125a19a8f9a460f1156c3241d1ab995c93097f4931
Opcode Fuzzy Hash: 9bac5f31a596e227babe3b951df384dd0cf9c53559ae47c95f8c4ed6b0999bd0
Instruction Fuzzy Hash: D341B471508348AEC751EF64C8469DFB7E8EF883A0F00186EF59AC3251EB34D689D752

Function 00F57291 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F572AA
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F57351
IsMenu.USER32(?), ref: 00F57369
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00F573B1
DrawMenuBar.USER32 ref: 00F573C4

Strings

0, xrefs: 00F5729E

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: ac54108469644d1574250a9fd1c465d2f58171ce95b332281568d95b39c393a6
Instruction ID: 1ee7336059c3e6e0310a142e7d6043b66ce06ade13b593bab1a80667d5388d5e
Opcode Fuzzy Hash: ac54108469644d1574250a9fd1c465d2f58171ce95b332281568d95b39c393a6
Instruction Fuzzy Hash: 15411875A04308AFDB20EF50E884A9ABBF8FF05361F149569FE15A7250D730AD58EF50

Function 00F50FA5 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00F50FD4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00F50FFE
FreeLibrary.KERNEL32(00000000), ref: 00F510B5

Part of subcall function 00F50FA5: RegCloseKey.ADVAPI32(?), ref: 00F5101B
Part of subcall function 00F50FA5: FreeLibrary.KERNEL32(?), ref: 00F5106D
Part of subcall function 00F50FA5: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00F51090

RegDeleteKeyW.ADVAPI32(?,?), ref: 00F51058

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 52d1ad052f2c01224736867caabe424add3ac4d41fec65dcd3ae7bbf89c37076
Instruction ID: 98ee071ef8ec4f2b9aacf130e2dcd90cca917566a732d43d919057fb4b99051a
Opcode Fuzzy Hash: 52d1ad052f2c01224736867caabe424add3ac4d41fec65dcd3ae7bbf89c37076
Instruction Fuzzy Hash: 9231E171D01109BFDB159F90DC85EFFB7BCEF08311F044169EA15A2191DA74AE89AA60

Function 00F562CD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00F562EC
GetWindowLongW.USER32(01796450,000000F0), ref: 00F5631F
GetWindowLongW.USER32(01796450,000000F0), ref: 00F56354
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00F56386
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00F563B0
GetWindowLongW.USER32(00000000,000000F0), ref: 00F563C1
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00F563DB

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 5d69312cc440b590e6df9c911eab3f4942c91a08d5b2164a0c4c9abae23162be
Instruction ID: b66c3fddf178f7f9942fe82f41144603ecc0bc823e7063bd720b2db7406f2487
Opcode Fuzzy Hash: 5d69312cc440b590e6df9c911eab3f4942c91a08d5b2164a0c4c9abae23162be
Instruction Fuzzy Hash: 20310231A44254AFEB21CF18DC84F5537E1FB4A766F5901A5FA21CF2B2CB71A848EB50

Function 00F2DAEB Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F2DB2E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F2DB54
SysAllocString.OLEAUT32(00000000), ref: 00F2DB57
SysAllocString.OLEAUT32(?), ref: 00F2DB75
SysFreeString.OLEAUT32(?), ref: 00F2DB7E
StringFromGUID2.OLE32(?,?,00000028), ref: 00F2DBA3
SysAllocString.OLEAUT32(?), ref: 00F2DBB1

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 90c0ee9bedfe270bf8264311efee0d88bc1322e152eb3ae6803ff58a0152f293
Instruction ID: a2ecd81b445321f0d00a16c0abb3e027f94c90390ba48e78a474673e01843b43
Opcode Fuzzy Hash: 90c0ee9bedfe270bf8264311efee0d88bc1322e152eb3ae6803ff58a0152f293
Instruction Fuzzy Hash: 4521A132A01229AF9F10DFA8EC98CBB73ACEB48360B018165FE14DB250D770AC45A760

Function 00F46173 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00F47D8B: inet_addr.WSOCK32(00000000), ref: 00F47DB6

socket.WSOCK32(00000002,00000001,00000006), ref: 00F461C6
WSAGetLastError.WSOCK32(00000000), ref: 00F461D5
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00F4620E
connect.WSOCK32(00000000,?,00000010), ref: 00F46217
WSAGetLastError.WSOCK32 ref: 00F46221
closesocket.WSOCK32(00000000), ref: 00F4624A
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00F46263

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: f1d71fa9cefbb146e9cf347d144fef5de70a23f85184f6b7a7addef3026157fe
Instruction ID: f96622487f24c48d7d495a5fe31156605814c3d2c7595170c004ba5b2a92468d
Opcode Fuzzy Hash: f1d71fa9cefbb146e9cf347d144fef5de70a23f85184f6b7a7addef3026157fe
Instruction Fuzzy Hash: F331B531600218AFDF10AF24CC85BBD7BACEF45721F044069FD05E7291DB74AD04AB62

Function 00F2F65E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00F2F671
__wcsnicmp.LIBCMT ref: 00F2F692
__wcsnicmp.LIBCMT ref: 00F2F6AC

Strings

#OnAutoItStartRegister, xrefs: 00F2F6A6
#notrayicon, xrefs: 00F2F669
#requireadmin, xrefs: 00F2F68C

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 1affbb937906beabc92efa5d5bd9b5342dcb783c880b661414d49f714ea8b89f
Instruction ID: d7b0e517e03bdd2465cbf657c8721f5fc620e971f4ddf342e3b71c6011ab24c6
Opcode Fuzzy Hash: 1affbb937906beabc92efa5d5bd9b5342dcb783c880b661414d49f714ea8b89f
Instruction Fuzzy Hash: CD21467262463166D220AB34FC02FB773E8EF55360F14403AF946D6191EB519D4AE395

Function 00F2DBC4 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F2DC09
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F2DC2F
SysAllocString.OLEAUT32(00000000), ref: 00F2DC32
SysAllocString.OLEAUT32 ref: 00F2DC53
SysFreeString.OLEAUT32 ref: 00F2DC5C
StringFromGUID2.OLE32(?,?,00000028), ref: 00F2DC76
SysAllocString.OLEAUT32(?), ref: 00F2DC84

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 73900e61ea147cc32d3c425549a9d63eed6d402d42b3729f773e0245b3280b1d
Instruction ID: 389a07bc5a250cfe724fcea3ebb9ab63d94e8c44668b2665dcf4f37a7805f62e
Opcode Fuzzy Hash: 73900e61ea147cc32d3c425549a9d63eed6d402d42b3729f773e0245b3280b1d
Instruction Fuzzy Hash: 36219836605218AFDB10DFB8EC88DBB77ECEB09360B508165FA14CB261D670EC45D764

Function 00F575CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00ED1D73
Part of subcall function 00ED1D35: GetStockObject.GDI32(00000011), ref: 00ED1D87
Part of subcall function 00ED1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00ED1D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00F57632
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00F5763F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00F5764A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00F57659
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00F57665

Strings

Msctls_Progress32, xrefs: 00F57603

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 14f34e80d08a124e1995d8a1fbe2fcd3c6093aa7d1e7bf5c424af4fe45c29e50
Instruction ID: fbf0f2c22f543d5b195b651ee75b1ace989039557b2db1eaca9596d9916a0ab2
Opcode Fuzzy Hash: 14f34e80d08a124e1995d8a1fbe2fcd3c6093aa7d1e7bf5c424af4fe45c29e50
Instruction Fuzzy Hash: 4A1193B211021DBFEF159F64CC85EE77F5DEF087A8F014115BB04A2050CA729C21EBA4

Function 00EF9AE6 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00EF9AE6

Part of subcall function 00EF3187: EncodePointer.KERNEL32(00000000), ref: 00EF318A
Part of subcall function 00EF3187: __initp_misc_winsig.LIBCMT ref: 00EF31A5
Part of subcall function 00EF3187: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00EF9EA0
Part of subcall function 00EF3187: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00EF9EB4
Part of subcall function 00EF3187: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00EF9EC7
Part of subcall function 00EF3187: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00EF9EDA
Part of subcall function 00EF3187: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00EF9EED
Part of subcall function 00EF3187: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00EF9F00
Part of subcall function 00EF3187: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00EF9F13
Part of subcall function 00EF3187: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00EF9F26
Part of subcall function 00EF3187: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00EF9F39
Part of subcall function 00EF3187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00EF9F4C
Part of subcall function 00EF3187: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00EF9F5F
Part of subcall function 00EF3187: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00EF9F72
Part of subcall function 00EF3187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00EF9F85
Part of subcall function 00EF3187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00EF9F98
Part of subcall function 00EF3187: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00EF9FAB
Part of subcall function 00EF3187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00EF9FBE

__mtinitlocks.LIBCMT ref: 00EF9AEB
__mtterm.LIBCMT ref: 00EF9AF4

Part of subcall function 00EF9B5C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00EF9AF9,00EF7CD0,00F8A0B8,00000014), ref: 00EF9C56
Part of subcall function 00EF9B5C: _free.LIBCMT ref: 00EF9C5D
Part of subcall function 00EF9B5C: DeleteCriticalSection.KERNEL32(00F8EC00,?,?,00EF9AF9,00EF7CD0,00F8A0B8,00000014), ref: 00EF9C7F

__calloc_crt.LIBCMT ref: 00EF9B19
__initptd.LIBCMT ref: 00EF9B3B
GetCurrentThreadId.KERNEL32 ref: 00EF9B42

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 49f3f23a5ceb70875c879f085288332f70da58ac528a29e6dfc6769462cc94ca
Instruction ID: 1003e1d476fa3b4f47a6868cac927d1ca942aac15b2609dd46005befd262d017
Opcode Fuzzy Hash: 49f3f23a5ceb70875c879f085288332f70da58ac528a29e6dfc6769462cc94ca
Instruction Fuzzy Hash: B6F0C232619B1D19E73476747C07BBA36D09B02338B202659F7D4F50D7EF6184000264

Function 00EF406B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00EF3F85), ref: 00EF4085
GetProcAddress.KERNEL32(00000000), ref: 00EF408C
EncodePointer.KERNEL32(00000000), ref: 00EF4097
DecodePointer.KERNEL32(00EF3F85), ref: 00EF40B2

Strings

RoUninitialize, xrefs: 00EF4074
combase.dll, xrefs: 00EF4080

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 76812f64d6dcf90755b436e56ede686e9d40cb9a2dd5467138756cab72388c3c
Instruction ID: 9f715dca09ccd9a9df992021827ef103fb5eb7e887e48f6fc8e8118c8f69be18
Opcode Fuzzy Hash: 76812f64d6dcf90755b436e56ede686e9d40cb9a2dd5467138756cab72388c3c
Instruction Fuzzy Hash: 82E0B6B0981708EFEB61AF61EC0DB163AA4B704787F104066F205E20F0CFB68648FA16

Function 00F364B8 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F3660B
_memmove.LIBCMT ref: 00F36546

Part of subcall function 00ED9837: __itow.LIBCMT ref: 00ED9862
Part of subcall function 00ED9837: __swprintf.LIBCMT ref: 00ED98AC

_memmove.LIBCMT ref: 00F365B9
_memmove.LIBCMT ref: 00F366A0
_memmove.LIBCMT ref: 00F366B9
_memmove.LIBCMT ref: 00F366D5

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 1a44ea1867cdb98926dfc3f4012692738adcbdbdccd52b9821b2ba9a2b0d409a
Instruction ID: 9d80fb99b31ff3e3b8af47775d15159e50141b308aa1ce1f51ec825ee7af74a5
Opcode Fuzzy Hash: 1a44ea1867cdb98926dfc3f4012692738adcbdbdccd52b9821b2ba9a2b0d409a
Instruction Fuzzy Hash: 7761AD3590025AABCF05EF60CC82EFE37A5EF45328F048529F955AB293DB34D806EB50

Function 00F501E4 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED7DE1: _memmove.LIBCMT ref: 00ED7E22

Part of subcall function 00F50E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F4FDAD,?,?), ref: 00F50E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F502BD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00F502FD
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00F50320
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00F50349
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00F5038C
RegCloseKey.ADVAPI32(00000000), ref: 00F50399

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: d65b2d943943fe7136e947098fbba09eeba9426349e0efa5a42222f4fc3f9daf
Instruction ID: 54c0484343e16f085154fff1d6705f8891e08329179b41a03b4ae883dc01602d
Opcode Fuzzy Hash: d65b2d943943fe7136e947098fbba09eeba9426349e0efa5a42222f4fc3f9daf
Instruction Fuzzy Hash: 08515871508304AFC710EF64C885E6EBBE8FF85314F04491DFA95972A2DB31E909DB52

Function 00F55799 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00F557FB
GetMenuItemCount.USER32(00000000), ref: 00F55832
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00F5585A
GetMenuItemID.USER32(?,?), ref: 00F558C9
GetSubMenu.USER32(?,?), ref: 00F558D7
PostMessageW.USER32(?,00000111,?,00000000), ref: 00F55928

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: a12443c300ada88d22ae2995d2ed9d7921e8f1d56c6996e460208fb4577223d8
Instruction ID: 37968119492fcad4d73d8d6e1150ac0a44440861795683d55604d8d124d28392
Opcode Fuzzy Hash: a12443c300ada88d22ae2995d2ed9d7921e8f1d56c6996e460208fb4577223d8
Instruction Fuzzy Hash: E7516D35E00619EFCF05EF64C855AAEB7B4EF48721F1440A9EE01BB351CB34AE45AB90

Function 00F2EEEC Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F2EF06
VariantClear.OLEAUT32(00000013), ref: 00F2EF78
VariantClear.OLEAUT32(00000000), ref: 00F2EFD3
_memmove.LIBCMT ref: 00F2EFFD
VariantClear.OLEAUT32(?), ref: 00F2F04A
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00F2F078

