Edit tour

Windows Analysis Report
RFQ_AS0101402025.22025_PDF.exe

Overview

General Information

Sample name:	RFQ_AS0101402025.22025_PDF.exe
Analysis ID:	1591035
MD5:	5fea044a3e446f3d3790b6827790ad0a
SHA1:	02873146af4e9922afbf952ea2eaba8e68e8fb1a
SHA256:	ad25549d450ba601baac64e5efd061cdafa3e5b6f78f679345d33ddc25e66dd2
Tags:	exeMassLoggeruser-lowmal3
Infos:

Detection

MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Disable Task Manager(disabletaskmgr)

Disables CMD prompt

Disables the Windows registry editor (regedit)

Disables the Windows task manager (taskmgr)

Found API chain indicative of sandbox detection

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Uses reg.exe to modify the Windows registry

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

RFQ_AS0101402025.22025_PDF.exe (PID: 5464 cmdline: "C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe" MD5: 5FEA044A3E446F3D3790B6827790AD0A)

RegSvcs.exe (PID: 6412 cmdline: "C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

reg.exe (PID: 1224 cmdline: REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

conhost.exe (PID: 7068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Configuration

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7756640782:AAGnFu3e4jddvj5TE8bEBVB_3c_4DP5vedk", "Telegram Chatid": "6070433873"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.2506765940.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000003.00000002.2506765940.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2506765940.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000003.00000002.2506765940.0000000000402000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf155:$a1: get_encryptedPassword 0xf489:$a2: get_encryptedUsername 0xeede:$a3: get_timePasswordChanged 0xefff:$a4: get_passwordField 0xf16b:$a5: set_encryptedPassword 0x10ae2:$a7: get_logins 0x10793:$a8: GetOutlookPasswords 0x10585:$a9: StartKeylogger 0x10a32:$a10: KeyLoggerEventArgs 0x105e2:$a11: KeyLoggerEventArgsEventHandler
00000003.00000002.2508725765.0000000002DD7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1271010509.0000000001310000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000000.00000002.1271010509.0000000001310000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1271010509.0000000001310000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1271010509.0000000001310000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf355:$a1: get_encryptedPassword 0xf689:$a2: get_encryptedUsername 0xf0de:$a3: get_timePasswordChanged 0xf1ff:$a4: get_passwordField 0xf36b:$a5: set_encryptedPassword 0x10ce2:$a7: get_logins 0x10993:$a8: GetOutlookPasswords 0x10785:$a9: StartKeylogger 0x10c32:$a10: KeyLoggerEventArgs 0x107e2:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1271010509.0000000001310000.00000004.00001000.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14683:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13b81:$a3: \Google\Chrome\User Data\Default\Login Data 0x13e8f:$a4: \Orbitum\User Data\Default\Login Data 0x14c87:$a5: \Kometa\User Data\Default\Login Data
Process Memory Space: RFQ_AS0101402025.22025_PDF.exe PID: 5464	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: RFQ_AS0101402025.22025_PDF.exe PID: 5464	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RFQ_AS0101402025.22025_PDF.exe PID: 5464	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RFQ_AS0101402025.22025_PDF.exe PID: 5464	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x5ccf3f:$a1: get_encryptedPassword 0x5cd264:$a2: get_encryptedUsername 0x5cccdc:$a3: get_timePasswordChanged 0x5ccdfd:$a4: get_passwordField 0x5ccf55:$a5: set_encryptedPassword 0x5ce873:$a7: get_logins 0x5ce524:$a8: GetOutlookPasswords 0x5ce316:$a9: StartKeylogger 0x5ce7c3:$a10: KeyLoggerEventArgs 0x5ce373:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RegSvcs.exe PID: 6412	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 6412	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 6412	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 6412	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x143e0:$a1: get_encryptedPassword 0x14705:$a2: get_encryptedUsername 0x1417d:$a3: get_timePasswordChanged 0x1429e:$a4: get_passwordField 0x143f6:$a5: set_encryptedPassword 0x15d14:$a7: get_logins 0x159c5:$a8: GetOutlookPasswords 0x157b7:$a9: StartKeylogger 0x15c64:$a10: KeyLoggerEventArgs 0x15814:$a11: KeyLoggerEventArgsEventHandler
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.RFQ_AS0101402025.22025_PDF.exe.1310000.1.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.RFQ_AS0101402025.22025_PDF.exe.1310000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.RFQ_AS0101402025.22025_PDF.exe.1310000.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.RFQ_AS0101402025.22025_PDF.exe.1310000.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf355:$a1: get_encryptedPassword 0xf689:$a2: get_encryptedUsername 0xf0de:$a3: get_timePasswordChanged 0xf1ff:$a4: get_passwordField 0xf36b:$a5: set_encryptedPassword 0x10ce2:$a7: get_logins 0x10993:$a8: GetOutlookPasswords 0x10785:$a9: StartKeylogger 0x10c32:$a10: KeyLoggerEventArgs 0x107e2:$a11: KeyLoggerEventArgsEventHandler
0.2.RFQ_AS0101402025.22025_PDF.exe.1310000.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14683:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13b81:$a3: \Google\Chrome\User Data\Default\Login Data 0x13e8f:$a4: \Orbitum\User Data\Default\Login Data 0x14c87:$a5: \Kometa\User Data\Default\Login Data
0.2.RFQ_AS0101402025.22025_PDF.exe.1310000.1.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.RFQ_AS0101402025.22025_PDF.exe.1310000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.RFQ_AS0101402025.22025_PDF.exe.1310000.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.RFQ_AS0101402025.22025_PDF.exe.1310000.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd555:$a1: get_encryptedPassword 0xd889:$a2: get_encryptedUsername 0xd2de:$a3: get_timePasswordChanged 0xd3ff:$a4: get_passwordField 0xd56b:$a5: set_encryptedPassword 0xeee2:$a7: get_logins 0xeb93:$a8: GetOutlookPasswords 0xe985:$a9: StartKeylogger 0xee32:$a10: KeyLoggerEventArgs 0xe9e2:$a11: KeyLoggerEventArgsEventHandler
0.2.RFQ_AS0101402025.22025_PDF.exe.1310000.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x12883:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x11d81:$a3: \Google\Chrome\User Data\Default\Login Data 0x1208f:$a4: \Orbitum\User Data\Default\Login Data 0x12e87:$a5: \Kometa\User Data\Default\Login Data
3.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
3.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
3.2.RegSvcs.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf355:$a1: get_encryptedPassword 0xf689:$a2: get_encryptedUsername 0xf0de:$a3: get_timePasswordChanged 0xf1ff:$a4: get_passwordField 0xf36b:$a5: set_encryptedPassword 0x10ce2:$a7: get_logins 0x10993:$a8: GetOutlookPasswords 0x10785:$a9: StartKeylogger 0x10c32:$a10: KeyLoggerEventArgs 0x107e2:$a11: KeyLoggerEventArgsEventHandler
3.2.RegSvcs.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14683:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13b81:$a3: \Google\Chrome\User Data\Default\Login Data 0x13e8f:$a4: \Orbitum\User Data\Default\Login Data 0x14c87:$a5: \Kometa\User Data\Default\Login Data
Click to see the 10 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T17:09:52.471031+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49702	158.101.44.242	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: RFQ_AS0101402025.22025_PDF.exe

Avira: detected

Found malware configuration

Source: 00000003.00000002.2508725765.0000000002C81000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7756640782:AAGnFu3e4jddvj5TE8bEBVB_3c_4DP5vedk", "Telegram Chatid": "6070433873"}

Multi AV Scanner detection for submitted file

Source: RFQ_AS0101402025.22025_PDF.exe	Virustotal: Detection: 29%			Perma Link
Source: RFQ_AS0101402025.22025_PDF.exe	ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: RFQ_AS0101402025.22025_PDF.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: RFQ_AS0101402025.22025_PDF.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.7:49703 version: TLS 1.0

Source:	Binary string: wntdll.pdbUGP source: RFQ_AS0101402025.22025_PDF.exe, 00000000.00000003.1265984488.0000000003E10000.00000004.00001000.00020000.00000000.sdmp, RFQ_AS0101402025.22025_PDF.exe, 00000000.00000003.1264557768.0000000003FB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: RFQ_AS0101402025.22025_PDF.exe, 00000000.00000003.1265984488.0000000003E10000.00000004.00001000.00020000.00000000.sdmp, RFQ_AS0101402025.22025_PDF.exe, 00000000.00000003.1264557768.0000000003FB0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009FC2A2 FindFirstFileExW,	0_2_009FC2A2
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_00A368EE FindFirstFileW,FindClose,	0_2_00A368EE
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_00A3698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00A3698F
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_00A2D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00A2D076
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_00A2D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00A2D3A9
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_00A39642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00A39642
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_00A3979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00A3979D
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_00A2DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00A2DBBE
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_00A39B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00A39B2B
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_00A35C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00A35C97

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 013C9311h	3_2_013C9060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 013C9A3Ah	3_2_013C9620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 013C9A3Ah	3_2_013C9610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 013C9A3Ah	3_2_013C9967

Source: global traffic

HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.96.1 104.21.96.1
Source: Joe Sandbox View	IP Address: 104.21.96.1 104.21.96.1
Source: Joe Sandbox View	IP Address: 158.101.44.242 158.101.44.242

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49702 -> 158.101.44.242:80

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.7:49703 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Code function: 0_2_00A3CE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

0_2_00A3CE44

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: RegSvcs.exe, 00000003.00000002.2508725765.0000000002D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: RegSvcs.exe, 00000003.00000002.2508725765.0000000002D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.comd
Source: RegSvcs.exe, 00000003.00000002.2508725765.0000000002D00000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.2508725765.0000000002CEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: RegSvcs.exe, 00000003.00000002.2508725765.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: RegSvcs.exe, 00000003.00000002.2508725765.0000000002D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/d
Source: RFQ_AS0101402025.22025_PDF.exe, 00000000.00000002.1271010509.0000000001310000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.2506765940.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: RegSvcs.exe, 00000003.00000002.2508725765.0000000002D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgd
Source: RegSvcs.exe, 00000003.00000002.2508725765.0000000002D1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: RegSvcs.exe, 00000003.00000002.2508725765.0000000002D1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.orgd
Source: RegSvcs.exe, 00000003.00000002.2508725765.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RFQ_AS0101402025.22025_PDF.exe, 00000000.00000002.1271010509.0000000001310000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.2506765940.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: RegSvcs.exe, 00000003.00000002.2508725765.0000000002D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: RFQ_AS0101402025.22025_PDF.exe, 00000000.00000002.1271010509.0000000001310000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.2506765940.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.2508725765.0000000002D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: RegSvcs.exe, 00000003.00000002.2508725765.0000000002D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189d
Source: RegSvcs.exe, 00000003.00000002.2508725765.0000000002D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189l

Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Code function: 0_2_00A3EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00A3EAFF

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Code function: 0_2_00A3ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00A3ED6A

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

0_2_00A3EAFF

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Code function: 0_2_00A2AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_00A2AA57

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Code function: 0_2_00A59576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00A59576

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.RFQ_AS0101402025.22025_PDF.exe.1310000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.RFQ_AS0101402025.22025_PDF.exe.1310000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.RFQ_AS0101402025.22025_PDF.exe.1310000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.RFQ_AS0101402025.22025_PDF.exe.1310000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000003.00000002.2506765940.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1271010509.0000000001310000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1271010509.0000000001310000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: Process Memory Space: RFQ_AS0101402025.22025_PDF.exe PID: 5464, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RegSvcs.exe PID: 6412, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Binary is likely a compiled AutoIt script file

Source: RFQ_AS0101402025.22025_PDF.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: RFQ_AS0101402025.22025_PDF.exe, 00000000.00000000.1254859137.0000000000A82000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_1b51e3d3-b
Source: RFQ_AS0101402025.22025_PDF.exe, 00000000.00000000.1254859137.0000000000A82000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_2eac2a0e-9
Source: RFQ_AS0101402025.22025_PDF.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_0fd0b678-0
Source: RFQ_AS0101402025.22025_PDF.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_e3bab9a0-9

Initial sample is a PE file and has a suspicious name

Source: initial sample	Static PE information: Filename: RFQ_AS0101402025.22025_PDF.exe
Source: initial sample	Static PE information: Filename: RFQ_AS0101402025.22025_PDF.exe

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Code function: 0_2_00A2D5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00A2D5EB

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Code function: 0_2_00A21201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00A21201

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Code function: 0_2_00A2E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00A2E8F6

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_00A32046	0_2_00A32046
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009C8060	0_2_009C8060
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_00A28298	0_2_00A28298
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009FE4FF	0_2_009FE4FF
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009F676B	0_2_009F676B
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_00A54873	0_2_00A54873
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009ECAA0	0_2_009ECAA0
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009CCAF0	0_2_009CCAF0
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009DCC39	0_2_009DCC39
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009F6DD9	0_2_009F6DD9
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009C91C0	0_2_009C91C0
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009DB119	0_2_009DB119
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009E1394	0_2_009E1394
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009E1706	0_2_009E1706
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009E781B	0_2_009E781B
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009E19B0	0_2_009E19B0
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009C7920	0_2_009C7920
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009D997D	0_2_009D997D
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009E7A4A	0_2_009E7A4A
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009E7CA7	0_2_009E7CA7
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009E1C77	0_2_009E1C77
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009F9EEE	0_2_009F9EEE
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_00A4BE44	0_2_00A4BE44
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009E1F32	0_2_009E1F32
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_015E9A10	0_2_015E9A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_013C9060	3_2_013C9060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_013CBD10	3_2_013CBD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_013C7C70	3_2_013C7C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_013C8544	3_2_013C8544
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_013C27B9	3_2_013C27B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_013C2DE0	3_2_013C2DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_013C9050	3_2_013C9050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_013CF878	3_2_013CF878
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_013CF888	3_2_013CF888
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_013CBD00	3_2_013CBD00

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: String function: 009DF9F2 appears 40 times
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: String function: 009C9CB3 appears 31 times
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: String function: 009E0A30 appears 46 times

Source: RFQ_AS0101402025.22025_PDF.exe, 00000000.00000003.1264557768.00000000040DD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs RFQ_AS0101402025.22025_PDF.exe
Source: RFQ_AS0101402025.22025_PDF.exe, 00000000.00000003.1268207134.0000000003F33000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs RFQ_AS0101402025.22025_PDF.exe
Source: RFQ_AS0101402025.22025_PDF.exe, 00000000.00000002.1271010509.0000000001310000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs RFQ_AS0101402025.22025_PDF.exe

Source: RFQ_AS0101402025.22025_PDF.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process created: C:\Windows\SysWOW64\reg.exe REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f

Source: 0.2.RFQ_AS0101402025.22025_PDF.exe.1310000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.RFQ_AS0101402025.22025_PDF.exe.1310000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.RFQ_AS0101402025.22025_PDF.exe.1310000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.RFQ_AS0101402025.22025_PDF.exe.1310000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000003.00000002.2506765940.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1271010509.0000000001310000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1271010509.0000000001310000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: RFQ_AS0101402025.22025_PDF.exe PID: 5464, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RegSvcs.exe PID: 6412, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/1@2/2

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Code function: 0_2_00A337B5 GetLastError,FormatMessageW,

0_2_00A337B5

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_00A210BF AdjustTokenPrivileges,CloseHandle,		0_2_00A210BF
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_00A216C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00A216C3

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Code function: 0_2_00A351CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00A351CD

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Code function: 0_2_00A4A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00A4A67C

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Code function: 0_2_00A3648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_00A3648E

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Code function: 0_2_009C42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_009C42A2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7068:120:WilError_03

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

File created: C:\Users\user~1\AppData\Local\Temp\vitraillist

Jump to behavior

Source: RFQ_AS0101402025.22025_PDF.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegSvcs.exe, 00000003.00000002.2508725765.0000000002D94000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.2508725765.0000000002DA0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.2508725765.0000000002D71000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.2508725765.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.2509466803.0000000003CAD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.2508725765.0000000002D7F000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: RFQ_AS0101402025.22025_PDF.exe	Virustotal: Detection: 29%
Source: RFQ_AS0101402025.22025_PDF.exe	ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe "C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe"
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\reg.exe REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
Source: C:\Windows\SysWOW64\reg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\reg.exe REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f	Jump to behavior

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: RFQ_AS0101402025.22025_PDF.exe

Static file information: File size 1234944 > 1048576

Source: RFQ_AS0101402025.22025_PDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: RFQ_AS0101402025.22025_PDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: RFQ_AS0101402025.22025_PDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: RFQ_AS0101402025.22025_PDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: RFQ_AS0101402025.22025_PDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: RFQ_AS0101402025.22025_PDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: RFQ_AS0101402025.22025_PDF.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: RFQ_AS0101402025.22025_PDF.exe, 00000000.00000003.1265984488.0000000003E10000.00000004.00001000.00020000.00000000.sdmp, RFQ_AS0101402025.22025_PDF.exe, 00000000.00000003.1264557768.0000000003FB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: RFQ_AS0101402025.22025_PDF.exe, 00000000.00000003.1265984488.0000000003E10000.00000004.00001000.00020000.00000000.sdmp, RFQ_AS0101402025.22025_PDF.exe, 00000000.00000003.1264557768.0000000003FB0000.00000004.00001000.00020000.00000000.sdmp

Source: RFQ_AS0101402025.22025_PDF.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: RFQ_AS0101402025.22025_PDF.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: RFQ_AS0101402025.22025_PDF.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: RFQ_AS0101402025.22025_PDF.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: RFQ_AS0101402025.22025_PDF.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Code function: 0_2_009C42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_009C42DE

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009E0A76 push ecx; ret		0_2_009E0A89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_013CF4A1 push 2C013CCAh; retf		3_2_013CF4B1

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009DF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_009DF98E
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_00A51C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00A51C41

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-96425

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

API/Special instruction interceptor: Address: 15E9634

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

API coverage: 3.4 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009FC2A2 FindFirstFileExW,	0_2_009FC2A2
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_00A368EE FindFirstFileW,FindClose,	0_2_00A368EE
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_00A3698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00A3698F
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_00A2D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00A2D076
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_00A2D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00A2D3A9
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_00A39642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00A39642
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_00A3979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00A3979D
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_00A2DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00A2DBBE
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_00A39B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00A39B2B
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_00A35C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00A35C97

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Code function: 0_2_009C42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_009C42DE

Source: RFQ_AS0101402025.22025_PDF.exe	Binary or memory string: HGfsvr
Source: RegSvcs.exe, 00000003.00000002.2507160867.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Code function: 0_2_00A3EAA2 BlockInput,

0_2_00A3EAA2

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Code function: 0_2_009F2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_009F2622

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Code function: 0_2_009C42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_009C42DE

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009E4CE8 mov eax, dword ptr fs:[00000030h]	0_2_009E4CE8
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_015E8260 mov eax, dword ptr fs:[00000030h]	0_2_015E8260
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_015E9900 mov eax, dword ptr fs:[00000030h]	0_2_015E9900
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_015E98A0 mov eax, dword ptr fs:[00000030h]	0_2_015E98A0

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Code function: 0_2_00A20B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00A20B62

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009F2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_009F2622
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009E083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_009E083F
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009E09D5 SetUnhandledExceptionFilter,	0_2_009E09D5
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_009E0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_009E0C21

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: CF6008

Jump to behavior

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

0_2_00A21201

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Code function: 0_2_00A02BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00A02BA5

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Code function: 0_2_00A2B226 SendInput,keybd_event,

0_2_00A2B226

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Code function: 0_2_00A422DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_00A422DA

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe"

Jump to behavior

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

0_2_00A20B62

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Code function: 0_2_00A21663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00A21663

Source: RFQ_AS0101402025.22025_PDF.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: RFQ_AS0101402025.22025_PDF.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Code function: 0_2_009E0698 cpuid

0_2_009E0698

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Code function: 0_2_00A38195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00A38195

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Code function: 0_2_00A1D27A GetUserNameW,

0_2_00A1D27A

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Code function: 0_2_009FB952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

0_2_009FB952

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe

Code function: 0_2_009C42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_009C42DE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Task Manager(disabletaskmgr)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Registry value created: DisableTaskMgr 1

Jump to behavior

Disables CMD prompt

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Registry value created: DisableCMD 1

Jump to behavior

Disables the Windows registry editor (regedit)

Source: C:\Windows\SysWOW64\reg.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableRegistryTools

Jump to behavior

Disables the Windows task manager (taskmgr)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 0.2.RFQ_AS0101402025.22025_PDF.exe.1310000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ_AS0101402025.22025_PDF.exe.1310000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2506765940.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1271010509.0000000001310000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ_AS0101402025.22025_PDF.exe PID: 5464, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6412, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.RFQ_AS0101402025.22025_PDF.exe.1310000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ_AS0101402025.22025_PDF.exe.1310000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2506765940.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1271010509.0000000001310000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ_AS0101402025.22025_PDF.exe PID: 5464, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6412, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: RFQ_AS0101402025.22025_PDF.exe	Binary or memory string: WIN_81
Source: RFQ_AS0101402025.22025_PDF.exe	Binary or memory string: WIN_XP
Source: RFQ_AS0101402025.22025_PDF.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: RFQ_AS0101402025.22025_PDF.exe	Binary or memory string: WIN_XPe
Source: RFQ_AS0101402025.22025_PDF.exe	Binary or memory string: WIN_VISTA
Source: RFQ_AS0101402025.22025_PDF.exe	Binary or memory string: WIN_7
Source: RFQ_AS0101402025.22025_PDF.exe	Binary or memory string: WIN_8

Source: Yara match	File source: 0.2.RFQ_AS0101402025.22025_PDF.exe.1310000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ_AS0101402025.22025_PDF.exe.1310000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2506765940.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2508725765.0000000002DD7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1271010509.0000000001310000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ_AS0101402025.22025_PDF.exe PID: 5464, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6412, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 0.2.RFQ_AS0101402025.22025_PDF.exe.1310000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ_AS0101402025.22025_PDF.exe.1310000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2506765940.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1271010509.0000000001310000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ_AS0101402025.22025_PDF.exe PID: 5464, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6412, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.RFQ_AS0101402025.22025_PDF.exe.1310000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ_AS0101402025.22025_PDF.exe.1310000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2506765940.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1271010509.0000000001310000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ_AS0101402025.22025_PDF.exe PID: 5464, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6412, type: MEMORYSTR

Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_00A41204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00A41204
Source: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe	Code function: 0_2_00A41806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00A41806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	411 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	3 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	127 System Information Discovery	Distributed Component Object Model	21 Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	221 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Modify Registry	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
RFQ_AS0101402025.22025_PDF.exe	30%	Virustotal		Browse
RFQ_AS0101402025.22025_PDF.exe	34%	ReversingLabs	Win32.Ransomware.MassLoggerRAT
RFQ_AS0101402025.22025_PDF.exe	100%	Avira	DR/AutoIt.Gen8
RFQ_AS0101402025.22025_PDF.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.96.1	true	false	high
checkip.dyndns.com	158.101.44.242	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false		high
https://reallyfreegeoip.org/xml/8.46.123.189	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189l	RegSvcs.exe, 00000003.00000002.2508725765.0000000002D00000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.comd	RegSvcs.exe, 00000003.00000002.2508725765.0000000002D00000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	RFQ_AS0101402025.22025_PDF.exe, 00000000.00000002.1271010509.0000000001310000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.2506765940.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	high
http://reallyfreegeoip.orgd	RegSvcs.exe, 00000003.00000002.2508725765.0000000002D1D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189d	RegSvcs.exe, 00000003.00000002.2508725765.0000000002D00000.00000004.00000800.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	RegSvcs.exe, 00000003.00000002.2508725765.0000000002D1D000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.orgd	RegSvcs.exe, 00000003.00000002.2508725765.0000000002D00000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	RegSvcs.exe, 00000003.00000002.2508725765.0000000002D00000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	RegSvcs.exe, 00000003.00000002.2508725765.0000000002D00000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.2508725765.0000000002CEE000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	RegSvcs.exe, 00000003.00000002.2508725765.0000000002D00000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/d	RegSvcs.exe, 00000003.00000002.2508725765.0000000002D00000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000003.00000002.2508725765.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot-/sendDocument?chat_id=	RFQ_AS0101402025.22025_PDF.exe, 00000000.00000002.1271010509.0000000001310000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.2506765940.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	RFQ_AS0101402025.22025_PDF.exe, 00000000.00000002.1271010509.0000000001310000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.2506765940.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.2508725765.0000000002D00000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.96.1	reallyfreegeoip.org	United States		13335	CLOUDFLARENETUS	false
158.101.44.242	checkip.dyndns.com	United States		31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591035
Start date and time:	2025-01-14 17:08:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RFQ_AS0101402025.22025_PDF.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/1@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 48 Number of non-executed functions: 298
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.175.87.197
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.96.1	k9OEsV37GE.exe	Get hash	malicious	FormBook	Browse	www.uzshou.world/kbd2/?EtJTX=_JVX4ryxDRQpLJF&cNPH=ufZ7RYF4yLxNXVSq5Vx/4TYieRbcnKjskkbM3L5RbgB1pAgqHA7sfCNkYWLyXRMMwBB3JLbYKUw1FAOWml6VLpxPVZ4qXf58MsNUIQgw/PJ5HUGIvLQvrl5frN9PrRFpPiAd2cDcH6Sr
	gH3LlhcRzg.exe	Get hash	malicious	FormBook	Browse	www.dejikenkyu.cyou/58m5/
	EIvidclKOb.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/0pqe/
	zE1VxVoZ3W.exe	Get hash	malicious	FormBook	Browse	www.aonline.top/fqlg/
	QUOTATION#070125-ELITE MARINE .exe	Get hash	malicious	FormBook	Browse	www.mzkd6gp5.top/3u0p/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	pelisplus.so/administrator/index.php
	Recibos.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/1a34/
158.101.44.242	ABG Draft.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	SOA.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	FA_35_01_2025_STA_Wz#U00f3r_standard_pdf .scr.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	nfKqna8HuC.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	aS39AS7b0P.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	sS7Jrsk0Z7.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	3qr7JBuNuX.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	5qJ6QQTcRS.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	prlsqnzspl.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	QUOTATION REQUIRED_Enatel s.r.l..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	Confirm Bank Statement.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	50201668.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	MB263350411AE_1.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
	ABG Draft.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	RENH3RE2025QUOTE.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.247.73
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	tN8GsMV1le.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	slime crypted.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
reallyfreegeoip.org	QUOTATION REQUIRED_Enatel s.r.l..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	Confirm Bank Statement.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.64.1
	50201668.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	MB263350411AE_1.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.16.1
	ABG Draft.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.64.1
	RENH3RE2025QUOTE.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.80.1
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	tN8GsMV1le.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	slime crypted.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	m68k.elf	Get hash	malicious	Unknown	Browse	193.122.239.186
	50201668.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	MB263350411AE_1.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
	ABG Draft.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	http://ubiquitous-twilight-c9292b.netlify.app/	Get hash	malicious	Unknown	Browse	129.213.176.209
	slime crypted.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	MB263350411AE.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
	Remittance Advice.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	SOA.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	FA_35_01_2025_STA_Wz#U00f3r_standard_pdf .scr.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
CLOUDFLARENETUS	http://www.adidas-samba.es	Get hash	malicious	Unknown	Browse	104.21.16.1
	lumma_phothockey.exe	Get hash	malicious	LummaC	Browse	104.21.67.165
	https://microsoft-visio.en.softonic.com/	Get hash	malicious	Unknown	Browse	172.67.74.232
	QUOTATION REQUIRED_Enatel s.r.l..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	EspPrivStoreAtt116.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	SPOOOFER776.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	PlusPrivStoreAtt116.exe	Get hash	malicious	Unknown	Browse	104.26.1.5
	AimPrivStoreAtt117.exe	Get hash	malicious	Unknown	Browse	172.67.72.57
	http://loginmicrosoftonline.al-mutaheda.com/expiration/notice/nRrRc/receiving@accel-inc.com	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	EspPrivStoreAtt116.exe	Get hash	malicious	Unknown	Browse	104.26.0.5

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	QUOTATION REQUIRED_Enatel s.r.l..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	Confirm Bank Statement.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.96.1
	50201668.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	MB263350411AE_1.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.96.1
	ABG Draft.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.96.1
	RENH3RE2025QUOTE.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.96.1
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	tN8GsMV1le.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	slime crypted.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1