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: a13e6827af693f6feae158b4323caaa6626bf49627e7b4beb1abe4a7fcb306f8
Instruction ID: 8ebe3452a994d6496059070cd48ce1816d0c0ac11ba66140218fad11f2e84382
Opcode Fuzzy Hash: a13e6827af693f6feae158b4323caaa6626bf49627e7b4beb1abe4a7fcb306f8
Instruction Fuzzy Hash: 2E5179B5A00219EFCB10DF58D884AAAB7B8FF4C310B158569EA49DB305E330E915CFA0

Function 00F3220A Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F32258
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F322A3
IsMenu.USER32(00000000), ref: 00F322C3
CreatePopupMenu.USER32 ref: 00F322F7
GetMenuItemCount.USER32(000000FF), ref: 00F32355
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00F32386

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 5066f846b308381d0b391d45f89316f45d30032f227aba5ef40b4450da9bedfb
Instruction ID: a43b9542252b5f9bfb559f403722fd11e2db1fb815063f5cc03f6676a43375cb
Opcode Fuzzy Hash: 5066f846b308381d0b391d45f89316f45d30032f227aba5ef40b4450da9bedfb
Instruction Fuzzy Hash: EC51CD30A01309EBDF61CF68D888BAEBBF5BF05334F144169E855AB290E3799904EB51

Function 00ED1765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00ED2612: GetWindowLongW.USER32(?,000000EB), ref: 00ED2623

BeginPaint.USER32(?,?,?,?,?,?), ref: 00ED179A
GetWindowRect.USER32(?,?), ref: 00ED17FE
ScreenToClient.USER32(?,?), ref: 00ED181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00ED182C
EndPaint.USER32(?,?), ref: 00ED1876

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 063da23ea0b3aa8acb808000716abc13b7c5256b9941ec951c28d07b77187d1d
Instruction ID: dcedf924c3039281c1d7fa6c26839fa808134c4b358983163dd69159cc7c4b2b
Opcode Fuzzy Hash: 063da23ea0b3aa8acb808000716abc13b7c5256b9941ec951c28d07b77187d1d
Instruction Fuzzy Hash: 9741B330504704AFDB11DF25DC84FBA7BE8EB46724F0446AAF6A4972B1C7319846FB61

Function 00F5B69E Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00F957B0,00000000,01796450,?,?,00F957B0,?,00F5B5A8,?,?), ref: 00F5B712
EnableWindow.USER32(00000000,00000000), ref: 00F5B736
ShowWindow.USER32(00F957B0,00000000,01796450,?,?,00F957B0,?,00F5B5A8,?,?), ref: 00F5B796
ShowWindow.USER32(00000000,00000004,?,00F5B5A8,?,?), ref: 00F5B7A8
EnableWindow.USER32(00000000,00000001), ref: 00F5B7CC
SendMessageW.USER32(?,0000130C,?,00000000), ref: 00F5B7EF

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: ce0ca474de4516ef59157b944b1e6a86c6c82372aa0a3f80dd505450207e506d
Instruction ID: 95feb9116ad1a824231ec70b1acc89727587bfc2cc2bfd05b550aaeb4ab0c216
Opcode Fuzzy Hash: ce0ca474de4516ef59157b944b1e6a86c6c82372aa0a3f80dd505450207e506d
Instruction Fuzzy Hash: 95416734900244AFDB25CF24D499B957BE1FF49322F1841B5EF488F562C731A85ADB51

Function 00F4709E Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00F44E41,?,?,00000000,00000001), ref: 00F470AC

Part of subcall function 00F439A0: GetWindowRect.USER32(?,?), ref: 00F439B3

GetDesktopWindow.USER32 ref: 00F470D6
GetWindowRect.USER32(00000000), ref: 00F470DD
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00F4710F

Part of subcall function 00F35244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00F352BC

GetCursorPos.USER32(?), ref: 00F4713B
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00F47199

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 6058056514662d5d06031091f7230db4415b6e6fff6bc7f2377a2129fed3c7cc
Instruction ID: 68bf0b6b8fa45277fb18192ad7dba03ecbf112a6fab4f0d350fb0fc8d6b4f525
Opcode Fuzzy Hash: 6058056514662d5d06031091f7230db4415b6e6fff6bc7f2377a2129fed3c7cc
Instruction Fuzzy Hash: FD31D272509309ABD720EF14CC49F9BBBAAFFC8314F000919F985A7191D734EA09DB92

Function 00F28879 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F280A9: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00F280C0
Part of subcall function 00F280A9: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00F280CA
Part of subcall function 00F280A9: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00F280D9
Part of subcall function 00F280A9: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00F280E0
Part of subcall function 00F280A9: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00F280F6

GetLengthSid.ADVAPI32(?,00000000,00F2842F), ref: 00F288CA
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00F288D6
HeapAlloc.KERNEL32(00000000), ref: 00F288DD
CopySid.ADVAPI32(00000000,00000000,?), ref: 00F288F6
GetProcessHeap.KERNEL32(00000000,00000000,00F2842F), ref: 00F2890A
HeapFree.KERNEL32(00000000), ref: 00F28911

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 4369b643c19301ec8a16b7961e1512e995deb0ac338f82626343f84bdcbbe5f7
Instruction ID: a7d456a34720214083a0285449942f5606c347b93e6562ae47438f56a8381309
Opcode Fuzzy Hash: 4369b643c19301ec8a16b7961e1512e995deb0ac338f82626343f84bdcbbe5f7
Instruction Fuzzy Hash: 5A11B132902619FFDB109FA4EC09BBE7B68EB44362F148068E945D7111CB329D46EB60

Function 00F285B1 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00F285E2
OpenProcessToken.ADVAPI32(00000000), ref: 00F285E9
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00F285F8
CloseHandle.KERNEL32(00000004), ref: 00F28603
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00F28632
DestroyEnvironmentBlock.USERENV(00000000), ref: 00F28646

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 36a355df30eba9b277815d6afef514e81f3bf5c1442ef6d2776da7dc03a4e62d
Instruction ID: 097c748c020bd0da509d7ca3e59a0e12826a4f0a5b75c85fcb2765168d4b1ac7
Opcode Fuzzy Hash: 36a355df30eba9b277815d6afef514e81f3bf5c1442ef6d2776da7dc03a4e62d
Instruction Fuzzy Hash: F1116AB250220DABDF018FA4ED49FDE7BA9EF08355F084064FE05A21A0C7729D65EB60

Function 00F2B790 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00F2B7B5
GetDeviceCaps.GDI32(00000000,00000058), ref: 00F2B7C6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00F2B7CD
ReleaseDC.USER32(00000000,00000000), ref: 00F2B7D5
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00F2B7EC
MulDiv.KERNEL32(000009EC,?,?), ref: 00F2B7FE

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 94321793307ea9667ded1a10677aa6e57f0b40bac890c75421f0bd8faf481fcd
Instruction ID: 98ee6ca24a404fac91b1ee4079dc5bf73e9e655d5ab8b3adf2c2c51c1c3acb88
Opcode Fuzzy Hash: 94321793307ea9667ded1a10677aa6e57f0b40bac890c75421f0bd8faf481fcd
Instruction Fuzzy Hash: D3018475E00319BBEB109BA69C45A5EBFB8EB48321F0040B5FF04EB291D6309C04DF90

Function 00EF0162 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00EF0193
MapVirtualKeyW.USER32(00000010,00000000), ref: 00EF019B
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00EF01A6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00EF01B1
MapVirtualKeyW.USER32(00000011,00000000), ref: 00EF01B9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00EF01C1

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 39aaf055f2d17ff8a334dca0fb025251d83cd6eb32c0ea82540ad95bd9a74a47
Instruction ID: 4ffd7459b55b67004f8428738d5149251d096aca1a94612b1b7153e72e875c47
Opcode Fuzzy Hash: 39aaf055f2d17ff8a334dca0fb025251d83cd6eb32c0ea82540ad95bd9a74a47
Instruction Fuzzy Hash: 43016CB09017597DE3009F5A8C85B52FFE8FF19354F00415BA15C47941C7F5A868CBE5

Function 00F353E9 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00F353F9
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00F3540F
GetWindowThreadProcessId.USER32(?,?), ref: 00F3541E
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F3542D
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F35437
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F3543E

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 87be0ddaa886498bb8746757dc129c3af64614cf0730a01f61977b253a1defb0
Instruction ID: eb47b0904c88b6f172b53fb6eacb072d555aba0ff5168caeaff112392fcaa9fe
Opcode Fuzzy Hash: 87be0ddaa886498bb8746757dc129c3af64614cf0730a01f61977b253a1defb0
Instruction Fuzzy Hash: E4F01D3264165CBBE7215BA2DC0DEAB7B7CEBC6B12F0001A9FB05D206196A11A05A6B5

Function 00F37230 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00F37243
EnterCriticalSection.KERNEL32(?,?,00EE0EE4,?,?), ref: 00F37254
TerminateThread.KERNEL32(00000000,000001F6,?,00EE0EE4,?,?), ref: 00F37261
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00EE0EE4,?,?), ref: 00F3726E

Part of subcall function 00F36C35: CloseHandle.KERNEL32(00000000,?,00F3727B,?,00EE0EE4,?,?), ref: 00F36C3F

InterlockedExchange.KERNEL32(?,000001F6), ref: 00F37281
LeaveCriticalSection.KERNEL32(?,?,00EE0EE4,?,?), ref: 00F37288

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: f47957cb713c378d07a73e7e59c5a87dd725bc2e5cadb6bbb0b69331d9267610
Instruction ID: 731d2b1033b69c28be3cbfee72bfcac0d9dae599b29993d70b3ed91128ac32fb
Opcode Fuzzy Hash: f47957cb713c378d07a73e7e59c5a87dd725bc2e5cadb6bbb0b69331d9267610
Instruction Fuzzy Hash: 15F05EB6541716EBDB122B64ED4C9DB7729EF45723F100571F603914A0CB7A5805EB50

Function 00F28992 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00F2899D
UnloadUserProfile.USERENV(?,?), ref: 00F289A9
CloseHandle.KERNEL32(?), ref: 00F289B2
CloseHandle.KERNEL32(?), ref: 00F289BA
GetProcessHeap.KERNEL32(00000000,?), ref: 00F289C3
HeapFree.KERNEL32(00000000), ref: 00F289CA

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: c9e66b17401a949f9c73dcde777b6a8f759fae44859c40939d51645e491f4d35
Instruction ID: a1512b1a25ac41438a20eaffc439eb23b660bfa9f0839c212a3e91d06bd8e0de
Opcode Fuzzy Hash: c9e66b17401a949f9c73dcde777b6a8f759fae44859c40939d51645e491f4d35
Instruction Fuzzy Hash: BBE05276105609FBDA012FE5EC0C95ABB69FB89763B508671F31981470CB32A469EB50

Function 00F485ED Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F48613
CharUpperBuffW.USER32(?,?), ref: 00F48722
VariantClear.OLEAUT32(?), ref: 00F4889A

Part of subcall function 00F37562: VariantInit.OLEAUT32(00000000), ref: 00F375A2
Part of subcall function 00F37562: VariantCopy.OLEAUT32(00000000,?), ref: 00F375AB
Part of subcall function 00F37562: VariantClear.OLEAUT32(00000000), ref: 00F375B7

Strings

AUTOIT.ERROR, xrefs: 00F48728
Incorrect Parameter format, xrefs: 00F4864B, 00F4880D

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 9dbdde52f3159aa88afe5a49ffc595807d5af14042549656d749399df90501be
Instruction ID: 9eff17961ddce2f44ded378a40774e126b780fb319ad2d7111b14363579e3882
Opcode Fuzzy Hash: 9dbdde52f3159aa88afe5a49ffc595807d5af14042549656d749399df90501be
Instruction Fuzzy Hash: BA918F71A043019FC710DF24C88495EBBE4EF89754F14496EF89A9B362DB31ED06DB92

Function 00F32A96 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EEFC86: _wcscpy.LIBCMT ref: 00EEFCA9

_memset.LIBCMT ref: 00F32B87
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00F32BB6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00F32C69
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00F32C97

Strings

0, xrefs: 00F32B73

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: d3dd26d1f235da5bb8f428fd143a9dcc32c52570d2f642f2c3408c387c205c1b
Instruction ID: 9bbdd5b26dd538e0c7ec2e44928d45fb14b9ec61f2152dd6472063caad6dc094
Opcode Fuzzy Hash: d3dd26d1f235da5bb8f428fd143a9dcc32c52570d2f642f2c3408c387c205c1b
Instruction Fuzzy Hash: 6E51DE71A083009BDBA59F28D845A6FB7E8EF853B0F141A2DF991E3291DB70CD04A752

Function 00EE3137 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00EE3277
_memmove.LIBCMT ref: 00EE3310
_free.LIBCMT ref: 00EE3336
_memmove.LIBCMT ref: 00EE33E9

Strings

_, xrefs: 00EE3322
3c, xrefs: 00EE3225

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: _memmove$_free
String ID: 3c$_
API String ID: 2620147621-4099079164
Opcode ID: 759580df80124e200fbccd0f8c56b726c4bbb87f3630610b5098cc3d5ccb541f
Instruction ID: b6fc7d6fd9f65311c24623b71c7d0ccc4351d61ffb1aedf183b3064cc7275f24
Opcode Fuzzy Hash: 759580df80124e200fbccd0f8c56b726c4bbb87f3630610b5098cc3d5ccb541f
Instruction Fuzzy Hash: D9519B71A043858FDB24CF29C844B6EBBE5EF85314F04592DE999E7391EB31E941CB42

Function 00EE6192 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00EE6248
_memmove.LIBCMT ref: 00EE62E4
_memset.LIBCMT ref: 00EE6308

Strings

ERCP, xrefs: 00EE61B3
3c, xrefs: 00EE62AF

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: _memset$_memmove
String ID: 3c$ERCP
API String ID: 2532777613-1756721700
Opcode ID: 7de2801853cb130c35da7899e220128079ab4b8c2c599b209d36e06ca560c0f1
Instruction ID: bdeba601a69cf273f76ba3dc09b8c55f4964d8e868bed7b6e08e2d80658725a3
Opcode Fuzzy Hash: 7de2801853cb130c35da7899e220128079ab4b8c2c599b209d36e06ca560c0f1
Instruction Fuzzy Hash: 4F51D271900309DBDB24CF66C841BEAB7F4EF58354F20856EE94AEB251E770EA40CB40

Function 00F2D56C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00F2D5D4
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00F2D60A
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00F2D61B
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00F2D69D

Strings

DllGetClassObject, xrefs: 00F2D610

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: df892a7f5ceb9ed69e88e3bf35cd4e73e1bd95819922151752b638f3eece9e0a
Instruction ID: 8328799abb59b0a66c9082ee5b2db135dd780115e4c149d6d349aa6929abc8ab
Opcode Fuzzy Hash: df892a7f5ceb9ed69e88e3bf35cd4e73e1bd95819922151752b638f3eece9e0a
Instruction Fuzzy Hash: 4241BFB1600214EFDB04DF64D884B9A7FAAEF44314F1581A9ED09DF246D7B4DD44EBA0

Function 00F32753 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F327C0
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00F327DC
DeleteMenu.USER32(?,00000007,00000000), ref: 00F32822
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00F95890,00000000), ref: 00F3286B

Strings

0, xrefs: 00F327B5

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 9e28e54efe157b349328f77165de98239bd7900e43385ff30194f1b46aef0f02
Instruction ID: 72f3687fce4d28850b13304777ca8efb738aba80659260f9afc9b5a9dd9ea8d3
Opcode Fuzzy Hash: 9e28e54efe157b349328f77165de98239bd7900e43385ff30194f1b46aef0f02
Instruction Fuzzy Hash: A241BE716043019FDB60DF24CC84B2ABBE8EF85334F144A6EF9A697291D734E905DB62

Function 00F4D7A5 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00F4D7C5

Part of subcall function 00ED784B: _memmove.LIBCMT ref: 00ED7899

Strings

winapi, xrefs: 00F4D836
none, xrefs: 00F4D8A0
cdecl, xrefs: 00F4D81C
stdcall, xrefs: 00F4D847

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 491ad547228c9f579e5bca756351e11801f4071d1c510bf2c108087fcfe5da69
Instruction ID: 56d4eea2240237b924548d625b09dae5d89c88bb96988c52d8eba8b24f6df116
Opcode Fuzzy Hash: 491ad547228c9f579e5bca756351e11801f4071d1c510bf2c108087fcfe5da69
Instruction Fuzzy Hash: E6317A71904619ABCF00EF58C9519FEB7F5FF04320B10866AE866A77D2DB71A906DB80

Function 00F28E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED7DE1: _memmove.LIBCMT ref: 00ED7E22

Part of subcall function 00F2AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00F2AABC

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00F28F14
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00F28F27
SendMessageW.USER32(?,00000189,?,00000000), ref: 00F28F57

Part of subcall function 00ED7BCC: _memmove.LIBCMT ref: 00ED7C06

Strings

ComboBox, xrefs: 00F28E9E
ListBox, xrefs: 00F28ED3

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 8b2b97225322fe19bfba50e06c41a0f8db9dd04028a01ac9c05e2cc806c46591
Instruction ID: d796243cbbc9da050805adb63be32eed4bcacce56e829982e2b07b13afe4705b
Opcode Fuzzy Hash: 8b2b97225322fe19bfba50e06c41a0f8db9dd04028a01ac9c05e2cc806c46591
Instruction Fuzzy Hash: 44210472A01208BBDB14ABB0DC85DFFB7A9DF453A0F14411AF821A72E1DF39480AA610

Function 00F4182D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00F4184C
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00F41872
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00F418A2
InternetCloseHandle.WININET(00000000), ref: 00F418E9

Part of subcall function 00F42483: GetLastError.KERNEL32(?,?,00F41817,00000000,00000000,00000001), ref: 00F42498
Part of subcall function 00F42483: SetEvent.KERNEL32(?,?,00F41817,00000000,00000000,00000001), ref: 00F424AD

Strings

, xrefs: 00F41893

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 0d0b6184f590c467a6fab970dc13959d9a11a59dc65018885cfa9e20a44fe907
Instruction ID: 319dba2816ca62c81204a03c4d85100d9395d78c95f7c8422b51749a0b7134b9
Opcode Fuzzy Hash: 0d0b6184f590c467a6fab970dc13959d9a11a59dc65018885cfa9e20a44fe907
Instruction Fuzzy Hash: 1421BEB150030CBFEB119B60DC85EBF7BEDFB48755F10412AF905A2240EA248D48B7A0

Function 00F563E7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00ED1D73
Part of subcall function 00ED1D35: GetStockObject.GDI32(00000011), ref: 00ED1D87
Part of subcall function 00ED1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00ED1D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00F56461
LoadLibraryW.KERNEL32(?), ref: 00F56468
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00F5647D
DestroyWindow.USER32(?), ref: 00F56485

Strings

SysAnimate32, xrefs: 00F5643C

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 6f3d30c29dc216e54bcb266ecaf8ae3dc65b8578b0d5ea221ded151e702247fa
Instruction ID: f04a738a926dcc0dbd4f2459d964ac4e1b2714c0ada79aad791e7c7f49198880
Opcode Fuzzy Hash: 6f3d30c29dc216e54bcb266ecaf8ae3dc65b8578b0d5ea221ded151e702247fa
Instruction Fuzzy Hash: 51217C71600209ABEF108F64DC80EBB77A9EB59375F904629FB20D3190D7759C45B760

Function 00F36D9C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00F36DBC
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00F36DEF
GetStdHandle.KERNEL32(0000000C), ref: 00F36E01
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00F36E3B

Strings

nul, xrefs: 00F36E36

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 171b51be50142e84b62fcd19e37d134f662f28b368163192d2d48631fe954553
Instruction ID: 6099b1c527f6188aa82d5eda8b65ae3223dd2048bc546126943c94af4bd6be6a
Opcode Fuzzy Hash: 171b51be50142e84b62fcd19e37d134f662f28b368163192d2d48631fe954553
Instruction Fuzzy Hash: 13219275A00309BBDB209F29DC04A9A77F4EF45731F208629FDA0D72D0DB709955AB54

Function 00F36E6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00F36E89
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00F36EBB
GetStdHandle.KERNEL32(000000F6), ref: 00F36ECC
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00F36F06

Strings

nul, xrefs: 00F36F01

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 76a639aed1812cd86b607b2e0d67b078b09e99a6916e292d9e87fb1839929b8b
Instruction ID: ae743f726f30061657a76d2a1915fde461197930f87a106fedc957410c6207da
Opcode Fuzzy Hash: 76a639aed1812cd86b607b2e0d67b078b09e99a6916e292d9e87fb1839929b8b
Instruction Fuzzy Hash: 5C21B079900305EBDB209F69CC04A9A77E8AF45731F208A19F9A0D72D0DB70A898AB14

Function 00F3AC40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00F3AC54
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00F3ACA8
__swprintf.LIBCMT ref: 00F3ACC1
SetErrorMode.KERNEL32(00000000,00000001,00000000,00F5F910), ref: 00F3ACFF

Strings

%lu, xrefs: 00F3ACBB

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 6dd4536d45ea16d2f6d1f053f57fe7c5e3bb7ccf5b1b4353a6b6076c38162e5a
Instruction ID: 4622fb2dc3601fd8bdc012d27f64adbf7423b6e7495446df65f44f7897484f14
Opcode Fuzzy Hash: 6dd4536d45ea16d2f6d1f053f57fe7c5e3bb7ccf5b1b4353a6b6076c38162e5a
Instruction Fuzzy Hash: 44217135A00209AFCB10DF65CD45DAE7BF8EF89715B0040A9F909EB352DB31EA45DB61

Function 00F31AE8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00F31B19

Strings

REMOVE, xrefs: 00F31B1F
APPEND, xrefs: 00F31B52
EXISTS, xrefs: 00F31B41
KEYS, xrefs: 00F31B30

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: aa3eb11aaeda4b1fcf9b62ef7351ece236c1c0f54ddb095a7100e3980e46df72
Instruction ID: e8ab55dcb50c58096b2ed3bbbb4ec8066ba4cca0e2695d7745ca6510a4995260
Opcode Fuzzy Hash: aa3eb11aaeda4b1fcf9b62ef7351ece236c1c0f54ddb095a7100e3980e46df72
Instruction Fuzzy Hash: C3115B719102088FCF00EFA4D9618FEF7B4FF66324F5484A9D814AB692EB325D06EB50

Function 00F4EB55 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00F4EC07
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00F4EC37
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00F4ED6A
CloseHandle.KERNEL32(?), ref: 00F4EDEB

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 67ba89c1fa4bbce1360dfb1405204c70acb87c0a36d95ff7c88434c4d50fcc4d
Instruction ID: 1dfefc5fc44005a40b6c64e6571ddd7f4a4e52f16700bdd1ef5b9498e0937209
Opcode Fuzzy Hash: 67ba89c1fa4bbce1360dfb1405204c70acb87c0a36d95ff7c88434c4d50fcc4d
Instruction Fuzzy Hash: 1C814E71A003009FD764EF28CC46B6AB7E5EF44720F14881EF999EB3D2D671AC419B52

Function 00F50037 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED7DE1: _memmove.LIBCMT ref: 00ED7E22

Part of subcall function 00F50E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00F4FDAD,?,?), ref: 00F50E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00F500FD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00F5013C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00F50183
RegCloseKey.ADVAPI32(?,?), ref: 00F501AF
RegCloseKey.ADVAPI32(00000000), ref: 00F501BC

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: bd4c894190ba7641c276e195ef226c3ff94bba93790a0e35f1bb133093d5fa24
Instruction ID: 59d9246261c28bb6458ae59bb1b37822f1c34b7796d500fcc0ebd6d9575e4c53
Opcode Fuzzy Hash: bd4c894190ba7641c276e195ef226c3ff94bba93790a0e35f1bb133093d5fa24
Instruction Fuzzy Hash: 96516971608304AFC704EF58CC81E6AB7E9FF84314F44492EFA95972A2DB31E909DB52

Function 00F4D8C8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED9837: __itow.LIBCMT ref: 00ED9862
Part of subcall function 00ED9837: __swprintf.LIBCMT ref: 00ED98AC

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00F4D927
GetProcAddress.KERNEL32(00000000,?), ref: 00F4D9AA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00F4D9C6
GetProcAddress.KERNEL32(00000000,?), ref: 00F4DA07
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00F4DA21

Part of subcall function 00ED5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00F37896,?,?,00000000), ref: 00ED5A2C
Part of subcall function 00ED5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00F37896,?,?,00000000,?,?), ref: 00ED5A50

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: d2d38b2f0cceeb528d5c8944d10a137f692e2e21f5b83f336e99a2d7ba92804e
Instruction ID: a71999c8e22c174f5aaeda412b058a62fbfca48676eddfc4f1253bcb1b4e2208
Opcode Fuzzy Hash: d2d38b2f0cceeb528d5c8944d10a137f692e2e21f5b83f336e99a2d7ba92804e
Instruction Fuzzy Hash: 0D512A35A00609DFCB00EFA8C8849ADBBF5FF09324B1580A6E955AB312D735ED46DF91

Function 00F3E571 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00F3E61F
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00F3E648
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00F3E687

Part of subcall function 00ED9837: __itow.LIBCMT ref: 00ED9862
Part of subcall function 00ED9837: __swprintf.LIBCMT ref: 00ED98AC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00F3E6AC
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00F3E6B4

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 8ff9657bb52e784af114aa727ca22da0f3ed7d6dadc09effe70c34ff030e79da
Instruction ID: a9bdb0fc4bf66998b8ec9853154b1e7fec8b68d2db019bdf5d1000c0b0bc27fc
Opcode Fuzzy Hash: 8ff9657bb52e784af114aa727ca22da0f3ed7d6dadc09effe70c34ff030e79da
Instruction Fuzzy Hash: 8D510C79A00209DFCB05EF64C9819AEBBF5EF09314F1480A5E909AB362CB31ED55DF50

Function 00F5A056 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f55db90634ecc4d9292b932cc2187916b799e630b371e5cc3ccd483869b35e43
Instruction ID: e165217159b34888aa19289bf05706b7a76da23c3a4e64a6b7914efaddbd71de
Opcode Fuzzy Hash: f55db90634ecc4d9292b932cc2187916b799e630b371e5cc3ccd483869b35e43
Instruction Fuzzy Hash: A141A335D04608AFD721DF28CC48FA9BBA4EB09322F150365FE15A72E1DB309D69FA51

Function 00ED2344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00ED2357
ScreenToClient.USER32(00F957B0,?), ref: 00ED2374
GetAsyncKeyState.USER32(00000001), ref: 00ED2399
GetAsyncKeyState.USER32(00000002), ref: 00ED23A7

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 0e2f8e419c13ee4b2963653e2d930d4b37083e7cb9b69ee865d8d4ad7788041e
Instruction ID: f616b67dee696c5a330b16203c25d9c37e946f504cba9a261dbaaeb637f969e7
Opcode Fuzzy Hash: 0e2f8e419c13ee4b2963653e2d930d4b37083e7cb9b69ee865d8d4ad7788041e
Instruction Fuzzy Hash: AE419D35A0420AFBCF159F68CC44AE9BB74FB15324F20435AF928A22A0C7359954EB91

Function 00F263AA Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F263E7
TranslateAcceleratorW.USER32(?,?,?), ref: 00F26433
TranslateMessage.USER32(?), ref: 00F2645C
DispatchMessageW.USER32(?), ref: 00F26466
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F26475

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: 16dd7a1db407f1a62cfea5f23651632d2275afa76a26e0228c16edaf46a3ad96
Instruction ID: a6851131f4271cb6b1f9739411e58f9ce3cdaf22c697ce0b7f9f9e50c1220728
Opcode Fuzzy Hash: 16dd7a1db407f1a62cfea5f23651632d2275afa76a26e0228c16edaf46a3ad96
Instruction Fuzzy Hash: 4831E831D0066AEFDB25DFB0EC44BB67BACAB01720F140166E561C71A1E7359889F761