Process:	C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe
File Type:	data
Category:	modified
Size (bytes):	94720
Entropy (8bit):	6.849654642582613
Encrypted:	false
SSDEEP:	1536:Hg6E2KUta7YiATiAclM0/nCtF0+k+4IHy3+SHX+/5z3cq:Hg6lKJ7VM0fCtFGbq
MD5:	C03963346C6A67F4010763FA3FA7A8EB
SHA1:	745A3EEAC6F6F13D8A966B83450DEBF5C366CBDB
SHA-256:	EC131CD740EA7D21EB340B7D207BDEF1D36785BD7F274604D0AF6650906CFD63
SHA-512:	B1229F0DD89BF1E689FAED4237B0CFF0707520A8B34465F40116068BE5A18326E81B7560489B4F050CB5BD0C798F21A16CFC1BFCD6575FBE955F603A3D0938BA
Malicious:	false
Reputation:	low
Preview:	...JS6RQL3SZ..OS.IXODYZY.P6RQH3SZJMOS8IXODYZYJP6RQH3SZJMOS8I.ODYTF.^6.X...[..n.P +o4+5>81[r2)]=5>m-6.;-!d04y..er<'W6tG@Ew8IXODYZ..P6.PK3.4..OS8IXODY.YHQ=S.H3;[JMGS8IXOD..XJP.RQH.RZJM.S8iXOD[ZYNP6RQH3S\JMOS8IXO.XZYHP6RQH3QZ.OS(IX_DYZYZP6BQH3SZJ]OS8IXODYZYJ8.SQ.3SZJ.NS.LXODYZYJP6RQH3SZJMOS.HXCDYZYJP6RQH3SZJMOS8IXODYZYJP6RQH3SZJMOS8IXODYZYJP6RQH.SZBMOS8IXODYZYBp6R.H3SZJMOS8IXa0<"-JP6.6I3SzJMO;9IXMDYZYJP6RQH3SZJmOSXg<6:ZYJ.3RQH.RZJKOS8#YODYZYJP6RQH3S.JM.}J,4 'YZUJP6R.I3SXJMO#9IXODYZYJP6RQHsSZ.MOS8IXODYZYJP6RQ.RZJMOSpIXOFY_Y.6R..3SYJMO.8I^O.YZ.JP6RQH3SZJMOS8IXODYZYJP6RQH3SZJMOS8IXODYZYJ.K.^..39.S8IXODXXZNV>ZQH3SZJMO-8IX.DYZ.JP6eQH3vZJM"S8I\|ODY$YJPHRQHWSZJ?OS8(XOD.ZYJ?6RQ&3SZ4MOS&KpPDYPslP4zqH3YZ`.<r8IR.EYZ]9r6R[.1SZN>lS8C.LDY^nP6X.L3S^9hOS2.]OD]p.JS.DWH3H5rMOY8J.ZBYZB`v6Pyq3SPJgiS;.MIDYAshP4.XH3Wp.>RS8Op.DYP-CP6P.B3S^`SM{{IXEn{$JJP2yQb.-NJMKx8cz1QYZ]aP.p/^3S^aMeqF^XO@rZsLzTR#J>SI".S8Op.DYPq.P6TQb.S$DMOW:&.ODS\|spP..QH5Sr.MOU8c.O:jZYN\|1,bH3Wq\3~S8M.I<YZ_9.6R[m.`ZJIg.8IROn.Zq.P6TQ`.SZL

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.1183425417704544
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	RFQ_AS0101402025.22025_PDF.exe
File size:	1'234'944 bytes
MD5:	5fea044a3e446f3d3790b6827790ad0a
SHA1:	02873146af4e9922afbf952ea2eaba8e68e8fb1a
SHA256:	ad25549d450ba601baac64e5efd061cdafa3e5b6f78f679345d33ddc25e66dd2
SHA512:	1a520effc2f3904145761072f3e823b8660444f21847c1c0e136912439cc2cb069ad976f06e18f8bff706631f37b255b3df271895539902cac5ab52695eac30c
SSDEEP:	24576:7qDEvCTbMWu7rQYlBQcBiT6rprG8aFWIWS9C0gKkqNezrh:7TvC/MTQYxsWR7aF+YCLKkqNE
TLSH:	A545CF0273D1C062FF9B92334F5AF6515BBC69260123EA1F13A819B9BD701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67864207 [Tue Jan 14 10:52:55 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F9134B4B103h
jmp 00007F9134B4AA0Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F9134B4ABEDh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F9134B4ABBAh
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F9134B4D7ADh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F9134B4D7F8h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F9134B4D7E1h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x56d7c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x12b000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x56d7c	0x56e00	981c5580666b192bf3ed3da48ddb2130	False	0.9246824415467626	data	7.8865897470866235	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x12b000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x4e044	data			1.000331710247969
RT_GROUP_ICON	0x12a7fc	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x12a874	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x12a888	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x12a89c	0x14	data	English	Great Britain	1.25
RT_VERSION	0x12a8b0	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x12a98c	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-14T17:09:52.471031+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49702	158.101.44.242	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 17:09:51.502572060 CET	49702	80	192.168.2.7	158.101.44.242
Jan 14, 2025 17:09:51.508502007 CET	80	49702	158.101.44.242	192.168.2.7
Jan 14, 2025 17:09:51.508585930 CET	49702	80	192.168.2.7	158.101.44.242
Jan 14, 2025 17:09:51.543334961 CET	49702	80	192.168.2.7	158.101.44.242
Jan 14, 2025 17:09:51.548158884 CET	80	49702	158.101.44.242	192.168.2.7
Jan 14, 2025 17:09:52.251221895 CET	80	49702	158.101.44.242	192.168.2.7
Jan 14, 2025 17:09:52.259341955 CET	49702	80	192.168.2.7	158.101.44.242
Jan 14, 2025 17:09:52.267338037 CET	80	49702	158.101.44.242	192.168.2.7
Jan 14, 2025 17:09:52.425313950 CET	80	49702	158.101.44.242	192.168.2.7
Jan 14, 2025 17:09:52.436923027 CET	49703	443	192.168.2.7	104.21.96.1
Jan 14, 2025 17:09:52.436970949 CET	443	49703	104.21.96.1	192.168.2.7
Jan 14, 2025 17:09:52.437231064 CET	49703	443	192.168.2.7	104.21.96.1
Jan 14, 2025 17:09:52.471030951 CET	49702	80	192.168.2.7	158.101.44.242
Jan 14, 2025 17:09:52.472661018 CET	49703	443	192.168.2.7	104.21.96.1
Jan 14, 2025 17:09:52.472687006 CET	443	49703	104.21.96.1	192.168.2.7
Jan 14, 2025 17:09:52.939722061 CET	443	49703	104.21.96.1	192.168.2.7
Jan 14, 2025 17:09:52.939913988 CET	49703	443	192.168.2.7	104.21.96.1
Jan 14, 2025 17:09:52.960558891 CET	49703	443	192.168.2.7	104.21.96.1
Jan 14, 2025 17:09:52.960581064 CET	443	49703	104.21.96.1	192.168.2.7
Jan 14, 2025 17:09:52.960973024 CET	443	49703	104.21.96.1	192.168.2.7
Jan 14, 2025 17:09:53.002587080 CET	49703	443	192.168.2.7	104.21.96.1
Jan 14, 2025 17:09:53.123173952 CET	49703	443	192.168.2.7	104.21.96.1
Jan 14, 2025 17:09:53.167329073 CET	443	49703	104.21.96.1	192.168.2.7
Jan 14, 2025 17:09:53.302067995 CET	443	49703	104.21.96.1	192.168.2.7
Jan 14, 2025 17:09:53.302130938 CET	443	49703	104.21.96.1	192.168.2.7
Jan 14, 2025 17:09:53.302239895 CET	49703	443	192.168.2.7	104.21.96.1
Jan 14, 2025 17:09:53.334902048 CET	49703	443	192.168.2.7	104.21.96.1
Jan 14, 2025 17:10:57.423110008 CET	80	49702	158.101.44.242	192.168.2.7
Jan 14, 2025 17:10:57.423235893 CET	49702	80	192.168.2.7	158.101.44.242
Jan 14, 2025 17:11:32.440324068 CET	49702	80	192.168.2.7	158.101.44.242
Jan 14, 2025 17:11:32.445175886 CET	80	49702	158.101.44.242	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 17:09:51.446940899 CET	51701	53	192.168.2.7	1.1.1.1
Jan 14, 2025 17:09:51.455055952 CET	53	51701	1.1.1.1	192.168.2.7
Jan 14, 2025 17:09:52.426843882 CET	58039	53	192.168.2.7	1.1.1.1
Jan 14, 2025 17:09:52.436259985 CET	53	58039	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 17:09:51.446940899 CET	192.168.2.7	1.1.1.1	0xbdfb	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 14, 2025 17:09:52.426843882 CET	192.168.2.7	1.1.1.1	0x829a	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 17:09:51.455055952 CET	1.1.1.1	192.168.2.7	0xbdfb	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 17:09:51.455055952 CET	1.1.1.1	192.168.2.7	0xbdfb	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 14, 2025 17:09:51.455055952 CET	1.1.1.1	192.168.2.7	0xbdfb	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 14, 2025 17:09:51.455055952 CET	1.1.1.1	192.168.2.7	0xbdfb	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 14, 2025 17:09:51.455055952 CET	1.1.1.1	192.168.2.7	0xbdfb	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 14, 2025 17:09:51.455055952 CET	1.1.1.1	192.168.2.7	0xbdfb	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 14, 2025 17:09:52.436259985 CET	1.1.1.1	192.168.2.7	0x829a	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 14, 2025 17:09:52.436259985 CET	1.1.1.1	192.168.2.7	0x829a	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 14, 2025 17:09:52.436259985 CET	1.1.1.1	192.168.2.7	0x829a	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 14, 2025 17:09:52.436259985 CET	1.1.1.1	192.168.2.7	0x829a	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 14, 2025 17:09:52.436259985 CET	1.1.1.1	192.168.2.7	0x829a	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 14, 2025 17:09:52.436259985 CET	1.1.1.1	192.168.2.7	0x829a	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 14, 2025 17:09:52.436259985 CET	1.1.1.1	192.168.2.7	0x829a	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49702	158.101.44.242	80	6412	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 17:09:51.543334961 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 14, 2025 17:09:52.251221895 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 16:09:52 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b1479183c211cb640adffba578dd1530 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 14, 2025 17:09:52.259341955 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 14, 2025 17:09:52.425313950 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 16:09:52 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7797d863a5d8e8c43a20481a7ec56021 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49703	104.21.96.1	443	6412	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 16:09:53 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-14 16:09:53 UTC	858	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 16:09:53 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2185782 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fmuCZMatUPkLZPTIy44N8SOB%2Bs%2Be%2FiACu1mEHJWZzuo5HydEHCX2Tw5tZXKOHaelV2tKaCnZ7g7QsP1kikqzGNgYnlzrYgVx6VcheLfMTCKKUagLmW%2B4Nw19MuO%2FCw6bsbtqkqBg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 901ee49bae1442c0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2157&min_rtt=2045&rtt_var=992&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=990502&cwnd=212&unsent_bytes=0&cid=798ebd38f83f0b47&ts=378&x=0"
2025-01-14 16:09:53 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Target ID:	0
Start time:	11:09:47
Start date:	14/01/2025
Path:	C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe"
Imagebase:	0x9c0000
File size:	1'234'944 bytes
MD5 hash:	5FEA044A3E446F3D3790B6827790AD0A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000000.00000002.1271010509.0000000001310000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1271010509.0000000001310000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1271010509.0000000001310000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1271010509.0000000001310000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000000.00000002.1271010509.0000000001310000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:09:48
Start date:	14/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe"
Imagebase:	0xa90000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000003.00000002.2506765940.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2506765940.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000002.2506765940.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000003.00000002.2506765940.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2508725765.0000000002DD7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:09:52
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
Imagebase:	0x800000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:09:52
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	0.9%
Signature Coverage:	2.8%
Total number of Nodes:	1813
Total number of Limit Nodes:	65

Executed Functions

Function 009C42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 009C430D

Part of subcall function 009C6B57: _wcslen.LIBCMT ref: 009C6B6A

GetCurrentProcess.KERNEL32(?,00A5CB64,00000000,?,?), ref: 009C4422
IsWow64Process.KERNEL32(00000000,?,?), ref: 009C4429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 009C4454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 009C4466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 009C4474
FreeLibrary.KERNEL32(00000000,?,?), ref: 009C447B
GetSystemInfo.KERNEL32(?,?,?), ref: 009C44A0

Strings

|O, xrefs: 00A036F8
kernel32.dll, xrefs: 009C444F
GetNativeSystemInfo, xrefs: 009C4460

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: d2a72cfbed6f9d14d1d21903f07271370642fa1c7e60aeb8772afc9451a8713e
Instruction ID: a7d4be8bbca8dca57b9309f072e7228d715272c3326e8eb40ae4b410bfbbb0ae
Opcode Fuzzy Hash: d2a72cfbed6f9d14d1d21903f07271370642fa1c7e60aeb8772afc9451a8713e
Instruction Fuzzy Hash: 5FA1B466F0A3C6DFCB95C7E978806A77FF87B26300B14489ED4419BA71DA24450BDB22

Function 009C42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,009C50AA,?,?,00000000,00000000), ref: 009C42B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,009C50AA,?,?,00000000,00000000), ref: 009C42C9
LoadResource.KERNEL32(?,00000000,?,?,009C50AA,?,?,00000000,00000000,?,?,?,?,?,?,009C4F20), ref: 00A035BE
SizeofResource.KERNEL32(?,00000000,?,?,009C50AA,?,?,00000000,00000000,?,?,?,?,?,?,009C4F20), ref: 00A035D3
LockResource.KERNEL32(009C50AA,?,?,009C50AA,?,?,00000000,00000000,?,?,?,?,?,?,009C4F20,?), ref: 00A035E6

Strings

SCRIPT, xrefs: 009C42BF

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: ff2143145e0d47e7ac1c75860672269faa2e69361ee972beb8c8972febe3365b
Instruction ID: 4c1a8b181437c45f63cf26ed396b4920e7fdb6f5d6c858f8ae4ee4006c987952
Opcode Fuzzy Hash: ff2143145e0d47e7ac1c75860672269faa2e69361ee972beb8c8972febe3365b
Instruction Fuzzy Hash: 1F11AC70600300BFEB219BA5EC49F6B7BBDFBC5B62F20416DF812862A0DB71D800D621