Function 00F28A1F Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00F28A30
PostMessageW.USER32(?,00000201,00000001), ref: 00F28ADA
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00F28AE2
PostMessageW.USER32(?,00000202,00000000), ref: 00F28AF0
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00F28AF8

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 6a918bc73e14557ccc074670d20caa1b32be73f20cd811e052e9739b9d85cfb7
Instruction ID: 18a8c0d8665a8c89b47fde52c7cb3258646e99746e3032a67f070ea7aaca060b
Opcode Fuzzy Hash: 6a918bc73e14557ccc074670d20caa1b32be73f20cd811e052e9739b9d85cfb7
Instruction Fuzzy Hash: 4B31F171901229EBCB00CFA8E94CA9E3BB5EB05326F104229F925E71D0CBB49915EF90

Function 00F2B1EC Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00F2B204
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00F2B221
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00F2B259
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00F2B27F
_wcsstr.LIBCMT ref: 00F2B289

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 6eef3e87e0f62ef317561a973e44b15df8452716bf60ca72591845de82f70877
Instruction ID: 7adc288e390a0512b98b21bdaf411644fbb972d703f4d70b5d4e8bf8e22e9810
Opcode Fuzzy Hash: 6eef3e87e0f62ef317561a973e44b15df8452716bf60ca72591845de82f70877
Instruction Fuzzy Hash: E921F532604314BBEB169B75AC09E7F7B98DF49720F104169FD04DA1A1EB619C40A2A0

Function 00F5B14B Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00ED2612: GetWindowLongW.USER32(?,000000EB), ref: 00ED2623

GetWindowLongW.USER32(?,000000F0), ref: 00F5B192
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00F5B1B7
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00F5B1CF
GetSystemMetrics.USER32(00000004), ref: 00F5B1F8
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00F40E90,00000000), ref: 00F5B216

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 1053d6c2ecb0075f5243537316df05e15918da4c84803f5e3c048573b4252723
Instruction ID: 7c104a7b9e936134136c9c0ae92b9475e07768ee459ecca87e553cae2a9c7548
Opcode Fuzzy Hash: 1053d6c2ecb0075f5243537316df05e15918da4c84803f5e3c048573b4252723
Instruction Fuzzy Hash: 49218071910659AFCB219F38DC18A6A3BA4EB05772F144729BE32D71E0E7309815EB90

Function 00F29307 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00F29320

Part of subcall function 00ED7BCC: _memmove.LIBCMT ref: 00ED7C06

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00F29352
__itow.LIBCMT ref: 00F2936A
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00F29392
__itow.LIBCMT ref: 00F293A3

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 4d81f31901b120caf491cfdf1dae9e10df67791534cb9a90f2b7d398c1422ed0
Instruction ID: db0eecd88e1991646e9173bf2661897e3e24bb87f5a029f9b715911329c2af23
Opcode Fuzzy Hash: 4d81f31901b120caf491cfdf1dae9e10df67791534cb9a90f2b7d398c1422ed0
Instruction Fuzzy Hash: A121DA31B042186BDB10EBA49C85EEE7BEDEB48720F045025FE45E72D1D6F0CD45A7A1

Function 00F45A4D Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00F45A6E
GetForegroundWindow.USER32 ref: 00F45A85
GetDC.USER32(00000000), ref: 00F45AC1
GetPixel.GDI32(00000000,?,00000003), ref: 00F45ACD
ReleaseDC.USER32(00000000,00000003), ref: 00F45B08

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 117b28ab729fea1e8aab302d7f6e03f5c6ea37f3f4622e73435199ecb958acf8
Instruction ID: b4f6b3159fcd289e20077579927cfff18d4aa164e891be012a186d3de0a4f402
Opcode Fuzzy Hash: 117b28ab729fea1e8aab302d7f6e03f5c6ea37f3f4622e73435199ecb958acf8
Instruction Fuzzy Hash: B421C335A00208AFD704EF64DC88AAABBF5EF48751F148079F909D7362CB74AC05EB90

Function 00ED12F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00ED134D
SelectObject.GDI32(?,00000000), ref: 00ED135C
BeginPath.GDI32(?), ref: 00ED1373
SelectObject.GDI32(?,00000000), ref: 00ED139C

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: bf5de03a9118bb5131061d077f323262dfd72aedd66ac0984c5635c60dd786e4
Instruction ID: 56622374084a9d2849e63f4dba13a9115e37d50d9a09fd85916ca989906dc846
Opcode Fuzzy Hash: bf5de03a9118bb5131061d077f323262dfd72aedd66ac0984c5635c60dd786e4
Instruction Fuzzy Hash: A2213E3080170CEFDB129F25DC4476D7BA8EB10B26F194297F911A62B0D7719996EF90

Function 00F2BC9E Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00F2BCB3
_memcmp.LIBCMT ref: 00F2BCD1
_memcmp.LIBCMT ref: 00F2BCE4
_memcmp.LIBCMT ref: 00F2BCFC
_memcmp.LIBCMT ref: 00F2BD14

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 6db85577dcd2145786bbc04e1d5041c7fcae9a333a588cd077a885d85689e4c9
Instruction ID: 9fdd38f7d2a765346e77fdd9bcb6e6220e71b18767d37e0c8bfc6403443608ed
Opcode Fuzzy Hash: 6db85577dcd2145786bbc04e1d5041c7fcae9a333a588cd077a885d85689e4c9
Instruction Fuzzy Hash: 8C01B57264152DBBD2046B117D42FFBB75CDE713A8B044021FE15A6383EB51DE10A2A1

Function 00F34A93 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00F34ABA
__beginthreadex.LIBCMT ref: 00F34AD8
MessageBoxW.USER32(?,?,?,?), ref: 00F34AED
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00F34B03
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00F34B0A

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: be3c2edec0bf4aa0f29e487b0ef8bc2a36c00e928f8a4199942710aa89290d19
Instruction ID: 70ae6f6e1cf9c4c469f71112efea9dd52949c2446672252aaaea433747e8b8e2
Opcode Fuzzy Hash: be3c2edec0bf4aa0f29e487b0ef8bc2a36c00e928f8a4199942710aa89290d19
Instruction Fuzzy Hash: 9411047690570CBBC7019FB8AC08A9B7FACEB85331F1442AAF914D3250D671E904ABA0

Function 00F28202 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00F2821E
GetLastError.KERNEL32(?,00F27CE2,?,?,?), ref: 00F28228
GetProcessHeap.KERNEL32(00000008,?,?,00F27CE2,?,?,?), ref: 00F28237
HeapAlloc.KERNEL32(00000000,?,00F27CE2,?,?,?), ref: 00F2823E
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00F28255

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: c8d1300fea7ab1671d0d8ac6a90d5f2cc72beddc9f712f27f31d6c88870cae9c
Instruction ID: b4cad7cae34bbde921f6487bb7e482c1063faa5e9cabac3bbee4bfd86cc1122a
Opcode Fuzzy Hash: c8d1300fea7ab1671d0d8ac6a90d5f2cc72beddc9f712f27f31d6c88870cae9c
Instruction Fuzzy Hash: 6E016271601718FFDB104FA5EC48D6B7B6CEF857A57500469F909C3160DA318C05EA60

Function 00F2710A Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00F27044,80070057,?,?,?,00F27455), ref: 00F27127
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00F27044,80070057,?,?), ref: 00F27142
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00F27044,80070057,?,?), ref: 00F27150
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00F27044,80070057,?), ref: 00F27160
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00F27044,80070057,?,?), ref: 00F2716C

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 180348b366163e6bcba542d08907999aaf970d1e20576e54a63d77e38e4f3a8c
Instruction ID: a967f9d22dd035f97dddb25b28af1b6b04163468b89b16b764ab483c9fb7992b
Opcode Fuzzy Hash: 180348b366163e6bcba542d08907999aaf970d1e20576e54a63d77e38e4f3a8c
Instruction Fuzzy Hash: 96018472A01328BBDB115F64EC44BAA7BADEF44763F1400A4FE04D2260D731DD50ABA0

Function 00F35244 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00F35260
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00F3526E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00F35276
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00F35280
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00F352BC

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 28c87e0b4f8259df83cc647d7ae139f10474a29d3342d199349e80ebd32b06f7
Instruction ID: c025e873d1226743e56895dc9e2dfb9889dd42339d3717ec7814037a0e6d1a9d
Opcode Fuzzy Hash: 28c87e0b4f8259df83cc647d7ae139f10474a29d3342d199349e80ebd32b06f7
Instruction Fuzzy Hash: 49012971D01A1DDBCF00EFE4EC49AEEBB78FB49B22F400596EA45B2191CB309554A7A1

Function 00F2810A Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00F28121
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00F2812B
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F2813A
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00F28141
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F28157

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: a68df41e5afafd05af5024f4985186ca5f915879a610f998b28d6fee8e78180c
Instruction ID: 22a2a5506358aac62217277715b37db35b2a540d7bd84f0d58e4c12d412fbf85
Opcode Fuzzy Hash: a68df41e5afafd05af5024f4985186ca5f915879a610f998b28d6fee8e78180c
Instruction Fuzzy Hash: 99F06271602328AFEB110FA5EC8DE6B3BACFF497A5B040065FA45C7190CB619D56EA60

Function 00F2C1E3 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00F2C1F7
GetWindowTextW.USER32(00000000,?,00000100), ref: 00F2C20E
MessageBeep.USER32(00000000), ref: 00F2C226
KillTimer.USER32(?,0000040A), ref: 00F2C242
EndDialog.USER32(?,00000001), ref: 00F2C25C

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 16c20c5bcd9057950e95b6fd206f53e52e04a13a6cabff10c790e3e6c62e8a63
Instruction ID: 9148bd8207d60d0e18c2a1ad56f5fc1b624a5f4f7a312f6b4cd82280bd23bb17
Opcode Fuzzy Hash: 16c20c5bcd9057950e95b6fd206f53e52e04a13a6cabff10c790e3e6c62e8a63
Instruction Fuzzy Hash: CB018B30904718D7EB206B64FD4EF9677B8FF00706F0006A9F682A14E1DBF46958AB91

Function 00ED13B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00ED13BF
StrokeAndFillPath.GDI32(?,?,00F0B888,00000000,?), ref: 00ED13DB
SelectObject.GDI32(?,00000000), ref: 00ED13EE
DeleteObject.GDI32 ref: 00ED1401
StrokePath.GDI32(?), ref: 00ED141C

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: fc552860424221b2bb9ba683bc34cbf2ae4547a46dfc8eb9c63d0bd7b2c61c5b
Instruction ID: 429c4c674904d8b2822f29dffadb70eecda662df95555790cb8809e6b5ea1da4
Opcode Fuzzy Hash: fc552860424221b2bb9ba683bc34cbf2ae4547a46dfc8eb9c63d0bd7b2c61c5b
Instruction Fuzzy Hash: 47F0E730405B0CEBDB125F26EC4C7583FA4EB0172AF0892A6E529991F1C731899AEF50

Function 00F3C397 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00F3C432
CoCreateInstance.OLE32(00F62D6C,00000000,00000001,00F62BDC,?), ref: 00F3C44A

Part of subcall function 00ED7DE1: _memmove.LIBCMT ref: 00ED7E22

CoUninitialize.OLE32 ref: 00F3C6B7

Strings

.lnk, xrefs: 00F3C3C6, 00F3C3EE, 00F3C3F8

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 3b0c25a0fa0e528823c5e39f1fd21e5f661f5020ba13052bddf2f2b78dc30a98
Instruction ID: a304b17215e65cc66e935acf2a52514d58b8876022353c4150569a07dd36b25c
Opcode Fuzzy Hash: 3b0c25a0fa0e528823c5e39f1fd21e5f661f5020ba13052bddf2f2b78dc30a98
Instruction Fuzzy Hash: 0AA13A71104205AFD700EF54CC91EAFB7E8EF95354F00491DF595AB2A2EB71EA0ACB62

Function 00EE2CFB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00EF0DB6: std::exception::exception.LIBCMT ref: 00EF0DEC
Part of subcall function 00EF0DB6: __CxxThrowException@8.LIBCMT ref: 00EF0E01

Part of subcall function 00ED7DE1: _memmove.LIBCMT ref: 00ED7E22

Part of subcall function 00ED7A51: _memmove.LIBCMT ref: 00ED7AAB

__swprintf.LIBCMT ref: 00EE2ECD

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00EE2D66

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 4f39dfd3ee45ff17ff33575ae15bdf1b9216982f104dab480f4f12c7be3e263e
Instruction ID: 5e95371f3e4e559215e746b16c5714ddb8154f8b0b6027ad6ee7074a358f9e7f
Opcode Fuzzy Hash: 4f39dfd3ee45ff17ff33575ae15bdf1b9216982f104dab480f4f12c7be3e263e
Instruction Fuzzy Hash: 72918C725082559FC714EF24C895CAEB7E8EF85310F00691EF595EB2A2EB30ED45CB52

Function 00F3B93B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00ED4743,?,?,00ED37AE,?), ref: 00ED4770

CoInitialize.OLE32(00000000), ref: 00F3B9BB
CoCreateInstance.OLE32(00F62D6C,00000000,00000001,00F62BDC,?), ref: 00F3B9D4
CoUninitialize.OLE32 ref: 00F3B9F1

Part of subcall function 00ED9837: __itow.LIBCMT ref: 00ED9862
Part of subcall function 00ED9837: __swprintf.LIBCMT ref: 00ED98AC

Strings

.lnk, xrefs: 00F3B99D, 00F3B9AB

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 478a11413312538f0fafed7c4c37c24fc7197d0e301e206a8a586460c78cba4d
Instruction ID: 8bef61089999538da7f82e42e4d9ac55957cb85a69b2129c9d3831c376926429
Opcode Fuzzy Hash: 478a11413312538f0fafed7c4c37c24fc7197d0e301e206a8a586460c78cba4d
Instruction Fuzzy Hash: 2AA18A75A043059FCB04DF14C894D2ABBE5FF89324F048989F9999B3A2CB31EC46DB91