Function 00A02BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 009C2B6B

Part of subcall function 009C3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00A91418,?,009C2E7F,?,?,?,00000000), ref: 009C3A78

Part of subcall function 009C9CB3: _wcslen.LIBCMT ref: 009C9CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00A82224), ref: 00A02C10
ShellExecuteW.SHELL32(00000000,?,?,00A82224), ref: 00A02C17

Strings

runas, xrefs: 00A02C0B

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 4540bad9332838a5a67e286935ca4132259da86b5f2b4bc72b133abb09b8c669
Instruction ID: 9c533f37d38da4fd23e9cb970d3b50e5db09e89bbfc565c7d8836f1a930c0773
Opcode Fuzzy Hash: 4540bad9332838a5a67e286935ca4132259da86b5f2b4bc72b133abb09b8c669
Instruction Fuzzy Hash: 2F11B471A083456AC714FF70E855FBEBBA4ABD6310F44842DF082520A2DF20894AC713

Function 009CD730 Relevance: 21.6, APIs: 14, Instructions: 618windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 009CD807
timeGetTime.WINMM ref: 009CDA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 009CDB28
TranslateMessage.USER32(?), ref: 009CDB7B
DispatchMessageW.USER32(?), ref: 009CDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 009CDB9F
Sleep.KERNEL32(0000000A), ref: 009CDBB1

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: e9a7ab27b24f7ce7a47dfcf5e9d562ebfd387f4f7c615258881588ff78a6c3ca
Instruction ID: 2ff8e69507bb01f7135346101a1455a69dad54af49fc6834cc46cd269a111c88
Opcode Fuzzy Hash: e9a7ab27b24f7ce7a47dfcf5e9d562ebfd387f4f7c615258881588ff78a6c3ca
Instruction Fuzzy Hash: AA420330A09341EFD728CF24C885FAAB7E5BF85304F14892EE59687291D774E895CB93

Function 009C2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 009C2D07
RegisterClassExW.USER32(00000030), ref: 009C2D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 009C2D42
InitCommonControlsEx.COMCTL32(?), ref: 009C2D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 009C2D6F
LoadIconW.USER32(000000A9), ref: 009C2D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 009C2D94

Strings

TaskbarCreated, xrefs: 009C2D37
0, xrefs: 009C2CE9
AutoIt v3 GUI, xrefs: 009C2D23
+, xrefs: 009C2CF0

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 28e8af5f8401d5d756560afd03ddc77ac7a352efc39e26336d46f93dfe80f958
Instruction ID: 03080dfd5ba79f26170511d9389803a6b9aaf6c618df5b30eafcb27fd074d97c
Opcode Fuzzy Hash: 28e8af5f8401d5d756560afd03ddc77ac7a352efc39e26336d46f93dfe80f958
Instruction Fuzzy Hash: 4521B2B5A01319AFDB00DFE4EC49B9DBBB4FB08B15F10811AF911A62A4DBB14545CF91

Function 00A0065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A0039A: CreateFileW.KERNELBASE(00000000,00000000,?,00A00704,?,?,00000000,?,00A00704,00000000,0000000C), ref: 00A003B7

GetLastError.KERNEL32 ref: 00A0076F
__dosmaperr.LIBCMT ref: 00A00776
GetFileType.KERNELBASE(00000000), ref: 00A00782
GetLastError.KERNEL32 ref: 00A0078C
__dosmaperr.LIBCMT ref: 00A00795
CloseHandle.KERNEL32(00000000), ref: 00A007B5
CloseHandle.KERNEL32(?), ref: 00A008FF
GetLastError.KERNEL32 ref: 00A00931
__dosmaperr.LIBCMT ref: 00A00938

Strings

H, xrefs: 00A008BD

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: eb78b18d240d2fcff98fff7a36e27a6acf7643858501b22ca381d61826df7c77
Instruction ID: b2ac5b674ec2303699e7b87b71a110627bf8a0834f5a138eaa30ed7a405af2f6
Opcode Fuzzy Hash: eb78b18d240d2fcff98fff7a36e27a6acf7643858501b22ca381d61826df7c77
Instruction Fuzzy Hash: 1DA10432A046488FDF19EFA8E851FAE7BA0AB46320F14415AF8159F3D1DB359D13CB91

Function 009C344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009C3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00A91418,?,009C2E7F,?,?,?,00000000), ref: 009C3A78

Part of subcall function 009C3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 009C3379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 009C356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00A0318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00A031CE
RegCloseKey.ADVAPI32(?), ref: 00A03210
_wcslen.LIBCMT ref: 00A03277
_wcslen.LIBCMT ref: 00A03286

Strings

Software\AutoIt v3\AutoIt, xrefs: 009C3560
Include, xrefs: 00A03184, 00A031C5
\, xrefs: 00A0328C
\Include\, xrefs: 009C3527

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 582c0d7b2e8aba419de1d1cf7e9935d3235e1102224a6eb84f573be8186159e2
Instruction ID: 3937417975c95bbd9ec0434c62c63d44db5579fdc9c47508e4b2e3f4a50d1f27
Opcode Fuzzy Hash: 582c0d7b2e8aba419de1d1cf7e9935d3235e1102224a6eb84f573be8186159e2
Instruction Fuzzy Hash: 5E71B271A05304AEC704DF65EC82FABB7E8FF99340F40492EF5458B1A1EB309A49CB52

Function 009C2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 009C2B8E
LoadCursorW.USER32(00000000,00007F00), ref: 009C2B9D
LoadIconW.USER32(00000063), ref: 009C2BB3
LoadIconW.USER32(000000A4), ref: 009C2BC5
LoadIconW.USER32(000000A2), ref: 009C2BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 009C2BEF
RegisterClassExW.USER32(?), ref: 009C2C40

Part of subcall function 009C2CD4: GetSysColorBrush.USER32(0000000F), ref: 009C2D07
Part of subcall function 009C2CD4: RegisterClassExW.USER32(00000030), ref: 009C2D31
Part of subcall function 009C2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 009C2D42
Part of subcall function 009C2CD4: InitCommonControlsEx.COMCTL32(?), ref: 009C2D5F
Part of subcall function 009C2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 009C2D6F
Part of subcall function 009C2CD4: LoadIconW.USER32(000000A9), ref: 009C2D85
Part of subcall function 009C2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 009C2D94

Strings

#, xrefs: 009C2C16
0, xrefs: 009C2C0F
AutoIt v3, xrefs: 009C2C2F

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: bc4bb7acc0b0f08076a2d8346beff001b3d8028e513ea97d692c51245a9d24f1
Instruction ID: caeeffcd1ddca7914bdec013dd3f19b0c7493b051738430e9f271f9cafab4426
Opcode Fuzzy Hash: bc4bb7acc0b0f08076a2d8346beff001b3d8028e513ea97d692c51245a9d24f1
Instruction Fuzzy Hash: 05211874E00319AFDB50DFE5EC59BAA7FB4FB48B54F04411BE504AA6A0DBB10542CF90

Function 009C3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,009C316A,?,?), ref: 009C31D8
KillTimer.USER32(?,00000001,?,?,?,?,?,009C316A,?,?), ref: 009C3204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 009C3227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,009C316A,?,?), ref: 009C3232
CreatePopupMenu.USER32 ref: 009C3246
PostQuitMessage.USER32(00000000), ref: 009C3267

Strings

TaskbarCreated, xrefs: 009C322D

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: ebf1c3ddb6b8222482dc158ddd7aa9e54a6b0edf8a3529753c753f440fca79c1
Instruction ID: fe431e987f915b205d3ae3295ae452bb5b31e242d1e35ab0b1e4e29186f5bdc8
Opcode Fuzzy Hash: ebf1c3ddb6b8222482dc158ddd7aa9e54a6b0edf8a3529753c753f440fca79c1
Instruction Fuzzy Hash: ED415731B44305AFDF159BB89D0DFB93A68E749350F08C12EF5128A5A1DB648E029B63

Function 015E89F0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 015E8AC1
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 015E8CE7

Memory Dump Source

Source File: 00000000.00000002.1271287847.00000000015E6000.00000040.00000020.00020000.00000000.sdmp, Offset: 015E6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15e6000_RFQ_AS0101402025.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
Instruction ID: 1388b12842f080ae3624c2165973d35f3d8a51bdd47dfb3308c6d6926ffc3152
Opcode Fuzzy Hash: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
Instruction Fuzzy Hash: EFA1F870E01209EBDF18CFA4C998BEEBBB5BF48304F208559E605BB281D7759A81CF54

Function 009C2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 009C2C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 009C2CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,009C1CAD,?), ref: 009C2CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,009C1CAD,?), ref: 009C2CCF

Strings

AutoIt v3, xrefs: 009C2C89, 009C2C8E, 009C2C8F
edit, xrefs: 009C2CAC

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: b7ebb9e1295f56ac226fa5d3f28befc96cff2ab1765730697186208e386fe01e
Instruction ID: 4205bcda65233e9c7467a8dc28363b28e06f32d5dd2f9027d6208ab620615b63
Opcode Fuzzy Hash: b7ebb9e1295f56ac226fa5d3f28befc96cff2ab1765730697186208e386fe01e
Instruction Fuzzy Hash: 00F030796403917EE77087636C0CE772E7DE7CAF61B00005AF9049A560DA710842DA70

Function 015E87A0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 015E8690: Sleep.KERNELBASE(000001F4), ref: 015E86A1

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 015E88E7

Strings

YZYJP6RQH3SZJMOS8IXOD, xrefs: 015E894A, 015E894D

Memory Dump Source

Source File: 00000000.00000002.1271287847.00000000015E6000.00000040.00000020.00020000.00000000.sdmp, Offset: 015E6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15e6000_RFQ_AS0101402025.jbxd

Similarity

API ID: CreateFileSleep
String ID: YZYJP6RQH3SZJMOS8IXOD
API String ID: 2694422964-2199555300
Opcode ID: ccbffd8ed676ab0e7eb79ed24ac801b010b270470157157926f4779966a75b5d
Instruction ID: f0fb490cfa9040289428d7db4e71a52a464517ac81fdca67a25fdc91ac07b45a
Opcode Fuzzy Hash: ccbffd8ed676ab0e7eb79ed24ac801b010b270470157157926f4779966a75b5d
Instruction Fuzzy Hash: A8518170D04249DBEF15DBA4C858BEEBBB5AF59300F004599E208BB2C1D7B91B44CB66

Function 009C3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,009C3B0F,SwapMouseButtons,00000004,?), ref: 009C3B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,009C3B0F,SwapMouseButtons,00000004,?), ref: 009C3B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,009C3B0F,SwapMouseButtons,00000004,?), ref: 009C3B83

Strings

Control Panel\Mouse, xrefs: 009C3B3E

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 8a8bbd11ad7162330bbcfb3443677db4000455e3f46034f9cc8a57e1ec6e6317
Instruction ID: 7f09e8edf4a8ae40774efe0cc17b512861e79363942806c819e001347f767d6d
Opcode Fuzzy Hash: 8a8bbd11ad7162330bbcfb3443677db4000455e3f46034f9cc8a57e1ec6e6317
Instruction Fuzzy Hash: D51118B5910208FFDB20CFA5DC44EBEB7BCEF04755B10C959B805D7110E2319E419B61

Function 015E7690 Relevance: 6.7, APIs: 4, Instructions: 720
processthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 015E7EBD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 015E7EE1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 015E7F03

Memory Dump Source

Source File: 00000000.00000002.1271287847.00000000015E6000.00000040.00000020.00020000.00000000.sdmp, Offset: 015E6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15e6000_RFQ_AS0101402025.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 0b43d72d38ac188f5e361c01a6572487286e397564ea08694eb873f1bb21aafa
Instruction ID: 94745d35a94fd2c5c2a23a4c47a6c8811838ae02f2ed0f69029b97cb7ba1bdbf
Opcode Fuzzy Hash: 0b43d72d38ac188f5e361c01a6572487286e397564ea08694eb873f1bb21aafa
Instruction Fuzzy Hash: D062FA30E14258DBEB28CBA4C854BDEB7B6FF58300F1095A9D10DEB290E7759E81CB59

Function 009CDFD0 Relevance: 6.7, APIs: 2, Strings: 1, Instructions: 1414COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00A132B7

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: fbf7b2ec48ce7b154225d75bfee6859465c37dc824f2a6139201947d5a29e288
Instruction ID: 7d3e22112da04de7bfd9211ec53615c2d92cd360715034017d2caf42183119c0
Opcode Fuzzy Hash: fbf7b2ec48ce7b154225d75bfee6859465c37dc824f2a6139201947d5a29e288
Instruction Fuzzy Hash: 12C27771E00205DFCB24CF98C881FADB7B5BF48310F24856AE916AB391D775AD81CB92

Function 009C3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00A033A2

Part of subcall function 009C6B57: _wcslen.LIBCMT ref: 009C6B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 009C3A04

Strings

Line: , xrefs: 00A033EB

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: fe6d259aa1bd95caa99c312bdf443d3069d53f3ea52157d3e2f7a65742d46306
Instruction ID: 27333771386d2bc410d8f6d40a991f6bef282e351eac3c12073b3dff2627b4f2
Opcode Fuzzy Hash: fe6d259aa1bd95caa99c312bdf443d3069d53f3ea52157d3e2f7a65742d46306
Instruction Fuzzy Hash: 4731C071908305AAD721EB60DC46FEBB7ECAB80714F00892EF59997191DF749A49C7C3

Function 009DFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 009E0668

Part of subcall function 009E32A4: RaiseException.KERNEL32(?,?,?,009E068A,?,00A91444,?,?,?,?,?,?,009E068A,009C1129,00A88738,009C1129), ref: 009E3304

__CxxThrowException@8.LIBVCRUNTIME ref: 009E0685

Strings

Unknown exception, xrefs: 009E0692

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 39e8fbc6c7b0b0e82ec29ba59dc7864deefbb49a56a23c057a86be3386080285
Instruction ID: 137093a958c5f914c5338f368356304a1a709730c713746eb289a178aeaa35e2
Opcode Fuzzy Hash: 39e8fbc6c7b0b0e82ec29ba59dc7864deefbb49a56a23c057a86be3386080285
Instruction Fuzzy Hash: 83F04C3080028C77CB01B666D84AE5E777D6EC0300BA08531B924D66D1EFB0DE55C6C0

Function 00A47F59 Relevance: 4.9, APIs: 3, Instructions: 430COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,00000067,000000FF,?,?,?), ref: 00A482F5
TerminateProcess.KERNEL32(00000000), ref: 00A482FC
FreeLibrary.KERNEL32(?,?,?,?), ref: 00A484DD

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Process$CurrentFreeLibraryTerminate
String ID:
API String ID: 146820519-0
Opcode ID: a5d33435dee40650ac9ab2244ae2fe335a8148a1202df03bb41c5fca0f1e5661
Instruction ID: 5295acbcd2fed9f6315992aaf634c27abb7251caa08257dd952d55a596b21893
Opcode Fuzzy Hash: a5d33435dee40650ac9ab2244ae2fe335a8148a1202df03bb41c5fca0f1e5661
Instruction Fuzzy Hash: 0A127A75A083019FC724DF28D484B2EBBE1BFC9314F14895DE8998B252DB35ED45CB92

Function 009C10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 009C1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 009C1BF4
Part of subcall function 009C1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 009C1BFC
Part of subcall function 009C1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 009C1C07
Part of subcall function 009C1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 009C1C12
Part of subcall function 009C1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 009C1C1A
Part of subcall function 009C1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 009C1C22

Part of subcall function 009C1B4A: RegisterWindowMessageW.USER32(00000004,?,009C12C4), ref: 009C1BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 009C136A
OleInitialize.OLE32 ref: 009C1388
CloseHandle.KERNEL32(00000000,00000000), ref: 00A024AB

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 592fd95126df036db7e835284fa16e137ef21b2736e0e0fa5c3e9ef6628fe7ae
Instruction ID: 19d93293cb378d88740374891ddc31cba75a4104c8ea034c7c1ed5fe33a96816
Opcode Fuzzy Hash: 592fd95126df036db7e835284fa16e137ef21b2736e0e0fa5c3e9ef6628fe7ae
Instruction Fuzzy Hash: 097189B8F113028FCB85DFB9A985A593AE0BB89394756862FD41AC7362EF304447CF45

Function 009F86AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00000000,?,?,009F85CC,?,00A88CC8,0000000C), ref: 009F8704
GetLastError.KERNEL32(?,009F85CC,?,00A88CC8,0000000C), ref: 009F870E
__dosmaperr.LIBCMT ref: 009F8739

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: ba5afb7bdac6359c3b09d6ba4d76e312840b291c57dc1b30742355806877df7b
Instruction ID: 13335ff76112f6b14670ae1cb9be19b3c59bdfcc823687c8a235a5fae3f84ce5
Opcode Fuzzy Hash: ba5afb7bdac6359c3b09d6ba4d76e312840b291c57dc1b30742355806877df7b
Instruction Fuzzy Hash: 8E012B33605A685AD6A4A2786849B7F678D8BC2779F3A0119FB14CB1D2DEA18C818350

Function 009D1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 009D17F6

Strings

CALL, xrefs: 009D17C6

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 5e440f499a281f398f06208c603e5bbcd4d8e56c097006033de519dee24fb1ee
Instruction ID: c1564ff5f33f168bca3b73131b74399b2e26cf0f78ec93fe25311ccf483399da
Opcode Fuzzy Hash: 5e440f499a281f398f06208c603e5bbcd4d8e56c097006033de519dee24fb1ee
Instruction Fuzzy Hash: 5D229B71648301AFC714CF14C490B6ABBF6BF89314F14895EF4968B3A2D735E985CB92

Function 009C2DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00A02C8C

Part of subcall function 009C3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009C3A97,?,?,009C2E7F,?,?,?,00000000), ref: 009C3AC2

Part of subcall function 009C2DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 009C2DC4

Strings

X, xrefs: 00A02C5A

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: b5e32256e58901fbbfca2730ab8a60b8803fd73b625c3cdda3e0ddd7c039e5ec
Instruction ID: 5cf84e9fec912dccb0c2e769cf5d1a96a75b27dd680d000daca89c2ec6c5b0bf
Opcode Fuzzy Hash: b5e32256e58901fbbfca2730ab8a60b8803fd73b625c3cdda3e0ddd7c039e5ec
Instruction Fuzzy Hash: A5219671E102589FDB01EF94D845BDE7BFCAF88314F008059E405BB281DBB45A498F61

Function 009C3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 009C3908

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: d0e06f09095e26174efcc6789645dc60d12c7a98eea151dbeb45c2b1791dec0e
Instruction ID: 775183347b8a54b40707d88113cf1a84e95a447bd016aab4c72917cf44e92bfe
Opcode Fuzzy Hash: d0e06f09095e26174efcc6789645dc60d12c7a98eea151dbeb45c2b1791dec0e
Instruction Fuzzy Hash: CC31A270A04301DFD761DF64D885B97BBF8FB49758F00492EF59987240E7B1AA44CB52

Function 009C5745 Relevance: 3.1, APIs: 2, Instructions: 56fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,009C949C,?,00008000), ref: 009C5773
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,?,?,009C949C,?,00008000), ref: 00A04052

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c99c421072d15ce6800bfcbb078f6eb3b9c36449444ae7abbbb11b4b2b699d03
Instruction ID: b9f4a78d412f24e5f08458ce8801f81f37ee0c0c1d153d48d70ff7440c859a0c
Opcode Fuzzy Hash: c99c421072d15ce6800bfcbb078f6eb3b9c36449444ae7abbbb11b4b2b699d03
Instruction Fuzzy Hash: E9019230545725BAE3314A6ADC0EF977F98EF067B1F118304BA9C6E1E0CBB46895CB91

Function 009CB710 Relevance: 2.1, APIs: 1, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 009CBB4E

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 442210e12874bf9ddaa750e3a016bfc6c6c528719294cc62e20be45a1d70af43
Instruction ID: b635df9d833d12f77c00529528e7192ab7ec2c4e0f2bf7c288e20a1567fd8566
Opcode Fuzzy Hash: 442210e12874bf9ddaa750e3a016bfc6c6c528719294cc62e20be45a1d70af43
Instruction Fuzzy Hash: C0329B35E00209EFDB24CF54C896FBEB7B9EF44354F14805AE915AB251C7B8AD81CB92

Function 015E768D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 015E7EBD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 015E7EE1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 015E7F03

Memory Dump Source

Source File: 00000000.00000002.1271287847.00000000015E6000.00000040.00000020.00020000.00000000.sdmp, Offset: 015E6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15e6000_RFQ_AS0101402025.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
Instruction ID: 70b5c4b41c2b1efbdd11e6b3398bd0a9608515cdc9f65713ddaa94380b5e3f55
Opcode Fuzzy Hash: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
Instruction Fuzzy Hash: A012EE24E24658C6EB24DF64D8547DEB272FF68300F1090E9910DEB7A4E77A4E81CF5A

Function 00A4709C Relevance: 1.8, APIs: 1, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 36bde61a1d8ae02929fa6021c091054fbf6d0478a1f6a69e881e50a583d8acf9
Instruction ID: df6a000cfef10d638cb7246edcaf9a335b54c85294756563da8c8a77720b60a8
Opcode Fuzzy Hash: 36bde61a1d8ae02929fa6021c091054fbf6d0478a1f6a69e881e50a583d8acf9
Instruction Fuzzy Hash: 58D13B75E04249EFCB14DF98C881EADBBB5FF88314F14815AF915AB291DB30AD81CB91

Function 00A458A2 Relevance: 1.7, APIs: 1, Instructions: 205COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00A45930

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 7cfb6898015ad19d522343f4c7c9fa10b9c4c80223d7c1630a5ea53699d83a5c
Instruction ID: d2ffb33fe59770b663c95bd9db9a4c1ea18ce69943140c1751fe87a62c3b0961
Opcode Fuzzy Hash: 7cfb6898015ad19d522343f4c7c9fa10b9c4c80223d7c1630a5ea53699d83a5c
Instruction Fuzzy Hash: BF71AD38A00605AFCB10DF64C885EBEB7F5FF98340F10856AFA559B282D771AD81CB90

Function 009DFC70 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 009DFD1F

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 1856b2dcdb411be23b18188dab72f43381f7d78edbd8f8eea3e8ad1a42f6e07f
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 21311574A40109DBC718CF69D4A2969F7A6FF49304B24C6A6E84ACB751D731EDD1CBC0

Function 009C4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 009C4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,009C4EDD,?,00A91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009C4E9C
Part of subcall function 009C4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 009C4EAE
Part of subcall function 009C4E90: FreeLibrary.KERNEL32(00000000,?,?,009C4EDD,?,00A91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009C4EC0

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00A91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009C4EFD

Part of subcall function 009C4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00A03CDE,?,00A91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009C4E62
Part of subcall function 009C4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 009C4E74
Part of subcall function 009C4E59: FreeLibrary.KERNEL32(00000000,?,?,00A03CDE,?,00A91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009C4E87

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 7a4e36e821045d67a10ff3c0d01e909f090d76d65ac509e414f098afcbf10a0b
Instruction ID: a4d26a936b433b35caf3809a28a05c1141e6f4e8b18bfe53bf5b7e0ed8c420f3
Opcode Fuzzy Hash: 7a4e36e821045d67a10ff3c0d01e909f090d76d65ac509e414f098afcbf10a0b
Instruction Fuzzy Hash: 29112332B00305AADF10FB60DC22FAD77A5AF84710F10882EF442A71C1EEB0AE459B52

Function 009F8402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 009F8440

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 89e349211f01354c326f8efc4dd79caca478ceb319e9648ca1544029531616e2
Instruction ID: 82d3bca0dc393ade09d53a9b32633d88d2bc5ad3f946b72b3696235e033f9e74
Opcode Fuzzy Hash: 89e349211f01354c326f8efc4dd79caca478ceb319e9648ca1544029531616e2
Instruction Fuzzy Hash: 6C111875A0410EAFCB05DF58E941AAF7BF9EF48314F144059F908AB312DB31DA21CBA5

Function 009F5000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009F4C7D: RtlAllocateHeap.NTDLL(00000008,009C1129,00000000,?,009F2E29,00000001,00000364,?,?,?,009EF2DE,009F3863,00A91444,?,009DFDF5,?), ref: 009F4CBE

_free.LIBCMT ref: 009F506C

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: 19629d796ad52cad25f885e7d826a2521b58b1c5f565d1af7952db553c8a66d4
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: 2A014E722047096BE3318F55D841A6AFBECFBC5370F29051DE398932C0EA706805C774

Function 009C1CD0 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,009C2B12,00A91418,?,?,?,?,?,?,?,009C1CAD,?), ref: 009C1D11

Part of subcall function 009C6B57: _wcslen.LIBCMT ref: 009C6B6A

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: FullNamePath_wcslen
String ID:
API String ID: 4019309064-0
Opcode ID: 40131ffacccb408833a143e7398c73f2c9da4feee9d6c343a38739eea8a8be7e
Instruction ID: 17b9e2913cca3cdf1e7416d1aa859ba6b0fb6e2275234e7509acef124e700e5e
Opcode Fuzzy Hash: 40131ffacccb408833a143e7398c73f2c9da4feee9d6c343a38739eea8a8be7e
Instruction Fuzzy Hash: 23118471E042099ACB11FBA4D905FDD73F8AF88354B0044A9B98AD7291DE70DB848726

Function 009EE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 81f59679942a3fff2f9ba1dd77d2ad901eec2066ac72931f9ab5e44b76e656f4
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 6DF0F432511A5896CA333B6B9C05B6B339C9FD2734F100B15F620932D2DB74EC0187A9

Function 009C9CB3 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 009C9CBD

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: b66f2ccc6a42f866386a2c3f527481c72d49d8aa6e16cad6a22e3b4c4ac6860b
Instruction ID: 3a9a8f6f23d81f4f335f1bba677083fc7b8ac1bd1f13752270fd7ebcb9bb4a13
Opcode Fuzzy Hash: b66f2ccc6a42f866386a2c3f527481c72d49d8aa6e16cad6a22e3b4c4ac6860b
Instruction Fuzzy Hash: 34F0A4B36406006ED7159F29D806F66BB98EB84760F10852EF61ECB2D1DB71E51086A0

Function 009F4C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,009C1129,00000000,?,009F2E29,00000001,00000364,?,?,?,009EF2DE,009F3863,00A91444,?,009DFDF5,?), ref: 009F4CBE

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f42bb316c83909dacd40eebc8348002b3cca46a4e78d31bf0247d334fe9b1341
Instruction ID: d66a902c4d220e2bf3b6cd3af648ae2cadb9b8db88ef16f4bf1f237b2a2b7e23
Opcode Fuzzy Hash: f42bb316c83909dacd40eebc8348002b3cca46a4e78d31bf0247d334fe9b1341
Instruction Fuzzy Hash: 80F0B43164226866DB215F62AC05BFB379CBF817B1B149116BB95AB281CA30DC0197A0

Function 009DDB31 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(00000000,?,00000000,00000000,00000000,?,009C674A,?,00000047,00000000,00000000,?), ref: 009DDB77

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: 3492d5b281e0b97c96566437b9aacb233ee7749f55e30df62d3cf29b4e41e76b
Instruction ID: b60eeb5a55aec1bc250cff483c27b6e77fea1b723d1067409aa20ef3be8f0404
Opcode Fuzzy Hash: 3492d5b281e0b97c96566437b9aacb233ee7749f55e30df62d3cf29b4e41e76b
Instruction Fuzzy Hash: 08F046B1609750AFC7125F24C810F69FFE1EF81724F01821FF04A87A92CB359812CB95

Function 009DDB43 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(00000000,?,00000000,00000000,00000000,?,009C674A,?,00000047,00000000,00000000,?), ref: 009DDB77