Function 00EF501D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00EF50AD

Part of subcall function 00F000F0: __87except.LIBCMT ref: 00F0012B

Strings

pow, xrefs: 00EF5085, 00EF50A2

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: a7502f03be534e5884a10857306f7cc4f0afd8a0a8ecb0b959e19940fc954a49
Instruction ID: 7d75c5fd86fe2d4a2542838db69f5e2d61f14f16ce3f586646a23a3c03c2d0d8
Opcode Fuzzy Hash: a7502f03be534e5884a10857306f7cc4f0afd8a0a8ecb0b959e19940fc954a49
Instruction Fuzzy Hash: 6351AA32E0DA0AC6DB117724CC0137E3BD49B60314F208D99E6D5962E9EF388DC4BB86

Function 00F18584 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 148COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F1862B
_memmove.LIBCMT ref: 00F18685

Strings

_, xrefs: 00F186FF, 00F1DFDC, 00F1DFF8
3c, xrefs: 00F1860C

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: _memmove
String ID: 3c$_
API String ID: 4104443479-4099079164
Opcode ID: 13749348f3b1f02bb50c20d8f82ad8e31d923af4cf780b541a7935a1ea1d678c
Instruction ID: ef241fee581034b166d2a6780ca4b0859ae6f30b47f7d6d7bc84d1ef061b224b
Opcode Fuzzy Hash: 13749348f3b1f02bb50c20d8f82ad8e31d923af4cf780b541a7935a1ea1d678c
Instruction Fuzzy Hash: 7F514DB0D00609DFCB24CF68C984AEEB7B1FF44354F148529E85AE7250EB31A996DB51

Function 00F297F5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F314BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00F29296,?,?,00000034,00000800,?,00000034), ref: 00F314E6

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00F2983F

Part of subcall function 00F31487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00F292C5,?,?,00000800,?,00001073,00000000,?,?), ref: 00F314B1

Part of subcall function 00F313DE: GetWindowThreadProcessId.USER32(?,?), ref: 00F31409
Part of subcall function 00F313DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00F2925A,00000034,?,?,00001004,00000000,00000000), ref: 00F31419
Part of subcall function 00F313DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00F2925A,00000034,?,?,00001004,00000000,00000000), ref: 00F3142F

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00F298AC
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00F298F9

Strings

@, xrefs: 00F29911

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 8d1b165bc5b1f9168588a76c9084715056720429f2c98dbe694a5d34c15ec766
Instruction ID: f6fa74e16f4915e6b43700b3b474cf0b5455e9d100a845eb0a2629da1d1f5821
Opcode Fuzzy Hash: 8d1b165bc5b1f9168588a76c9084715056720429f2c98dbe694a5d34c15ec766
Instruction Fuzzy Hash: D0413E7690121CAFDB10DFA4CD81ADEBBB8EB09310F004199FA45B7191DA756E89DBA0

Function 00F57946 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00F5F910,00000000,?,?,?,?), ref: 00F579DF
GetWindowLongW.USER32 ref: 00F579FC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00F57A0C

Strings

SysTreeView32, xrefs: 00F579B1

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 618c38aa476090a0b946eba8db52f63d3acfd338c484187ca76761bf4dac11f0
Instruction ID: 11077aeb9a678892847107b9cfc980f74f99fccb754f7a62e976ad90dcc4e9f7
Opcode Fuzzy Hash: 618c38aa476090a0b946eba8db52f63d3acfd338c484187ca76761bf4dac11f0
Instruction Fuzzy Hash: 9C31103160420AABDB119E38DC01BEA37A9EF05331F204725FA75A32E0D730ED55AB60

Function 00F573D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00F57461
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00F57475
SendMessageW.USER32(?,00001002,00000000,?), ref: 00F57499

Strings

SysMonthCal32, xrefs: 00F5742C

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 5305c300da864a64a31eac63bd92267edce4d106014f1861ed61bf6d7dd613ff
Instruction ID: 146ddddc814fe771ab78963ddf39155f028e3048d285860f5cebe5fb2e50ea39
Opcode Fuzzy Hash: 5305c300da864a64a31eac63bd92267edce4d106014f1861ed61bf6d7dd613ff
Instruction Fuzzy Hash: 1F219F32500218ABDF11DFA4DC46FEA3BAAEB48725F110214FF156B190DAB5AC55EBA0

Function 00F57B93 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00F57C4A
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00F57C58
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00F57C5F

Strings

msctls_updown32, xrefs: 00F57BC4

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: e42d26403d21f6760e4e30172deee4b4c714e5f28c042bf67dfcd20f6f7c29ff
Instruction ID: 3058382104b52ea0168729197e4818c5f321c9ea50f3aa7ee82ade022cf4a0c0
Opcode Fuzzy Hash: e42d26403d21f6760e4e30172deee4b4c714e5f28c042bf67dfcd20f6f7c29ff
Instruction Fuzzy Hash: D9217FB1604208AFDB11EF28DCC5DA737ECEB4A365B140059FA019B3A1CB31EC05AB60

Function 00F56CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00F56D3B
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00F56D4B
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00F56D70

Strings

Listbox, xrefs: 00F56D08

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: f9c61e924b63cf6bd5cef3d9c96d2888120b72d78890ed020621b8879b305f2f
Instruction ID: 7bb720b5088d9e4e0a4dcbd6c8d54d054d8c17267108823f2c76da1df1b51e44
Opcode Fuzzy Hash: f9c61e924b63cf6bd5cef3d9c96d2888120b72d78890ed020621b8879b305f2f
Instruction Fuzzy Hash: BD21D432A00118BFDF118F54CC45FBB3BBAEF89762F418124FE559B1A0CA719C55ABA0

Function 00F5770E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00F57772
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00F57787
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00F57794

Strings

msctls_trackbar32, xrefs: 00F57749

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 9c07a67ad7d189f2110ac7f20e6ccb62c236e42e7c018859a332b46990517f97
Instruction ID: 094cfd80d9791684f46baa7b8b2c51d9b51e1371423f0a163e6d6df2e15fda48
Opcode Fuzzy Hash: 9c07a67ad7d189f2110ac7f20e6ccb62c236e42e7c018859a332b46990517f97
Instruction Fuzzy Hash: DD112772604308BAEF106F60EC05FEB37A9EF88B65F010118FB41A2090D671E811EB10

Function 00ED4C36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00ED4B83,?), ref: 00ED4C44
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00ED4C56

Strings

Wow64RevertWow64FsRedirection, xrefs: 00ED4C50
kernel32.dll, xrefs: 00ED4C3F

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 9770454cb2364071675478accf95779d7ef423153edc57bbb1262dc387b5587c
Instruction ID: c9401b1128928d555ccec6b2ff807f2f1ec9c716a9d836eff1902c29a751dd41
Opcode Fuzzy Hash: 9770454cb2364071675478accf95779d7ef423153edc57bbb1262dc387b5587c
Instruction Fuzzy Hash: 2BD0C270510B13CFD7205F31C908606B3D4AF0134AB10887A9591D66A0E670C484D651

Function 00ED4C03 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00ED4BD0,?,00ED4DEF,?,00F952F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00ED4C11
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00ED4C23

Strings

Wow64DisableWow64FsRedirection, xrefs: 00ED4C1D
kernel32.dll, xrefs: 00ED4C0C

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 54afe9bb849d67afd1dc57a12b2f5bab53dfca24ae77815d84443d1b50ade09b
Instruction ID: 086d39ad745dfda567acfd2bc8be1e9d7f40eb72442bcad50c4dad8be3a44dec
Opcode Fuzzy Hash: 54afe9bb849d67afd1dc57a12b2f5bab53dfca24ae77815d84443d1b50ade09b
Instruction Fuzzy Hash: F7D0C270510B13CFD7206F70CA48606B6D5EF0934AB008C7A9481D6290E7B0C485DB51

Function 00F50DE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00F51039), ref: 00F50DF5
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00F50E07

Strings

advapi32.dll, xrefs: 00F50DF0
RegDeleteKeyExW, xrefs: 00F50E01

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 9a4d5839318afc0c3190b30e93bd51a41053de0edfd22565b7f86bae47b9f55f
Instruction ID: c6657912f895d1f8bc7c360074788088d373dcf2ce604c00b2a643df6ca21912
Opcode Fuzzy Hash: 9a4d5839318afc0c3190b30e93bd51a41053de0edfd22565b7f86bae47b9f55f
Instruction Fuzzy Hash: BDD0C730800B26CFC321AF70C80A28272E4AF00363F288C3E9A82C6150EBB0D894EB40

Function 00F490E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00F48CF4,?,00F5F910), ref: 00F490EE
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00F49100

Strings

GetModuleHandleExW, xrefs: 00F490FA
kernel32.dll, xrefs: 00F490E9

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 13d05a7398fef1fa3a1b6d165ed239fdd1adb95f0afe6b03cd833161c896c56e
Instruction ID: 638cc09cb21c84da2cb65e95cba8893914ac739dbb4acda27073d671667e9467
Opcode Fuzzy Hash: 13d05a7398fef1fa3a1b6d165ed239fdd1adb95f0afe6b03cd833161c896c56e
Instruction Fuzzy Hash: BED01234A14713DFD7209F31D81854776D4AF45356B11887A9A86D6550E6B0C484E791

Function 00F11714 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00F11718
__swprintf.LIBCMT ref: 00F11749

Strings

WIN_XPe, xrefs: 00F11788
%.3d, xrefs: 00F11723

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 6ef304e81ef7c90450027b87f6f35c7a84a001c6c0832daa5a03dcc449e64d3c
Instruction ID: ac63de0a80bdd7f761d3cbbde7190d45a2026c464d47ffb2fad2548f7a12bfd4
Opcode Fuzzy Hash: 6ef304e81ef7c90450027b87f6f35c7a84a001c6c0832daa5a03dcc449e64d3c
Instruction Fuzzy Hash: F1D0127280910DEACB009A90988C9F9777CB718301F141452FB02E2280E221C7D9F621

Function 00F2717D Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab0d728a7cd06ea076bd1de4820d79fc2a1e704d8d22dc2302378cb48afd58a9
Instruction ID: 05d508fa2e5763d17fb730efaed75229ea46da4a584a0a2911fd073e21aeb829
Opcode Fuzzy Hash: ab0d728a7cd06ea076bd1de4820d79fc2a1e704d8d22dc2302378cb48afd58a9
Instruction Fuzzy Hash: 10C18075A04326EFCB14EF94D884EAEBBB5FF48314B148598E805EB251D730ED81EB90

Function 00F4E02A Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00F4E0BE
CharLowerBuffW.USER32(?,?), ref: 00F4E101

Part of subcall function 00F4D7A5: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00F4D7C5

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00F4E301
_memmove.LIBCMT ref: 00F4E314

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: cf5a1920bb684b7c870dceaaab9919791d6bf298a2abf7d7106cb5a07a77d713
Instruction ID: 1fa97134e6011d610212ad421fa68a31cfdb64fba410ebd7619f415b11c8ec4c
Opcode Fuzzy Hash: cf5a1920bb684b7c870dceaaab9919791d6bf298a2abf7d7106cb5a07a77d713
Instruction Fuzzy Hash: 62C15B71A043019FC714DF28C480A6ABBE4FF89724F14896EF9999B352D771E946CB81

Function 00F48093 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00F480C3
CoUninitialize.OLE32 ref: 00F480CE

Part of subcall function 00F2D56C: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00F2D5D4

VariantInit.OLEAUT32(?), ref: 00F480D9
VariantClear.OLEAUT32(?), ref: 00F483AA

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: c99f47cd4906b715bf8599925230502361f749eeaf71ce9665adf209718aa622
Instruction ID: 2e69e5c77cb1c44881f962701125ce813212d218045cea44aadb23f7d88a3954
Opcode Fuzzy Hash: c99f47cd4906b715bf8599925230502361f749eeaf71ce9665adf209718aa622
Instruction Fuzzy Hash: 02A136756047019FDB04DF14C881A2EBBE4FF89764F144449F996AB3A2CB74ED06EB82

Function 00F27530 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00F62C7C,?), ref: 00F276EA
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00F62C7C,?), ref: 00F27702
CLSIDFromProgID.OLE32(?,?,00000000,00F5FB80,000000FF,?,00000000,00000800,00000000,?,00F62C7C,?), ref: 00F27727
_memcmp.LIBCMT ref: 00F27748

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: c3cb877b5e93c112ad9c813bd10b89d2306b8f8de70d4f67cddcdcf2dfcb2f51
Instruction ID: a617d2a7aecc20236d4863ffdf7617926955a7ecfff20635f011a6287a5bbc32
Opcode Fuzzy Hash: c3cb877b5e93c112ad9c813bd10b89d2306b8f8de70d4f67cddcdcf2dfcb2f51
Instruction Fuzzy Hash: C4813D71A00219EFCB04DFA4C984EEEB7B9FF89315F204198F505AB250DB71AE06DB60

Function 00F2687D Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F2688E
SysAllocString.OLEAUT32(00000000), ref: 00F26937
VariantCopy.OLEAUT32 ref: 00F26966
VariantClear.OLEAUT32(?), ref: 00F2698D

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 6fb977e56acd2afa5a04a549d12a0809e24b94d70622e763488cebbe49c8f367
Instruction ID: b5b888c14339d2f22aa7fe9e9872e22124e1074507bd84854007785da373d4d5
Opcode Fuzzy Hash: 6fb977e56acd2afa5a04a549d12a0809e24b94d70622e763488cebbe49c8f367
Instruction Fuzzy Hash: 4751C675B003159ACB24EF65E8A173AB3E5EF45310F20D81FE586EB291DB38DC81AB01