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: 99a0cf841b53603f108841a3750fdbbae63f656c2ead61afc12bd19c8ca6cf79
Instruction ID: bdd8eb46759e9286a7a423646f0da5a50020047300c1887d9a63145603b0cc19
Opcode Fuzzy Hash: 99a0cf841b53603f108841a3750fdbbae63f656c2ead61afc12bd19c8ca6cf79
Instruction Fuzzy Hash: 61F0B475641724AFC7115F15C401B29FBE9EF84B65F01C02FF00947641CB799821CBD5

Function 009F3820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00A91444,?,009DFDF5,?,?,009CA976,00000010,00A91440,009C13FC,?,009C13C6,?,009C1129), ref: 009F3852

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cd67f8e9986730b79ee94305c1bee205a2a22169bc943e2d65795282f100027c
Instruction ID: cb60bbcab20059ec9b8df8cb91c5259969e833fd63556daf0c4e4cf28b020ab2
Opcode Fuzzy Hash: cd67f8e9986730b79ee94305c1bee205a2a22169bc943e2d65795282f100027c
Instruction Fuzzy Hash: C9E0E53110026CA6D62226B79D00BBB365CAB827F0F158121BE1596A80DB1DDD0183E0

Function 009C4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00A91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009C4F6D

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 734f272513166dd754053473eb022c1d18a7f268d14e1e6ad919cd3c52e5f2fd
Instruction ID: f9085a4249be326744c756c956ca2bc74e24a8c5f72a646d65238c5a49f00eeb
Opcode Fuzzy Hash: 734f272513166dd754053473eb022c1d18a7f268d14e1e6ad919cd3c52e5f2fd
Instruction Fuzzy Hash: B5F03971A05752CFDB349F65D4A0E22BBE8BF143293208E7EE1EA82621CB359844DF51

Function 00A2CCFF Relevance: 1.5, APIs: 1, Instructions: 26fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,00000000,00000000,?,?,?,?,00A0EE51,00A83630,00000002), ref: 00A2CD26

Part of subcall function 00A2CC37: SetFilePointerEx.KERNEL32(?,00000000,00000000,?,00000001,00000000,?,00000000,?,?,?,00A2CD19,?,?,?), ref: 00A2CC59
Part of subcall function 00A2CC37: SetFilePointerEx.KERNEL32(?,?,00000000,00000000,00000001,?,00A2CD19,?,?,?,?,00A0EE51,00A83630,00000002), ref: 00A2CC6E
Part of subcall function 00A2CC37: SetFilePointerEx.KERNEL32(?,00000000,00000000,?,00000001,?,00A2CD19,?,?,?,?,00A0EE51,00A83630,00000002), ref: 00A2CC7A

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: File$Pointer$Write
String ID:
API String ID: 3847668363-0
Opcode ID: f033ba7646e95046a19c23a617b68082a39cfd8b28ac558290c20c2ed92d5176
Instruction ID: daff12e94d4a905e5d96a8d0666b3271cee550095f231a5d9a9584543ed001ca
Opcode Fuzzy Hash: f033ba7646e95046a19c23a617b68082a39cfd8b28ac558290c20c2ed92d5176
Instruction Fuzzy Hash: 21E06D7A400714EFC7219F8AED008ABBBF8FF84361710853FE996C2110D3B1AA14DB60

Function 009C2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 009C2DC4

Part of subcall function 009C6B57: _wcslen.LIBCMT ref: 009C6B6A

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 7c62105417c82fff15a050078eda3bab117e9eca0e75e385ce54907635e8a4e2
Instruction ID: 81130d36e5d43e7e52ed32135abf5e128a5d4c67661a296463a33e8f790c9176
Opcode Fuzzy Hash: 7c62105417c82fff15a050078eda3bab117e9eca0e75e385ce54907635e8a4e2
Instruction Fuzzy Hash: FDE0CD72A042245BC710E2989C05FDA77DDDFC8790F040075FD09E7248D960AD808551

Function 009C2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 009C3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 009C3908

Part of subcall function 009CD730: GetInputState.USER32 ref: 009CD807

SetCurrentDirectoryW.KERNEL32(?), ref: 009C2B6B

Part of subcall function 009C30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 009C314E

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 2cb0d400916fbf60e58d59a386615c58c750cdf69f424580adb9d08430c0b4c6
Instruction ID: d913f56003291fc7e0c99b96b4fe698ec79b30a8eba331cec3b9b7051e3104a5
Opcode Fuzzy Hash: 2cb0d400916fbf60e58d59a386615c58c750cdf69f424580adb9d08430c0b4c6
Instruction Fuzzy Hash: 38E08662B0434507CA04FB749856F7DB7599BD9361F40953EF146871A2CE2449478253

Function 00A0039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00A00704,?,?,00000000,?,00A00704,00000000,0000000C), ref: 00A003B7

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d0c96af602b3b42ea21f0b8b123e19a5e449e28ad2fcd324ef9661b22758d50e
Instruction ID: 7a7013bd8e8619ee63f63d5531ea2acce1084ae0fbf575596ee8625fcdae9d2c
Opcode Fuzzy Hash: d0c96af602b3b42ea21f0b8b123e19a5e449e28ad2fcd324ef9661b22758d50e
Instruction Fuzzy Hash: D8D06C3204020DBFDF028F84DD06EDA3BAAFB48714F014100BE1856020C732E822AB90

Function 009C1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 009C1CBC

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 52f3d63a0d82a3faf12fbe9cc7ac3ab51eb14286f90a340735dc5b676afb160c
Instruction ID: 8cf4dc8ad14e8c34ca6b48680a8c39a5f4434255fa68067e5bf8a86622928850
Opcode Fuzzy Hash: 52f3d63a0d82a3faf12fbe9cc7ac3ab51eb14286f90a340735dc5b676afb160c
Instruction Fuzzy Hash: 58C0483A3C0305AEE214CBD0AC4AF117764A348B15F448002F609A95E39AA22822EA50

Function 00A3744A Relevance: 1.5, APIs: 1, Instructions: 220COMMON

Download Yara Rule

APIs

Part of subcall function 009C5745: CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,009C949C,?,00008000), ref: 009C5773

GetLastError.KERNEL32(00000002,00000000), ref: 00A376DE

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: 83c0a7f5dc24c80ec080bdbce9b9eeb9abc6cff8396acd661bb70694d83501de
Instruction ID: 35b71432d64cd81f86b9144f665e315f59371f0cfbe5f21c60dd14044de9b26e
Opcode Fuzzy Hash: 83c0a7f5dc24c80ec080bdbce9b9eeb9abc6cff8396acd661bb70694d83501de
Instruction Fuzzy Hash: 03816F706087019FCB24EF28C4A2B6DB7E1BF89354F04456DF8965B2A2DB30AD45CB92

Function 009C6246 Relevance: 1.3, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00000000,00A024E0), ref: 009C6266

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 9bce741943a1d5bdc3d446f1a2881786a990452ff4dfc8ff9e859a26bb3dff8b
Instruction ID: b7de396be6998a60a86ea76d29054865d193fdca3b7030e2c01fe873db3637e9
Opcode Fuzzy Hash: 9bce741943a1d5bdc3d446f1a2881786a990452ff4dfc8ff9e859a26bb3dff8b
Instruction Fuzzy Hash: 3AE09975800B01CEC3318F1AE804912FBE9FFE13623208A2ED0F692660D3B0688A8B51

Function 015E8690 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 015E86A1

Memory Dump Source

Source File: 00000000.00000002.1271287847.00000000015E6000.00000040.00000020.00020000.00000000.sdmp, Offset: 015E6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15e6000_RFQ_AS0101402025.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 86d8dd3b7313a8b7f68243c253d955783a78a936b881a139774ca0ad8f04a4e1
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: C0E0BF7494010D9FDB00EFA4D54969E7BB4EF04301F100165FD0192281D6309E508A62

Non-executed Functions

Function 00A59576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 009D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009D9BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00A5961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00A5965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00A5969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00A596C9
SendMessageW.USER32 ref: 00A596F2
GetKeyState.USER32(00000011), ref: 00A5978B
GetKeyState.USER32(00000009), ref: 00A59798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00A597AE
GetKeyState.USER32(00000010), ref: 00A597B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00A597E9
SendMessageW.USER32 ref: 00A59810
SendMessageW.USER32(?,00001030,?,00A57E95), ref: 00A59918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00A5992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00A59941
SetCapture.USER32(?), ref: 00A5994A
ClientToScreen.USER32(?,?), ref: 00A599AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00A599BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00A599D6
ReleaseCapture.USER32 ref: 00A599E1
GetCursorPos.USER32(?), ref: 00A59A19
ScreenToClient.USER32(?,?), ref: 00A59A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00A59A80
SendMessageW.USER32 ref: 00A59AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00A59AEB
SendMessageW.USER32 ref: 00A59B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00A59B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00A59B4A
GetCursorPos.USER32(?), ref: 00A59B68
ScreenToClient.USER32(?,?), ref: 00A59B75
GetParent.USER32(?), ref: 00A59B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00A59BFA
SendMessageW.USER32 ref: 00A59C2B
ClientToScreen.USER32(?,?), ref: 00A59C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00A59CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00A59CDE
SendMessageW.USER32 ref: 00A59D01
ClientToScreen.USER32(?,?), ref: 00A59D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00A59D82

Part of subcall function 009D9944: GetWindowLongW.USER32(?,000000EB), ref: 009D9952

GetWindowLongW.USER32(?,000000F0), ref: 00A59E05

Strings

F, xrefs: 00A59D07
@GUI_DRAGID, xrefs: 00A5997D

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: 477ba9914df13e2c76e82eac8e9488c1592cfb70f7b441f721329656530cba05
Instruction ID: b157d48536fc23fac54bba36084730a8d08485f4d1c636a8a5795a0f34f45155
Opcode Fuzzy Hash: 477ba9914df13e2c76e82eac8e9488c1592cfb70f7b441f721329656530cba05
Instruction Fuzzy Hash: 7C429C70204301EFDB21CF64CD44BABBBE5FF48321F100A1AFA998B6A1D731A959DB41

Function 00A54873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 00A548F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00A54908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00A54927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 00A5494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 00A5495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 00A5497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 00A549AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 00A549D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00A54A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00A54A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00A54A7E
IsMenu.USER32(?), ref: 00A54A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00A54AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00A54B20
GetWindowLongW.USER32(?,000000F0), ref: 00A54B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00A54BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00A54C82
wsprintfW.USER32 ref: 00A54CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00A54CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00A54CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00A54D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00A54D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00A54D5A

Strings

%d/%02d/%02d, xrefs: 00A54CA8

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: dfee4f0415039ab3690e922ed241921ed6b18890366f0a88db50f92598573a62
Instruction ID: 6d011859bd0b53c2d17dc7a7f11ac9e86c2b4ff32689212c8a93c7d54847fcf3
Opcode Fuzzy Hash: dfee4f0415039ab3690e922ed241921ed6b18890366f0a88db50f92598573a62
Instruction Fuzzy Hash: 9612FF71600304ABEB248F68CC49FAE7BB8FF89715F104119F916DA2A1D7789A89CB50

Function 009DF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 009DF998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00A1F474
IsIconic.USER32(00000000), ref: 00A1F47D
ShowWindow.USER32(00000000,00000009), ref: 00A1F48A
SetForegroundWindow.USER32(00000000), ref: 00A1F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00A1F4AA
GetCurrentThreadId.KERNEL32 ref: 00A1F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00A1F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 00A1F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 00A1F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 00A1F4DE
SetForegroundWindow.USER32(00000000), ref: 00A1F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 00A1F4F6
keybd_event.USER32(00000012,00000000), ref: 00A1F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 00A1F50B
keybd_event.USER32(00000012,00000000), ref: 00A1F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 00A1F519
keybd_event.USER32(00000012,00000000), ref: 00A1F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 00A1F528
keybd_event.USER32(00000012,00000000), ref: 00A1F52D
SetForegroundWindow.USER32(00000000), ref: 00A1F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 00A1F557

Strings

Shell_TrayWnd, xrefs: 00A1F46F

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 30fda21bc841c4dd628ed4c0504131f45447746d4ab5e16c0f8f4c4313af71a9
Instruction ID: ef30cebe8fa36e606d331dd529870a0ab961f8863b57b734cac50489cc8a7c1f
Opcode Fuzzy Hash: 30fda21bc841c4dd628ed4c0504131f45447746d4ab5e16c0f8f4c4313af71a9
Instruction Fuzzy Hash: 6F317271A80318BFEB21ABF55C4AFBF7E6DFB44B61F100065FA01E61D1D6B05D41AAA0

Function 00A21201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00A216C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00A2170D
Part of subcall function 00A216C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00A2173A
Part of subcall function 00A216C3: GetLastError.KERNEL32 ref: 00A2174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00A21286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00A212A8
CloseHandle.KERNEL32(?), ref: 00A212B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00A212D1
GetProcessWindowStation.USER32 ref: 00A212EA
SetProcessWindowStation.USER32(00000000), ref: 00A212F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00A21310

Part of subcall function 00A210BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00A211FC), ref: 00A210D4
Part of subcall function 00A210BF: CloseHandle.KERNEL32(?,?,00A211FC), ref: 00A210E9

Strings

winsta0, xrefs: 00A212CC
, xrefs: 00A2125A
default, xrefs: 00A2130B

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: a8c4b3944a300617dedf5d1965f97f8764f73b6d4c64385c07f0a9f495cad01f
Instruction ID: b89935e611fceeba11749a2de2f3141587dced50b2e2dddd547148f0d481bf5e
Opcode Fuzzy Hash: a8c4b3944a300617dedf5d1965f97f8764f73b6d4c64385c07f0a9f495cad01f
Instruction Fuzzy Hash: 46817BB1A00319AFDF21EFA8EC49BEE7BB9FF04715F144129F915A61A0D7318A45CB60

Function 00A20B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A210F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00A21114
Part of subcall function 00A210F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00A20B9B,?,?,?), ref: 00A21120
Part of subcall function 00A210F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00A20B9B,?,?,?), ref: 00A2112F
Part of subcall function 00A210F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00A20B9B,?,?,?), ref: 00A21136
Part of subcall function 00A210F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00A2114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00A20BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00A20C00
GetLengthSid.ADVAPI32(?), ref: 00A20C17
GetAce.ADVAPI32(?,00000000,?), ref: 00A20C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00A20C6D
GetLengthSid.ADVAPI32(?), ref: 00A20C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00A20C8C
HeapAlloc.KERNEL32(00000000), ref: 00A20C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00A20CB4
CopySid.ADVAPI32(00000000), ref: 00A20CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00A20CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00A20D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00A20D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A20D45
HeapFree.KERNEL32(00000000), ref: 00A20D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A20D55
HeapFree.KERNEL32(00000000), ref: 00A20D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A20D65
HeapFree.KERNEL32(00000000), ref: 00A20D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00A20D78
HeapFree.KERNEL32(00000000), ref: 00A20D7F

Part of subcall function 00A21193: GetProcessHeap.KERNEL32(00000008,00A20BB1,?,00000000,?,00A20BB1,?), ref: 00A211A1
Part of subcall function 00A21193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00A20BB1,?), ref: 00A211A8
Part of subcall function 00A21193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00A20BB1,?), ref: 00A211B7

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 142d8ee716ac113be4dd55da1619efa903a442f0d406013106387ebf4ce7b07c
Instruction ID: 654301a1b1cdf3eee7568b1f6d23c56689028ffb2af4688341c5b2a38ecb1819
Opcode Fuzzy Hash: 142d8ee716ac113be4dd55da1619efa903a442f0d406013106387ebf4ce7b07c
Instruction Fuzzy Hash: 73713A7190132AAFDF10DFE8EC44FAEBBB8BF04311F144625E915A6192D771A906CF60

Function 00A3EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00A5CC08), ref: 00A3EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 00A3EB37
GetClipboardData.USER32(0000000D), ref: 00A3EB43
CloseClipboard.USER32 ref: 00A3EB4F
GlobalLock.KERNEL32(00000000), ref: 00A3EB87
CloseClipboard.USER32 ref: 00A3EB91
GlobalUnlock.KERNEL32(00000000), ref: 00A3EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 00A3EBC9
GetClipboardData.USER32(00000001), ref: 00A3EBD1
GlobalLock.KERNEL32(00000000), ref: 00A3EBE2
GlobalUnlock.KERNEL32(00000000), ref: 00A3EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 00A3EC38
GetClipboardData.USER32(0000000F), ref: 00A3EC44
GlobalLock.KERNEL32(00000000), ref: 00A3EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00A3EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00A3EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00A3ECD2
GlobalUnlock.KERNEL32(00000000), ref: 00A3ECF3
CountClipboardFormats.USER32 ref: 00A3ED14
CloseClipboard.USER32 ref: 00A3ED59

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 7f09664d53b06bb57596f25074de3dcb31f44b2466a778c3e23657aa398be18b
Instruction ID: 34fbf24ac82c78d024f983d4842a55e289694efd628580e6f56d50aacbe297aa
Opcode Fuzzy Hash: 7f09664d53b06bb57596f25074de3dcb31f44b2466a778c3e23657aa398be18b
Instruction Fuzzy Hash: 6561AB34204301AFD300EF64D899F6AB7A8BF84764F14855DF4569B2E2CB31ED46CBA2

Function 00A3698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00A369BE
FindClose.KERNEL32(00000000), ref: 00A36A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00A36A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00A36A75

Part of subcall function 009C9CB3: _wcslen.LIBCMT ref: 009C9CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00A36AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00A36ADF

Strings

%02d, xrefs: 00A36C00, 00A36C0A, 00A36C5A, 00A36CAA, 00A36CFA, 00A36D4A
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00A36B32
%03d, xrefs: 00A36DA2
%4d%02d%02d%02d%02d%02d, xrefs: 00A36B6A
%4d, xrefs: 00A36BB1

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 7c76f8c9018e9dd85c8037cf113df786f9e2bb0ac0a1860911d3a053b889665a
Instruction ID: ae8354c9fda06661d9ea636d026f3aac5514afe73d5f45d82bd1aa5c43c55f3b
Opcode Fuzzy Hash: 7c76f8c9018e9dd85c8037cf113df786f9e2bb0ac0a1860911d3a053b889665a
Instruction Fuzzy Hash: 28D13E72908340AFC710EBA4D996FABB7E8AF88704F04491DF589D6191EB74DA44CB62

Function 00A39642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 00A39663
GetFileAttributesW.KERNEL32(?), ref: 00A396A1
SetFileAttributesW.KERNEL32(?,?), ref: 00A396BB
FindNextFileW.KERNEL32(00000000,?), ref: 00A396D3
FindClose.KERNEL32(00000000), ref: 00A396DE
FindFirstFileW.KERNEL32(*.*,?), ref: 00A396FA
SetCurrentDirectoryW.KERNEL32(?), ref: 00A3974A
SetCurrentDirectoryW.KERNEL32(00A86B7C), ref: 00A39768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00A39772
FindClose.KERNEL32(00000000), ref: 00A3977F
FindClose.KERNEL32(00000000), ref: 00A3978F

Strings

*.*, xrefs: 00A396F5

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 2d821c0f5210965fa5a034f7c4c69c74bf00a524e1ae152af65fee6c58ac1c8a
Instruction ID: 69f828b8d6d81c4963f436a04e0a295d3a66f88f9f83bd74bb2bcfebcdad8f15
Opcode Fuzzy Hash: 2d821c0f5210965fa5a034f7c4c69c74bf00a524e1ae152af65fee6c58ac1c8a
Instruction Fuzzy Hash: 9C31AB3264171A7EDB10EFB4DC49AEF77ACAF49331F104166F915E21A0EBB4DE458A20

Function 00A3979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 00A397BE
FindNextFileW.KERNEL32(00000000,?), ref: 00A39819
FindClose.KERNEL32(00000000), ref: 00A39824
FindFirstFileW.KERNEL32(*.*,?), ref: 00A39840
SetCurrentDirectoryW.KERNEL32(?), ref: 00A39890
SetCurrentDirectoryW.KERNEL32(00A86B7C), ref: 00A398AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00A398B8
FindClose.KERNEL32(00000000), ref: 00A398C5
FindClose.KERNEL32(00000000), ref: 00A398D5

Part of subcall function 00A2DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00A2DB00

Strings

*.*, xrefs: 00A3983B

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 4f4445430a492298e637714712c12b56a80b962a1c0a3201ee452b95e0cb8608
Instruction ID: 45cdfbd4729cf8a604bcc75ab81d94b60a348eb46ef99db182f7c547fa5e59ed
Opcode Fuzzy Hash: 4f4445430a492298e637714712c12b56a80b962a1c0a3201ee452b95e0cb8608
Instruction Fuzzy Hash: CA31AE3254071A7EEB10EFA4EC48ADF77ACAF86335F104565F914A21A1DBB0DE85CA60

Function 00A38195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00A38257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00A38267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00A38273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00A38310
SetCurrentDirectoryW.KERNEL32(?), ref: 00A38324
SetCurrentDirectoryW.KERNEL32(?), ref: 00A38356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00A3838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00A38395

Strings

*.*, xrefs: 00A3839B

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: e33b5a944085179654e49efb61a0ea4e1338e365bb77158375b011179fc0a37b
Instruction ID: 3522f84bf16a1b8165ca86eddcd672524166c7b9d91ad70224363dd223f2bf20
Opcode Fuzzy Hash: e33b5a944085179654e49efb61a0ea4e1338e365bb77158375b011179fc0a37b
Instruction Fuzzy Hash: 0B6169B25043459FC710EF64C841AAEB3E8FF89324F04892EF99997251DB35E945CB92

Function 00A2D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009C3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009C3A97,?,?,009C2E7F,?,?,?,00000000), ref: 009C3AC2

Part of subcall function 00A2E199: GetFileAttributesW.KERNEL32(?,00A2CF95), ref: 00A2E19A

FindFirstFileW.KERNEL32(?,?), ref: 00A2D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00A2D1DD
MoveFileW.KERNEL32(?,?), ref: 00A2D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 00A2D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 00A2D237

Part of subcall function 00A2D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00A2D21C,?,?), ref: 00A2D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 00A2D253
FindClose.KERNEL32(00000000), ref: 00A2D264

Strings

\*.*, xrefs: 00A2D0CD, 00A2D0D6, 00A2D0EB

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: a0adf9dc6da31440b9561c44d1620e20d1b21802de7ed466ad06daf0874fed61
Instruction ID: a8152690841d442b4e9df22ddbc56aebf67652ce227d7a30c24faef213853fa4
Opcode Fuzzy Hash: a0adf9dc6da31440b9561c44d1620e20d1b21802de7ed466ad06daf0874fed61
Instruction Fuzzy Hash: E8611931C0125DAECF05EBA4EA52EEDB7B5AF55300F248169E40277192EB30AF09CB61

Function 00A3ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00A3ED91
EmptyClipboard.USER32 ref: 00A3ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 00A3EDAC
CloseClipboard.USER32 ref: 00A3EEA3

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: ac0692ea9c6c9f34ef0616cae4c8ee075f1f754e4f32c581b25ca5969bbf1e7c
Instruction ID: 07336cedf468108a8d49b9222a29bc719c4a4e6c5a821ae80ebaff27cfd72392
Opcode Fuzzy Hash: ac0692ea9c6c9f34ef0616cae4c8ee075f1f754e4f32c581b25ca5969bbf1e7c
Instruction Fuzzy Hash: AA418935604611AFE320DF55D888F2ABBA5FF44329F148099F4198BAA2C735ED42CB91

Function 00A2E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00A216C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00A2170D
Part of subcall function 00A216C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00A2173A
Part of subcall function 00A216C3: GetLastError.KERNEL32 ref: 00A2174A

ExitWindowsEx.USER32(?,00000000), ref: 00A2E932

Strings

, xrefs: 00A2E920
, xrefs: 00A2E95C
@, xrefs: 00A2E925
SeShutdownPrivilege, xrefs: 00A2E902

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 9d2664f8931109b18d803261d7bd68069d11dec6121d4c785357c3cfa4c08c4b
Instruction ID: a097e4ba8196377d7b2abc43ca4cce4ed92629b4b8ef590321bcb9c40e60ae1f
Opcode Fuzzy Hash: 9d2664f8931109b18d803261d7bd68069d11dec6121d4c785357c3cfa4c08c4b
Instruction Fuzzy Hash: 7E01D672610331AFEB54A7BCBC8ABBFB26CA714751F150833F812E21D1E5A05CC48294

Function 00A41204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006), ref: 00A41276
WSAGetLastError.WSOCK32 ref: 00A41283
bind.WSOCK32(00000000,?,00000010), ref: 00A412BA
WSAGetLastError.WSOCK32 ref: 00A412C5
closesocket.WSOCK32(00000000), ref: 00A412F4
listen.WSOCK32(00000000,00000005), ref: 00A41303
WSAGetLastError.WSOCK32 ref: 00A4130D
closesocket.WSOCK32(00000000), ref: 00A4133C

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 4bd7755cf7e523ec657782c0e57c5042537adf990a82adb3510937dbdd758e63
Instruction ID: 167829208d6dd41ae78f306b6c916a70d4a79f8ac1e8b2856e9ee8ef9dda04ec
Opcode Fuzzy Hash: 4bd7755cf7e523ec657782c0e57c5042537adf990a82adb3510937dbdd758e63
Instruction Fuzzy Hash: 0C417275A002409FD710DF64C489B69BBE5BF86328F18819CE8569F396C771ED82CBE1

Function 009FB952 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 009FB9D4
_free.LIBCMT ref: 009FB9F8
_free.LIBCMT ref: 009FBB7F
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00A63700), ref: 009FBB91
WideCharToMultiByte.KERNEL32(00000000,00000000,00A9121C,000000FF,00000000,0000003F,00000000,?,?), ref: 009FBC09
WideCharToMultiByte.KERNEL32(00000000,00000000,00A91270,000000FF,?,0000003F,00000000,?), ref: 009FBC36
_free.LIBCMT ref: 009FBD4B

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: 60e1896c584cdcb4f5230a9611cc015cd16a863869cb497e4dde9c6a0e29ac7f
Instruction ID: d59f4073d46c9b6f53ab75979351468c1436e3ff9c4cbe3aab4f73ec656b6df2
Opcode Fuzzy Hash: 60e1896c584cdcb4f5230a9611cc015cd16a863869cb497e4dde9c6a0e29ac7f
Instruction Fuzzy Hash: 93C10671A0420DAFCB20EF69DC41BBA7BEDEF85350F2441AAE694D7251EB709E428750

Function 00A2D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009C3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009C3A97,?,?,009C2E7F,?,?,?,00000000), ref: 009C3AC2

Part of subcall function 00A2E199: GetFileAttributesW.KERNEL32(?,00A2CF95), ref: 00A2E19A

FindFirstFileW.KERNEL32(?,?), ref: 00A2D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 00A2D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 00A2D481
FindClose.KERNEL32(00000000), ref: 00A2D498
FindClose.KERNEL32(00000000), ref: 00A2D4A1

Strings

\*.*, xrefs: 00A2D3F2

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: c7469ce57568b29b69261da8dd19caf90a37b29d7e10dec24b291ca950d3315a
Instruction ID: 1a2635f24d7a2f0f05c52697eb0641137cf940c103b45b0522d0b1853d3e03a7
Opcode Fuzzy Hash: c7469ce57568b29b69261da8dd19caf90a37b29d7e10dec24b291ca950d3315a
Instruction Fuzzy Hash: BE316F714083559FC204FF64D855EAFB7A8BED5314F444A2DF4D153192EB30AA09C763

Function 009FE4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 009FE645

Strings

1#QNAN, xrefs: 009FF84B
1#IND, xrefs: 009FF83D
1#INF, xrefs: 009FF852
1#SNAN, xrefs: 009FF844

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 44d8c7ebd99126d65a9e1878fbd77813cf04edf552509ab32058ca31404a2d9c
Instruction ID: 9ee8ecbdee97ee5ad6dd719eda6a97f2c26b511b490b6b70183d5369c8b62cc8
Opcode Fuzzy Hash: 44d8c7ebd99126d65a9e1878fbd77813cf04edf552509ab32058ca31404a2d9c
Instruction Fuzzy Hash: 55C24971E0862C8FDB25CE289D507EAB7B9EF84305F1445EAD54EE7250E778AE818F40

Function 00A3648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A364DC
CoInitialize.OLE32(00000000), ref: 00A36639
CoCreateInstance.OLE32(00A5FCF8,00000000,00000001,00A5FB68,?), ref: 00A36650
CoUninitialize.OLE32 ref: 00A368D4