Function 00F597F4 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(0179E970,?), ref: 00F59863
ScreenToClient.USER32(00000002,00000002), ref: 00F59896
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00F59903

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 1f2131f64f1bb7eb985f1d6ba551d793c80bded67f42bece7cb9762a1e9ff215
Instruction ID: 4199bef3dc17712b1a5cc3c30164a66e968e656575c348fd4954690a2f57e32b
Opcode Fuzzy Hash: 1f2131f64f1bb7eb985f1d6ba551d793c80bded67f42bece7cb9762a1e9ff215
Instruction Fuzzy Hash: 9A514D34A04208EFCF14CF64C884AAE7BB5FF45362F548159FA659B2A0D770AD85EB90

Function 00F29A80 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00F29AD2
__itow.LIBCMT ref: 00F29B03

Part of subcall function 00F29D53: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00F29DBE

SendMessageW.USER32(?,0000110A,00000001,?), ref: 00F29B6C
__itow.LIBCMT ref: 00F29BC3

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: e3b057c2b9a2fb5080336cf3ecfd9e7ee6e574501c8399d5d0fc686824469765
Instruction ID: 84e37fcd07c17cd3c7d4ff0b63271c3f35892a812e85c7f8a3c50b6f584e8992
Opcode Fuzzy Hash: e3b057c2b9a2fb5080336cf3ecfd9e7ee6e574501c8399d5d0fc686824469765
Instruction Fuzzy Hash: 5641B171A04318ABDF11EF54E845BFE7BF9EF88720F00006AF945A3291DBB09A45DB61

Function 00F469AA Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00F469D1
WSAGetLastError.WSOCK32(00000000), ref: 00F469E1

Part of subcall function 00ED9837: __itow.LIBCMT ref: 00ED9862
Part of subcall function 00ED9837: __swprintf.LIBCMT ref: 00ED98AC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00F46A45
WSAGetLastError.WSOCK32(00000000), ref: 00F46A51

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: c4644bd7c5a67fb48824db047fdebf8171aeb31aa9cdf902fe4feec9feaa31da
Instruction ID: 113666529a76a4c3e1ea51b5084fc30ebc37c6d757963ec61ecb1eeaaa59a2d8
Opcode Fuzzy Hash: c4644bd7c5a67fb48824db047fdebf8171aeb31aa9cdf902fe4feec9feaa31da
Instruction Fuzzy Hash: FE41BF35700200AFEB64AF28DC86F2A77E8DB05B14F048059FA59EB3C3DA749D019792

Function 00F4641A Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,00F5F910), ref: 00F464A7
_strlen.LIBCMT ref: 00F464D9

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 1cf264c6d32968b9acf13ee5178d65b9653350c514f0768c3e40062104ad63cb
Instruction ID: 115952ae3fa3f7f08da43397c0fdb9859804d102a43e143961bbc50f368548e7
Opcode Fuzzy Hash: 1cf264c6d32968b9acf13ee5178d65b9653350c514f0768c3e40062104ad63cb
Instruction Fuzzy Hash: 57419175900208ABCB14EBA8EC96FBEBBE8EF05320F148156FD15A7296DB30AD05D751

Function 00F3B7F4 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00F3B89E
GetLastError.KERNEL32(?,00000000), ref: 00F3B8C4
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00F3B8E9
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00F3B915

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 0dfddd26ba2080d9382dd1fb977d34ae5413f6ebd7b1870d5c50b58b5d16cb39
Instruction ID: bb9c1804dfe70b59a98c45551a07b23872c47dab6ea93cf984aad01b6f56fbce
Opcode Fuzzy Hash: 0dfddd26ba2080d9382dd1fb977d34ae5413f6ebd7b1870d5c50b58b5d16cb39
Instruction Fuzzy Hash: FC412D39A00654DFCB14EF15C855A5DBBE1EF49720F058099ED4AAB362CB34FD02EB91

Function 00F58851 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00F588DE

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: df2f4602445ef405dbf79786d414d4a9a4be5db1c385479ab130a9d95014323f
Instruction ID: 7e46a8f8ace38ea940f9a074257ee4d317f190977268d1d4eae7540321eccc80
Opcode Fuzzy Hash: df2f4602445ef405dbf79786d414d4a9a4be5db1c385479ab130a9d95014323f
Instruction Fuzzy Hash: AE31C334A40108EEEB219B58CC45BB97BA5EB057A3F944112FF11F62A1CE31D94ABB53

Function 00F5AB37 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00F5AB60
GetWindowRect.USER32(?,?), ref: 00F5ABD6
PtInRect.USER32(?,?,00F5C014), ref: 00F5ABE6
MessageBeep.USER32(00000000), ref: 00F5AC57

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 1daca0275b788bcf32442ffa1af9ff75f24a217ba4e04f737faead1fcf941797
Instruction ID: b1dcdfc60822197e9bab03916520796e5f4430ffd0a94982afb75810385e44a1
Opcode Fuzzy Hash: 1daca0275b788bcf32442ffa1af9ff75f24a217ba4e04f737faead1fcf941797
Instruction Fuzzy Hash: ED41B330A00208DFCB12DF58C888B597BF5FF49712F1882A5EE559B364D730E859EB92

Function 00F30AD6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00F30B27
SetKeyboardState.USER32(00000080,?,00000001), ref: 00F30B43
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00F30BA9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00F30BFB

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 1751e7025c63809268fab338b6c3aeed4e2d4673d994de639b64a0aa84680376
Instruction ID: 8ecb7cf50f52f0e6d483cc7ec8839d88cbfe25dd6fcd0478c39fa4a2ff026952
Opcode Fuzzy Hash: 1751e7025c63809268fab338b6c3aeed4e2d4673d994de639b64a0aa84680376
Instruction Fuzzy Hash: BA314B70D40318AEFB308B298C15BFAFBA9AB85335F08436BF581D21D1CB748944B755

Function 00F30C11 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00F30C66
SetKeyboardState.USER32(00000080,?,00008000), ref: 00F30C82
PostMessageW.USER32(00000000,00000101,00000000), ref: 00F30CE1
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00F30D33

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 440cbbb193ac4aede1b694122ea938306ace59fc1c81ad6c07669cd5a548e03e
Instruction ID: 95e967f030b0582a5a357e2fbafd5752e1214ce7adae60fb4fd8d07d64627e92
Opcode Fuzzy Hash: 440cbbb193ac4aede1b694122ea938306ace59fc1c81ad6c07669cd5a548e03e
Instruction Fuzzy Hash: 3F313730E403186EFF308A648C247FEBBA5AB45331F08536BE481621D1DB799945F7A1

Function 00F061C5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00F061FB
__isleadbyte_l.LIBCMT ref: 00F06229
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00F06257
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00F0628D

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 424552d61c6ec4e294cd9a5fb72ecc7c32918dfe7eabc2864c1f4338e4bfb37a
Instruction ID: 30766830516139f655a154318dca1dbc657b359ac4b8fd175960d4cb57036f2d
Opcode Fuzzy Hash: 424552d61c6ec4e294cd9a5fb72ecc7c32918dfe7eabc2864c1f4338e4bfb37a
Instruction Fuzzy Hash: 8031AE31A0424AAFDF218F65CC44BBA7BA9BF41720F154029F864D71E1D731D960FB90

Function 00F54EEE Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00F54F02

Part of subcall function 00F33641: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00F3365B
Part of subcall function 00F33641: GetCurrentThreadId.KERNEL32 ref: 00F33662
Part of subcall function 00F33641: AttachThreadInput.USER32(00000000,?,00F35005), ref: 00F33669

GetCaretPos.USER32(?), ref: 00F54F13
ClientToScreen.USER32(00000000,?), ref: 00F54F4E
GetForegroundWindow.USER32 ref: 00F54F54

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 083215c2560347936aa670782d0df936708c10fb42eb60e3c94fd9fc6088f22c
Instruction ID: a6b091762e29133e1cdffc7d7ced1c86a9d0dde80410173ecbe3eb87ad04f0ab
Opcode Fuzzy Hash: 083215c2560347936aa670782d0df936708c10fb42eb60e3c94fd9fc6088f22c
Instruction Fuzzy Hash: 0A312D71D00208AFCB00EFA5CC859EFB7F9EF88304F10406AE915E7241EA75AE459BA0

Function 00F5C498 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED2612: GetWindowLongW.USER32(?,000000EB), ref: 00ED2623

GetCursorPos.USER32(?), ref: 00F5C4D2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00F0B9AB,?,?,?,?,?), ref: 00F5C4E7
GetCursorPos.USER32(?), ref: 00F5C534
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00F0B9AB,?,?,?), ref: 00F5C56E

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 4773939931d5e88d84cca0cb36afcb126af769abd1358d55f2abe983e646fae4
Instruction ID: 6a55275024a669766bf422d477179a3cb7638776713b5552532fea0fcd559e34
Opcode Fuzzy Hash: 4773939931d5e88d84cca0cb36afcb126af769abd1358d55f2abe983e646fae4
Instruction Fuzzy Hash: E831A535500118AFCF16CF98C858EEA7BF5EB09721F484069FE068B261D731AD58EBE4

Function 00F28656 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F2810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00F28121
Part of subcall function 00F2810A: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00F2812B
Part of subcall function 00F2810A: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F2813A
Part of subcall function 00F2810A: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00F28141
Part of subcall function 00F2810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F28157

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00F286A3
_memcmp.LIBCMT ref: 00F286C6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F286FC
HeapFree.KERNEL32(00000000), ref: 00F28703

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: d813bd575847d6847609449f20fcfd422544ba9d54e6c3db394700b5d86355cf
Instruction ID: 74c3b8e0aa7edcaa104b6f38d2d66afeefdc841668abbc936cbbaa3fa3daf34a
Opcode Fuzzy Hash: d813bd575847d6847609449f20fcfd422544ba9d54e6c3db394700b5d86355cf
Instruction Fuzzy Hash: 7E21C131E0221CEFDB10DFA4D948BEEBBB8EF50355F144099E405A7241DB30AE06EB50

Function 00EF098C Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00EF09AE

Part of subcall function 00ED5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00F37896,?,?,00000000), ref: 00ED5A2C
Part of subcall function 00ED5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00F37896,?,?,00000000,?,?), ref: 00ED5A50

_fprintf.LIBCMT ref: 00EF09E5
OutputDebugStringW.KERNEL32(?), ref: 00F25DBB

Part of subcall function 00EF4AAA: _flsall.LIBCMT ref: 00EF4AC3

__setmode.LIBCMT ref: 00EF0A1A

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 783c4d826c75a1beeb0c3cd9fc7902b4e8067e8e08f4c7823b9797343b301b3f
Instruction ID: 4e0377e5c8c605270714fa6d1df78b26c0dd6edb2bcf5ac0d7d5c5b3a6c172bf
Opcode Fuzzy Hash: 783c4d826c75a1beeb0c3cd9fc7902b4e8067e8e08f4c7823b9797343b301b3f
Instruction Fuzzy Hash: F91102B290460C6BDB08B3B4AC469BEB7E9DF81360F241056F304B72C3EE304846A7A5

Function 00F41767 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00F417A3

Part of subcall function 00F4182D: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00F4184C
Part of subcall function 00F4182D: InternetCloseHandle.WININET(00000000), ref: 00F418E9

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: b0a4e5b6257c9884dae7f9884ddde35a50aad6ce46d488515d34c0b58b0645cc
Instruction ID: 7494d18bdd257d7f90b038cc42e5cc7d3f985bce1d07193f92b65d98b8520b63
Opcode Fuzzy Hash: b0a4e5b6257c9884dae7f9884ddde35a50aad6ce46d488515d34c0b58b0645cc
Instruction Fuzzy Hash: 9921AE36600705BFEB129F60DC01FBABFA9FF48711F10402AFE5196651DB759851BBA0

Function 00F33A2A Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00F5FAC0), ref: 00F33A64
GetLastError.KERNEL32 ref: 00F33A73
CreateDirectoryW.KERNEL32(?,00000000), ref: 00F33A82
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00F5FAC0), ref: 00F33ADF

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 0c907a2012121d652007119c86ccd89a460e801aceb68300cf0d11cf680d0a4b
Instruction ID: eda9f7841fb3f17d450b62311325cdcd0e59730d0f7e6e0e62f054407f24beb4
Opcode Fuzzy Hash: 0c907a2012121d652007119c86ccd89a460e801aceb68300cf0d11cf680d0a4b
Instruction Fuzzy Hash: 9921B1755083058F8700EF28C88186ABBE8EF55374F104A6AF4D9C72A1E735DA0AEB42

Function 00F2DCBE Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F2F0BC: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00F2DCD3,?,?,?,00F2EAC6,00000000,000000EF,00000119,?,?), ref: 00F2F0CB
Part of subcall function 00F2F0BC: lstrcpyW.KERNEL32(00000000,?,?,00F2DCD3,?,?,?,00F2EAC6,00000000,000000EF,00000119,?,?,00000000), ref: 00F2F0F1
Part of subcall function 00F2F0BC: lstrcmpiW.KERNEL32(00000000,?,00F2DCD3,?,?,?,00F2EAC6,00000000,000000EF,00000119,?,?), ref: 00F2F122

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00F2EAC6,00000000,000000EF,00000119,?,?,00000000), ref: 00F2DCEC
lstrcpyW.KERNEL32(00000000,?,?,00F2EAC6,00000000,000000EF,00000119,?,?,00000000), ref: 00F2DD12
lstrcmpiW.KERNEL32(00000002,cdecl,?,00F2EAC6,00000000,000000EF,00000119,?,?,00000000), ref: 00F2DD46

Strings

cdecl, xrefs: 00F2DD3D

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 573bb4f11a2ca91f80e887eae4f792f732e6a48a5c93d0642e8ec99b4df3fd4c
Instruction ID: 1cc1b8b764eae9771428ca2d71ccf6a000411098f72ad27ef6edea01968c6393
Opcode Fuzzy Hash: 573bb4f11a2ca91f80e887eae4f792f732e6a48a5c93d0642e8ec99b4df3fd4c
Instruction Fuzzy Hash: A811D33A600319EBDB25AF34EC45D7A77A8FF45310B80506AF906CB2A1EB71D841E7D1

Function 00F050E2 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F05101

Part of subcall function 00EF571C: __FF_MSGBANNER.LIBCMT ref: 00EF5733
Part of subcall function 00EF571C: __NMSG_WRITE.LIBCMT ref: 00EF573A
Part of subcall function 00EF571C: RtlAllocateHeap.NTDLL(01780000,00000000,00000001,00000000,?,?,?,00EF0DD3,?), ref: 00EF575F

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: be8a98eb068c212475a0b95209762926b1d10097a807821da4445f3ff9fca891
Instruction ID: 9852fb06b7bd36bbdb6dc09562e783204d71ca9b2c205a30d1d3afeb37861324
Opcode Fuzzy Hash: be8a98eb068c212475a0b95209762926b1d10097a807821da4445f3ff9fca891
Instruction Fuzzy Hash: 19110672A04A1DAECF312F70AC0577F37D89F10771B10192AFB04AA1E0DEB08840BB90

Function 00ED44A0 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00ED44CF

Part of subcall function 00ED407C: _memset.LIBCMT ref: 00ED40FC
Part of subcall function 00ED407C: _wcscpy.LIBCMT ref: 00ED4150
Part of subcall function 00ED407C: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00ED4160

KillTimer.USER32(?,00000001,?,?), ref: 00ED4524
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00ED4533
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00F0D4B9

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 2f4b4cf02cc61711486b0ac9cde6a28d981fc50fb7553cca0d3c6f0f705b2bc6
Instruction ID: 7eae647987063b0f1865651e8c0d6535e2d2c53e130c428598543b258ac7053f
Opcode Fuzzy Hash: 2f4b4cf02cc61711486b0ac9cde6a28d981fc50fb7553cca0d3c6f0f705b2bc6
Instruction Fuzzy Hash: BA21F5B4904788AFE732CB649855BE6BBECDB15318F04109EE78E662C1C3742A85EB41

Function 00F46369 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00F37896,?,?,00000000), ref: 00ED5A2C
Part of subcall function 00ED5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00F37896,?,?,00000000,?,?), ref: 00ED5A50

gethostbyname.WSOCK32(?), ref: 00F46399
WSAGetLastError.WSOCK32(00000000), ref: 00F463A4
_memmove.LIBCMT ref: 00F463D1
inet_ntoa.WSOCK32(?), ref: 00F463DC

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: e1e09dc45278b314a3af13dbbced803fb973401e658f00156688ba24196d7776
Instruction ID: 1540d25b291dc7f27ca3bd9ba37f7ebbe848e8c92f707df7c67ee9cdad81b7c8
Opcode Fuzzy Hash: e1e09dc45278b314a3af13dbbced803fb973401e658f00156688ba24196d7776
Instruction Fuzzy Hash: E1115136900109AFCB04FBA4DD46CAE7BB8EF04321B144066F905B7262DB309E09EB61

Function 00F28B41 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00F28B61
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00F28B73
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00F28B89
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00F28BA4

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 67f34aad597aca3a57e942cba9dba414fa2b1e3a3620d3f54a51f480af08cbfc
Instruction ID: 693ce09fde8b96042534e476b005317d893f5fc4e2d1d4670ff627f6af94e7b4
Opcode Fuzzy Hash: 67f34aad597aca3a57e942cba9dba414fa2b1e3a3620d3f54a51f480af08cbfc
Instruction Fuzzy Hash: 30111C79901218FFDB11DF95CC85F9DBBB4FB48750F204095EA00B7250DA716E11EB94

Function 00ED1290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00ED2612: GetWindowLongW.USER32(?,000000EB), ref: 00ED2623

DefDlgProcW.USER32(?,00000020,?), ref: 00ED12D8
GetClientRect.USER32(?,?), ref: 00F0B5FB
GetCursorPos.USER32(?), ref: 00F0B605
ScreenToClient.USER32(?,?), ref: 00F0B610

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 21ebdaab798bb2fa40d07f74adad49b6c7d29e1205cc271a46255757307c3a24
Instruction ID: 11b9a63324127a8c4f51b3547d72df6f4ef94b6285b519a437a87c4c60a4b3a7
Opcode Fuzzy Hash: 21ebdaab798bb2fa40d07f74adad49b6c7d29e1205cc271a46255757307c3a24
Instruction Fuzzy Hash: A8112835A0011DBBCB10EF98D8859EE77B9EB05301F500496FA01E7251D731AA56ABA5

Function 00F31142 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00F2FCED,?,00F30D40,?,00008000), ref: 00F3115F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00F2FCED,?,00F30D40,?,00008000), ref: 00F31184
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00F2FCED,?,00F30D40,?,00008000), ref: 00F3118E
Sleep.KERNEL32(?,?,?,?,?,?,?,00F2FCED,?,00F30D40,?,00008000), ref: 00F311C1

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: c1a5568083fa8c4e7a5f43dd93a7de6481ee509185ec0333dad38f5c041c4602
Instruction ID: ac6363a183297a54c2d50447a6a17729b938eeba842631785a0c1cbe515a5006
Opcode Fuzzy Hash: c1a5568083fa8c4e7a5f43dd93a7de6481ee509185ec0333dad38f5c041c4602
Instruction Fuzzy Hash: 50113C32D01A1DD7CF00AFA5D848AEEBBBCFF09721F504095EA41B2241CB709554EBA5

Function 00F2D831 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 00F2D84D
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00F2D864
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00F2D879
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00F2D897

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 2d81fa611a61c2afa1871c5eccca436eff7e43232aa85b7bfbc0f9070b3d7e7e
Instruction ID: d03e455b9e99104eb341331751dcd441074c80a2e3a925dfc8c3efb6c834cb7c
Opcode Fuzzy Hash: 2d81fa611a61c2afa1871c5eccca436eff7e43232aa85b7bfbc0f9070b3d7e7e
Instruction Fuzzy Hash: 11116175606324DBE320CF50EC08FD3BBBCEB00B00F108569A656D6090D7B0E549EBA1

Function 00F06FB7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00F06FDB

Part of subcall function 00F076C2: __fltout2.LIBCMT ref: 00F076EB

__cftog_l.LIBCMT ref: 00F07001
__cftoe_l.LIBCMT ref: 00F07033

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 7a120ceccc5c8052d168e921847f7c84f5ada1ad5274fe17ea7dcf3c12f3ef68
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 10014E7284424EBBCF166E84CC01CED3F66BB18355F588595FA18580B1D336E9B1BB81

Function 00F5B2C5 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00F5B2E4
ScreenToClient.USER32(?,?), ref: 00F5B2FC
ScreenToClient.USER32(?,?), ref: 00F5B320
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00F5B33B

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 63dbb051b7f6f6b2a9de15785ba7b17bf59597a16261af1aafaa3362a5a0a245
Instruction ID: aea1afd0b41015d8d1fcc961126533186c04fa39b9a3a25f904d3d20f7494bfe
Opcode Fuzzy Hash: 63dbb051b7f6f6b2a9de15785ba7b17bf59597a16261af1aafaa3362a5a0a245
Instruction Fuzzy Hash: 681143B9D0060DEFDB41CFA9C8849EEBBB9FB08311F1081A6E914E3620D735AA559F50

Function 00F5B635 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F5B644
_memset.LIBCMT ref: 00F5B653
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00F96F20,00F96F64), ref: 00F5B682
CloseHandle.KERNEL32 ref: 00F5B694

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: ecb907454d00bf9e10b7c69207f35826a4fa94c83da855eaf3ef9f871ff0e5b2
Instruction ID: 59509cb3a7bb2025ff3fd255ae20bd007c4f31748dfb189aa41493973bf52d7e
Opcode Fuzzy Hash: ecb907454d00bf9e10b7c69207f35826a4fa94c83da855eaf3ef9f871ff0e5b2
Instruction Fuzzy Hash: D9F012B294030C7BF7102765BC06FBB7A9CEB09799F004065FB08E51A2E7765C10A7A8

Function 00F36BDA Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00F36BE6

Part of subcall function 00F376C4: _memset.LIBCMT ref: 00F376F9

_memmove.LIBCMT ref: 00F36C09
_memset.LIBCMT ref: 00F36C16
LeaveCriticalSection.KERNEL32(?), ref: 00F36C26

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 2d118a844192aa766d189fed574b4872b2a23fc25a8dcbdc098b322317f72509
Instruction ID: 2936b209e10d7c2b046aa52d4c55372cdd819d477c291882f3864c6036123cfa
Opcode Fuzzy Hash: 2d118a844192aa766d189fed574b4872b2a23fc25a8dcbdc098b322317f72509
Instruction Fuzzy Hash: FDF05E7A200204ABCF016F55DC85A8ABF6AEF45361F04C0A5FF096E227CB35E811DBB4

Function 00ED2218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00ED2231
SetTextColor.GDI32(?,000000FF), ref: 00ED223B
SetBkMode.GDI32(?,00000001), ref: 00ED2250
GetStockObject.GDI32(00000005), ref: 00ED2258
GetWindowDC.USER32(?,00000000), ref: 00F0BE83
GetPixel.GDI32(00000000,00000000,00000000), ref: 00F0BE90
GetPixel.GDI32(00000000,?,00000000), ref: 00F0BEA9
GetPixel.GDI32(00000000,00000000,?), ref: 00F0BEC2
GetPixel.GDI32(00000000,?,?), ref: 00F0BEE2
ReleaseDC.USER32(?,00000000), ref: 00F0BEED

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 26cd0e47627f4b17420251d0682d37d9bc8a88ea20a9089868cb60853692ec92
Instruction ID: 308e8d658dc158c70e1a8aa67e5debec6aac0c74183f8b9ed35c172987a37194
Opcode Fuzzy Hash: 26cd0e47627f4b17420251d0682d37d9bc8a88ea20a9089868cb60853692ec92
Instruction Fuzzy Hash: 9CE03932504648AADB215FA4EC0DBD83B10EB15337F0483A6FB69980E187714985EB12

Function 00F28712 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00F2871B
OpenThreadToken.ADVAPI32(00000000,?,?,?,00F282E6), ref: 00F28722
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00F282E6), ref: 00F2872F
OpenProcessToken.ADVAPI32(00000000,?,?,?,00F282E6), ref: 00F28736

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 03851334d0fdcfaaf6ebeea01b742ab1c0c44a8225d8361eeb382a6881472675
Instruction ID: 639555a36e87f7d330a0f18960ce862789fb5329964efce95567230bfaaa98ef
Opcode Fuzzy Hash: 03851334d0fdcfaaf6ebeea01b742ab1c0c44a8225d8361eeb382a6881472675
Instruction Fuzzy Hash: E5E08676A123259BD7605FB06D0CB573BBCEF607E3F144868B345CA0C0DA34844AE750

Function 00F2B2F3 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00F2B4BE

Strings

AutoIt3GUI, xrefs: 00F2B436
Container, xrefs: 00F2B43B

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 6976e0c1b4c758f399764504a1ca7eb63376a5c2aa3a257542271271f73cd5f6
Instruction ID: 3729d1491d6276d10304f7ba77581d75c0f9889071e54ba65fd9ca4aea2687f8
Opcode Fuzzy Hash: 6976e0c1b4c758f399764504a1ca7eb63376a5c2aa3a257542271271f73cd5f6
Instruction Fuzzy Hash: 0D916771600611AFDB14DF64D885B6ABBE9FF48710F24856DED0ACF2A2DB70E841DB50

Function 00F3AFAC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00EEFC86: _wcscpy.LIBCMT ref: 00EEFCA9

Part of subcall function 00ED9837: __itow.LIBCMT ref: 00ED9862
Part of subcall function 00ED9837: __swprintf.LIBCMT ref: 00ED98AC

__wcsnicmp.LIBCMT ref: 00F3B02D
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00F3B0F6

Strings

LPT, xrefs: 00F3B027

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 88857f8bcada2195c8ba264932695ff3cfcb324042bbf18697cd87a41129e5b7
Instruction ID: e12993cd890b8f578abb79a956b041e2bad07b8e4af3909ad82c2bf0436ea8cc
Opcode Fuzzy Hash: 88857f8bcada2195c8ba264932695ff3cfcb324042bbf18697cd87a41129e5b7
Instruction Fuzzy Hash: 84617576E00219AFCB18EF94C861EAEB7F4EF08720F15405AFA16AB351D770AE45DB50

Function 00EE2957 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00EE2968
GlobalMemoryStatusEx.KERNEL32(?), ref: 00EE2981

Strings

@, xrefs: 00EE2975

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: cca05cee1cc02c096858460729e95ee3a7ae6e44f544e60ec642de37de34ca9b
Instruction ID: 69df759636cb73ab499763e505d5a49703ffa5e2eb82217886d48ec4e07506d2
Opcode Fuzzy Hash: cca05cee1cc02c096858460729e95ee3a7ae6e44f544e60ec642de37de34ca9b
Instruction Fuzzy Hash: 3C5136714087489BD320AF10DC86BAFBBF8FB85344F41885EF2D8511A2DB319569DB67

Function 00F39734 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00ED4F0B: __fread_nolock.LIBCMT ref: 00ED4F29

_wcscmp.LIBCMT ref: 00F39824
_wcscmp.LIBCMT ref: 00F39837

Strings

FILE, xrefs: 00F39770

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: a6c385a4dd274e8a840e3be214b7afa49aceffb6e8ecb8e0eba35bd0ee5d5e60
Instruction ID: 978b6937917405befc573f091a469fba8e53db46b550f8dd79806d6a39bdfd2d
Opcode Fuzzy Hash: a6c385a4dd274e8a840e3be214b7afa49aceffb6e8ecb8e0eba35bd0ee5d5e60
Instruction Fuzzy Hash: BB41B671A04209BBDF21ABA0CC45FEFBBFDDF85720F40046AF904B7291DAB199059B61