Strings

.lnk, xrefs: 00A364BA, 00A36524, 00A365E0

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 0f1fbe0687d6e0d7e96138441be5871e5c87bf4e1af97013e01a8048c49d0bcc
Instruction ID: 5a832b6a587d3c4e72e340468025c3284a23c934c262b518846063b5baa9efb3
Opcode Fuzzy Hash: 0f1fbe0687d6e0d7e96138441be5871e5c87bf4e1af97013e01a8048c49d0bcc
Instruction Fuzzy Hash: 43D11771908301AFD314EF24C881E6BB7E9BFD9704F10896DF5958B291EB71E905CB92

Function 00A422DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 00A422E8

Part of subcall function 00A3E4EC: GetWindowRect.USER32(?,?), ref: 00A3E504

GetDesktopWindow.USER32 ref: 00A42312
GetWindowRect.USER32(00000000), ref: 00A42319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00A42355
GetCursorPos.USER32(?), ref: 00A42381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00A423DF

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: aca93e918b39f9e1bd3b7d8215d459e6fb7bd2057edb58c0b0b4a0f6cfa040a7
Instruction ID: 8d2efbc7b8d8a1734a44461e6d80303c65457cdd55c5a6652ecef1f400b5bc7d
Opcode Fuzzy Hash: aca93e918b39f9e1bd3b7d8215d459e6fb7bd2057edb58c0b0b4a0f6cfa040a7
Instruction Fuzzy Hash: D831DE72504315AFC720DF58D849B5BBBA9FFC8724F400919F9859B181DB34EA49CB92

Function 00A39B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 009C9CB3: _wcslen.LIBCMT ref: 009C9CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00A39B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00A39C8B

Part of subcall function 00A33874: GetInputState.USER32 ref: 00A338CB
Part of subcall function 00A33874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00A33966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00A39BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00A39C75

Strings

*.*, xrefs: 00A39B5D

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: cc45aec08692460b6e2091cf13b130bafedaaa1cbc05c9c920df23f2173ed7bb
Instruction ID: 92b9558bfae39e9b516b9c3da1391b4c6b087ea906d8a260565010628508e208
Opcode Fuzzy Hash: cc45aec08692460b6e2091cf13b130bafedaaa1cbc05c9c920df23f2173ed7bb
Instruction Fuzzy Hash: A441717190420AAFDF54DFA4C989BEEBBB4FF45311F144159F805A2191EB709E84CF61

Function 009D997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 009D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009D9BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 009D9A4E
GetSysColor.USER32(0000000F), ref: 009D9B23
SetBkColor.GDI32(?,00000000), ref: 009D9B36

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 319ced3f1d92149f6f718a23a84434063dd792241ef881eab1416d8232055b56
Instruction ID: 5c624851f5d29ae2aeac676617d0a220ed45519b43ff96f02ad62f9e1c991ddb
Opcode Fuzzy Hash: 319ced3f1d92149f6f718a23a84434063dd792241ef881eab1416d8232055b56
Instruction Fuzzy Hash: 24A13971288500BEE724FB3C8D98EBF26ADEB82350F15860BF412DA7D1DA299D41D271

Function 00A41806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00A4304E: inet_addr.WSOCK32(?), ref: 00A4307A
Part of subcall function 00A4304E: _wcslen.LIBCMT ref: 00A4309B

socket.WSOCK32(00000002,00000002,00000011), ref: 00A4185D
WSAGetLastError.WSOCK32 ref: 00A41884
bind.WSOCK32(00000000,?,00000010), ref: 00A418DB
WSAGetLastError.WSOCK32 ref: 00A418E6
closesocket.WSOCK32(00000000), ref: 00A41915

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 7b25e6288f6edbead8dc263627a364996c76886c229259e213d56c48d1b54d0d
Instruction ID: 0c78bef5a3078d6c71a33f0bc32ed4873522c888702bfed3e64fa736d917aaea
Opcode Fuzzy Hash: 7b25e6288f6edbead8dc263627a364996c76886c229259e213d56c48d1b54d0d
Instruction Fuzzy Hash: FC519375A00210AFDB10EF64C886F6A7BE5ABC4718F18845CF9169F3D3D771AD428BA1

Function 00A51C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00A51CC0
IsWindowEnabled.USER32 ref: 00A51CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00A51CDB
IsIconic.USER32 ref: 00A51CE9
IsZoomed.USER32 ref: 00A51CF7

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 635fd9237e847e943eca6083ab0396d048b00b718c2106cb4826e5ea5c404713
Instruction ID: c0125303c030cbaf24b9553683056782118f3505dfb67d6ce56b32fdd7ec40bb
Opcode Fuzzy Hash: 635fd9237e847e943eca6083ab0396d048b00b718c2106cb4826e5ea5c404713
Instruction Fuzzy Hash: 7C219F317402105FD7208F2AC884F7A7BA5FF95326B19806CEC4A8B351DB72ED46CB90

Function 009C8060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00A05DF0
VUUU, xrefs: 009C83E8
ERCP, xrefs: 009C813C
VUUU, xrefs: 009C843C
VUUU, xrefs: 009C83FA

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 5376986294125546684860a00b456a9662a3e14ef719e96281b865c546aa354a
Instruction ID: f5efd05ac55e0431ac499be39a83721075b08bde946301c2cdb0936d3bcacff7
Opcode Fuzzy Hash: 5376986294125546684860a00b456a9662a3e14ef719e96281b865c546aa354a
Instruction Fuzzy Hash: ECA2AE70E0061ECBDF24CF58D944BAEB7B1BF44314F2485AAE815AB281EB749D91CF91

Function 00A4A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00A4A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 00A4A6BA

Part of subcall function 009C9CB3: _wcslen.LIBCMT ref: 009C9CBD

Process32NextW.KERNEL32(00000000,?), ref: 00A4A79C
CloseHandle.KERNEL32(00000000), ref: 00A4A7AB

Part of subcall function 009DCE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00A03303,?), ref: 009DCE8A

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 5039281a362e7a7ff86f926059c0e9b1f9f698590dbdf99638c64f30a90f74e6
Instruction ID: b810c9ba41773712b269a67a0cd7eabf4b837221e67ae634a78418a7ec20bf92
Opcode Fuzzy Hash: 5039281a362e7a7ff86f926059c0e9b1f9f698590dbdf99638c64f30a90f74e6
Instruction Fuzzy Hash: A851F6B59083009FD710EF64C886E6ABBE8FFC9754F40891DF59697251EB30D905CBA2

Function 00A2AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00A2AAAC
SetKeyboardState.USER32(00000080), ref: 00A2AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00A2AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00A2AB88

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 352894fe17361fc0ef1be3469246147194f32101e27495e78efacc611be55e9c
Instruction ID: e31a651f3a505ad3007a73768f882728630f25146ef49ccbe8d6539e680cd1b7
Opcode Fuzzy Hash: 352894fe17361fc0ef1be3469246147194f32101e27495e78efacc611be55e9c
Instruction Fuzzy Hash: 9A311670A40328AFFB35CB6CAC05BFA7BA6EF64320F04422AF181961D0D3758D85C762

Function 00A3CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 00A3CE89
GetLastError.KERNEL32(?,00000000), ref: 00A3CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 00A3CEFE

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 5ac76fb2c677d463c803ab82cf68b14050c81eb85da9c188a703d3d8a07ae4dd
Instruction ID: 50e5ec45acd4e5b88a96b8d3c66326f1de4c16a34fb12563eb55f86c4d9b7acd
Opcode Fuzzy Hash: 5ac76fb2c677d463c803ab82cf68b14050c81eb85da9c188a703d3d8a07ae4dd
Instruction Fuzzy Hash: AD219AB1500705AFEB20DFA5CD48BAAB7F8EB40769F20442EF546A2151EB70EE058B64

Function 00A2DBBE Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00A05222), ref: 00A2DBCE
GetFileAttributesW.KERNEL32(?), ref: 00A2DBDD
FindFirstFileW.KERNEL32(?,?), ref: 00A2DBEE
FindClose.KERNEL32(00000000), ref: 00A2DBFA

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 7f4bd370aad110f1053809aa16aede7ef7b10ddc4b8b5111761c91639fdbd277
Instruction ID: bc931b951e21ddb5f2d829da2ecda9c42bc82696dba2f77b6af81fca00cfc9a1
Opcode Fuzzy Hash: 7f4bd370aad110f1053809aa16aede7ef7b10ddc4b8b5111761c91639fdbd277
Instruction Fuzzy Hash: 84F0A030810B206BC220BBBCAC0D8AE376CAE01336B104712F836D24E1FBB05956C696

Function 00A28298 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00A282AA

Strings

|, xrefs: 00A282DA
(, xrefs: 00A282F0

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: dde0692b8748766157cb683a25db5d622a938fe4819daaf7d679db54298bd70f
Instruction ID: c30edc5f7c36fe4ab0310ba1a7cc2f67d04157b58803a2a6b243b5f3f96744ba
Opcode Fuzzy Hash: dde0692b8748766157cb683a25db5d622a938fe4819daaf7d679db54298bd70f
Instruction Fuzzy Hash: 71324474A016159FCB28CF19D081AAAB7F0FF48710B15C46EE49ADB7A1EB74E981CB40

Function 00A35C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00A35CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00A35D17
FindClose.KERNEL32(?), ref: 00A35D5F

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 21c1961f501190d1677fc287c8197a5edbf27f9112046ea7c1f2a0c920e22418
Instruction ID: 843bc951f63e281be04f50c2d04b045958ecd34189a031676dfa68b8707ca666
Opcode Fuzzy Hash: 21c1961f501190d1677fc287c8197a5edbf27f9112046ea7c1f2a0c920e22418
Instruction Fuzzy Hash: 27514374A04A019FC714DF28C494E9AB7E4FF49324F14855EF9AA8B3A2DB30ED45CB91

Function 009F2622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 009F271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 009F2724
UnhandledExceptionFilter.KERNEL32(?), ref: 009F2731

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 670b4371b94d2c026e5f37b352e2877006f27edaf8f9a742a6c0eb19402abd4a
Instruction ID: f77fdf9337835019c9b0a93240542720dafb05548d7db8c0ad470046271895db
Opcode Fuzzy Hash: 670b4371b94d2c026e5f37b352e2877006f27edaf8f9a742a6c0eb19402abd4a
Instruction Fuzzy Hash: 5231C27490131CABCB21DF69D98979CBBB8AF58320F5041EAE80CA7260E7709F818F45

Function 00A351CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00A351DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00A35238
SetErrorMode.KERNEL32(00000000), ref: 00A352A1

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 3b62a7ff7545e44cc3a0fc21049c9e3724f88a6d3f26014f29611e009a39bbab
Instruction ID: 401f78593b5ece97299e8e419b5ab941c507633b0009c783d7be652274424c64
Opcode Fuzzy Hash: 3b62a7ff7545e44cc3a0fc21049c9e3724f88a6d3f26014f29611e009a39bbab
Instruction Fuzzy Hash: 06312B75A006189FDB00DFA4D884FAEBBB4FF49314F048099E805AB366DB35E956CB91

Function 00A216C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 009DFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 009E0668
Part of subcall function 009DFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 009E0685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00A2170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00A2173A
GetLastError.KERNEL32 ref: 00A2174A

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 46b8fec611c8233572c524197b62152724306a6cf49618b1cb825957da480efb
Instruction ID: 700ce778d0871eda04c89d5aa5db9f829ee40061e1ef3c1a6a7129f7d3c4fcd1
Opcode Fuzzy Hash: 46b8fec611c8233572c524197b62152724306a6cf49618b1cb825957da480efb
Instruction Fuzzy Hash: F41191B2404304AFD718DF54EC86E6BB7B9FB44725B20852EE05657681EB70BC418A60

Function 00A2D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00A2D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00A2D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00A2D650

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: beb8c235876fc4ffc94ec77157e2225d59c057d283add7e22fd9020a4c74e60f
Instruction ID: 3d3e8cef661f88099ea1427e14354b5862b182d2c087798713f4a86d8c45bc4a
Opcode Fuzzy Hash: beb8c235876fc4ffc94ec77157e2225d59c057d283add7e22fd9020a4c74e60f
Instruction Fuzzy Hash: A0113C75E05328BFDB108F99AC45FAFBBBCEB45B60F108125F914E7294D6704A058BA1

Function 00A21663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00A2168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00A216A1
FreeSid.ADVAPI32(?), ref: 00A216B1

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 743bb6fae49a8533dc42149d96997540ff72f77e900bcf155124540f0c6992ef
Instruction ID: 72f1d8ad2cccd77c29cea12b87ef8914b18b658387eef191875935cdcc001690
Opcode Fuzzy Hash: 743bb6fae49a8533dc42149d96997540ff72f77e900bcf155124540f0c6992ef
Instruction Fuzzy Hash: 4EF0FF71950309FFEB00DFE49C89AAEBBBDFB08615F5049A5E901E2181E774AA448A60

Function 009E4CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(009F28E9,?,009E4CBE,009F28E9,00A888B8,0000000C,009E4E15,009F28E9,00000002,00000000,?,009F28E9), ref: 009E4D09
TerminateProcess.KERNEL32(00000000,?,009E4CBE,009F28E9,00A888B8,0000000C,009E4E15,009F28E9,00000002,00000000,?,009F28E9), ref: 009E4D10
ExitProcess.KERNEL32 ref: 009E4D22

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 12579284f3c9ec7c83ffbe7afb4c6a51bc1ee7b6917c32a84e51c403b1412226
Instruction ID: 4ad03534369f76da276148f9964563616d9b58fb31af7a4e5f86cb81b9197d33
Opcode Fuzzy Hash: 12579284f3c9ec7c83ffbe7afb4c6a51bc1ee7b6917c32a84e51c403b1412226
Instruction Fuzzy Hash: FAE0BF71000748AFCF12AF55DD09A587F69FF81762B104054FD09CA267CB35ED82CB40

Function 009FC2A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 009FC36C

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 8b487ff005555aa8cece725b04b9136e955aba970b79f51c59781506b6b5b321
Instruction ID: 5f6ad7dbe91e28afa51880d06837f8831906e9458d2b7bf1bd6993f4876a47a5
Opcode Fuzzy Hash: 8b487ff005555aa