Function 00F4258E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F4259E
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00F425D4

Strings

|, xrefs: 00F425A5

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: e006fbade9e72724fa0d4b2c7a3fe008e6b3b9c8c6c8a46ec9ac2db2bc1e4ef3
Instruction ID: e0d88f2ce3295bc0d101b4d9ec2e3af6976ea743634f99c65a6677ba0edd9bb1
Opcode Fuzzy Hash: e006fbade9e72724fa0d4b2c7a3fe008e6b3b9c8c6c8a46ec9ac2db2bc1e4ef3
Instruction Fuzzy Hash: 95310371801219AFCF01AFA4CC85EEEBFB8FF08350F10106AFD14B6262EA315956DB60

Function 00F57A71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00F57B61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00F57B76

Strings

', xrefs: 00F57ACA

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 46a0b6e2bc1fa9f65a44b67de2e3313294e73154cf8fe71773d68b71bd47199d
Instruction ID: af3c045c93ae468acefb5b85dd6b909ddb3981ca73f505e12c9d38986b060114
Opcode Fuzzy Hash: 46a0b6e2bc1fa9f65a44b67de2e3313294e73154cf8fe71773d68b71bd47199d
Instruction Fuzzy Hash: 1A412875A04309AFDB14DF65D880BDABBB5FB08301F10016AEE04EB395D730AA45DF90

Function 00F56A63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00F56B17
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00F56B53

Strings

static, xrefs: 00F56AB3

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: b581811afdcc060ba9ed04a164f4db930dde30eadc2877d6acdcd884effbb9b5
Instruction ID: 8d74c29df0208956c7c14c5568b71b8dbfe79210150bc41b92434889a725f3d9
Opcode Fuzzy Hash: b581811afdcc060ba9ed04a164f4db930dde30eadc2877d6acdcd884effbb9b5
Instruction Fuzzy Hash: 1E31B071200608AEDB109F64CC40BFB77A9FF88721F509519FEA5D3190DA34AC86EB60

Function 00F328A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F32911
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00F3294C

Strings

0, xrefs: 00F3290A

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 5392a67f6a52c409274e3771c703c9bf3692106c01a29d539a1ca754d2bdf92c
Instruction ID: 9e454f77918f958375ef3acefaa4a73934a08aa4eb11ee277ca21e0805ac6537
Opcode Fuzzy Hash: 5392a67f6a52c409274e3771c703c9bf3692106c01a29d539a1ca754d2bdf92c
Instruction Fuzzy Hash: 6A31C131A01309DFEB65CF58CC85BAEBBF8EF45370F140029E985A61A1D7709944FB51

Function 00F439E9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00F43A66

Part of subcall function 00ED7DE1: _memmove.LIBCMT ref: 00ED7E22

Strings

, $, xrefs: 00F43AA6
AUTOITCALLVARIABLE%d, xrefs: 00F43A58

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: 55e225298be1e46bed726cffa7111a8dcb9c3d7851d359398cf501c44e1b95f7
Instruction ID: addeb3b91b823bbefa07ad07d8c0209823f7ab873800ce778a706cb58bc273cc
Opcode Fuzzy Hash: 55e225298be1e46bed726cffa7111a8dcb9c3d7851d359398cf501c44e1b95f7
Instruction Fuzzy Hash: AE218135640219AFCF10EF64CC82AAE7BF5EF44700F500455E955BB282DB34EA46DB61

Function 00F566D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00F56761
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00F5676C

Strings

Combobox, xrefs: 00F5672E

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 45388623ffb877c9e8000e4ae8c1b8e352716a2cd48a31120fd387b6aae403d1
Instruction ID: bd057b7ea061ea286af0167be6f6ea53be829d96a37423ca608a0831a3dba085
Opcode Fuzzy Hash: 45388623ffb877c9e8000e4ae8c1b8e352716a2cd48a31120fd387b6aae403d1
Instruction Fuzzy Hash: 3A11B6716002086FEF159F54DC80EBB3B6AEB48369F510125FE24D7290DA75DC55A7A0

Function 00F56C07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00ED1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00ED1D73
Part of subcall function 00ED1D35: GetStockObject.GDI32(00000011), ref: 00ED1D87
Part of subcall function 00ED1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00ED1D91

GetWindowRect.USER32(00000000,?), ref: 00F56C71
GetSysColor.USER32(00000012), ref: 00F56C8B

Strings

static, xrefs: 00F56C4E

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 88f46029cf078fa71ba45bcd9dcb0a770a63bdb80370c6061ddfe130de846841
Instruction ID: 9d9a0cc82450e6c54bd9add87b151defd964c51c66b0ade0548973f420e4bffe
Opcode Fuzzy Hash: 88f46029cf078fa71ba45bcd9dcb0a770a63bdb80370c6061ddfe130de846841
Instruction Fuzzy Hash: 74215972910209AFDF04DFA8CC45AEA7BA9FB08316F004629FE95D3250E735E854EB60

Function 00F56920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00F569A2
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00F569B1

Strings

edit, xrefs: 00F56986

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 25162469fb2297c9fe5e63a7194c49def76d5836086a3a03a5be6f243f42ce0f
Instruction ID: 675519ead533e26a12a600fb51bb3c76172ac77ba0ca93d4ecee6ac4dc7a4c44
Opcode Fuzzy Hash: 25162469fb2297c9fe5e63a7194c49def76d5836086a3a03a5be6f243f42ce0f
Instruction Fuzzy Hash: 66115871900208ABEB108E649C40AAB37A9EB053B6F904624FEB5D71E0C635DC59A760

Function 00F329AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F32A22
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00F32A41

Strings

0, xrefs: 00F32A18

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 4102c9278e9bada67754726dfd772ee4d29f64af93c61d25b2af42eab7a57be2
Instruction ID: 5149573e93476f3d05c4c01570b98e4a09599ca25ee7a2697977474d7fe3132e
Opcode Fuzzy Hash: 4102c9278e9bada67754726dfd772ee4d29f64af93c61d25b2af42eab7a57be2
Instruction Fuzzy Hash: 90110832D01118ABDF71DF58DC44BAA73B8AB46330F244021E995E72A0D734AD0AF791

Function 00F421D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00F4222C
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00F42255

Strings

<local>, xrefs: 00F4221D

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 51e8b740bffa7d2e651a0811a3a909e2a212061c7407db45227e472e52e6fd6c
Instruction ID: c30176fd5841cfbfe905cdaff67fab97d76906d916da2d01dff0c01e2564c367
Opcode Fuzzy Hash: 51e8b740bffa7d2e651a0811a3a909e2a212061c7407db45227e472e52e6fd6c
Instruction Fuzzy Hash: A711E370901225BAEB248F118C84FB7FFA8FF06361F50823AFE0586000D3B05A84E6F0

Function 00F28E05 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED7DE1: _memmove.LIBCMT ref: 00ED7E22

Part of subcall function 00F2AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00F2AABC

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00F28E73

Strings

ComboBox, xrefs: 00F28E12
ListBox, xrefs: 00F28E3D

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 6525c8b46cf4eb8bcd6b56cfa2a9c9fde79c1df8ee75d3caae74a68015130520
Instruction ID: 96d7191a642a0a15ffcd74f0546302b34b4150547127bd48a1fed8c2c1d228a2
Opcode Fuzzy Hash: 6525c8b46cf4eb8bcd6b56cfa2a9c9fde79c1df8ee75d3caae74a68015130520
Instruction Fuzzy Hash: 2D01F572A02229AB8B14FBE4CC519FE73A9EF02360B10061AB871673E1EE355809E650

Function 00F28CFD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED7DE1: _memmove.LIBCMT ref: 00ED7E22

Part of subcall function 00F2AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00F2AABC

SendMessageW.USER32(?,00000180,00000000,?), ref: 00F28D6B

Strings

ComboBox, xrefs: 00F28D0A
ListBox, xrefs: 00F28D35

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 7c448a7488b0097201b404d7f94c6e9dee3ee403cfed5e97339bbc3cc034e911
Instruction ID: 5ff9c93a9717c1b05c4b36ccf50a08af81df09ede589cf5ca8cec821b0a78e4b
Opcode Fuzzy Hash: 7c448a7488b0097201b404d7f94c6e9dee3ee403cfed5e97339bbc3cc034e911
Instruction Fuzzy Hash: 8301D472A41219ABCB14EBA0DD52EFE73A8DF15390F60001AB841732D1DE249E0DE672

Function 00F28D82 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED7DE1: _memmove.LIBCMT ref: 00ED7E22

Part of subcall function 00F2AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00F2AABC

SendMessageW.USER32(?,00000182,?,00000000), ref: 00F28DEE

Strings

ComboBox, xrefs: 00F28D8F
ListBox, xrefs: 00F28DBA

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 225740dd9f814877f9b625fea2bd2ad1d4c53f0147e551c018381bf420900fae
Instruction ID: 6b8eee1a069889c22913eaad7ae193001e28491728c392251ee61958590a2508
Opcode Fuzzy Hash: 225740dd9f814877f9b625fea2bd2ad1d4c53f0147e551c018381bf420900fae
Instruction Fuzzy Hash: 0A01F772A41219A7CB10F7A4D952EFE73A8DF11350F600016B841B3292DE258E0EF671

Function 00F34F28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00F34F46
_wcscmp.LIBCMT ref: 00F34F58

Strings

#32770, xrefs: 00F34F52

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 5a4b16c3be12fefbcbcba14b1bd8cae8b5dd32145ed5217580f38035a7202c49
Instruction ID: 70bc777687418f2c341239d39157dafa31d90e865a4f117ccdbfd3b2655d00bb
Opcode Fuzzy Hash: 5a4b16c3be12fefbcbcba14b1bd8cae8b5dd32145ed5217580f38035a7202c49
Instruction Fuzzy Hash: CDE09232A0022C2AD720ABA9EC49AA7F7ACEB85B71F050067FD04D7051D960AA4587E1

Function 00F0B2C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00F0B314: _memset.LIBCMT ref: 00F0B321

Part of subcall function 00EF0940: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00F0B2F0,?,?,?,00ED100A), ref: 00EF0945

IsDebuggerPresent.KERNEL32(?,?,?,00ED100A), ref: 00F0B2F4
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00ED100A), ref: 00F0B303

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00F0B2FE

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: dcae7cedb43d202504caca785b907179b55a4e853567f95ac284d47b74dbef84
Instruction ID: 629d55f1038fccaf6ed8525e0201a6fd08bdbe8350d3356f57d2ebd442581610
Opcode Fuzzy Hash: dcae7cedb43d202504caca785b907179b55a4e853567f95ac284d47b74dbef84
Instruction Fuzzy Hash: 4DE06D706007048BD7609F28E8043467AE4AF40714F10CD6EE44AC7781E7B4D448EBA2

Function 00F11935 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00F11775

Part of subcall function 00F4BFF0: LoadLibraryA.KERNEL32(kernel32.dll,?,00F1195E,?), ref: 00F4BFFE
Part of subcall function 00F4BFF0: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00F4C010

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00F1196D

Strings

WIN_XPe, xrefs: 00F11788

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: 1fb9ba841b2ca204468c80559e01ac25a813c67c2ad029786d3bf0e566e4e44c
Instruction ID: 42c0f24193d7f8a6573c3d9bf37e7c7d424e1a23c7f4b7b5716694c1d1cf34a1
Opcode Fuzzy Hash: 1fb9ba841b2ca204468c80559e01ac25a813c67c2ad029786d3bf0e566e4e44c
Instruction Fuzzy Hash: 55F0C97180010DDFDB15DBA5C988BECBBF8BB08315F640096E712A2291D7758F89EF61

Function 00F55998 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00F559AE
PostMessageW.USER32(00000000), ref: 00F559B5

Part of subcall function 00F35244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00F352BC

Strings

Shell_TrayWnd, xrefs: 00F559A7

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 8f0a663236dd4d69b4c3df3349b794208aa39b0e91c9133a996aeeab891d5e87
Instruction ID: 06a4a3f1d1d6e8f141419657847f70352e8029c61e7f5c17619490a06e4c3332
Opcode Fuzzy Hash: 8f0a663236dd4d69b4c3df3349b794208aa39b0e91c9133a996aeeab891d5e87
Instruction Fuzzy Hash: DAD0C9313C0315BBE664BB709D0BFD77A14AB45B61F040865B346AB1D0D9E4A804D654

Function 00F55964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00F5596E
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00F55981

Part of subcall function 00F35244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00F352BC

Strings

Shell_TrayWnd, xrefs: 00F55967

Memory Dump Source

Source File: 00000000.00000002.1709570026.0000000000ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00ED0000, based on PE: true

Associated: 00000000.00000002.1709491839.0000000000ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709776950.0000000000F84000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709884477.0000000000F8E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1709985594.0000000000F97000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_UF7jzc7ETP.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: c1880f236413c5978f2115d890c138ae0d4ee5483fa10e78a5f0cf85f0cdc58a
Instruction ID: 5a5844555c67bbe26375142638e127494e12f72819497333d2fd873832d9a00a
Opcode Fuzzy Hash: c1880f236413c5978f2115d890c138ae0d4ee5483fa10e78a5f0cf85f0cdc58a
Instruction Fuzzy Hash: D4D0C935384315B7E664BB709D0BFD77A14AB40B61F040865B34AAB1D0D9E49804D654

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report UF7jzc7ETP.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: MassLogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\autECA5.tmp

C:\Users\user\AppData\Local\Temp\autECD5.tmp

C:\Users\user\AppData\Local\Temp\quinquenniad

C:\Users\user\AppData\Local\Temp\subpredication

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
UF7jzc7ETP.exe

Function 00ED3B3A Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Function 00ED49A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 00ED4E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 00F39155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 00ED3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 71
windowregistryCOMMON

Function 00ED3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 00ED708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00ED3A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00ED3633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 00ED3766 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Function 017EB930 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 00ED39D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 017EB6D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 154
fileCOMMON

Function 00ED407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Function 00EF541D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre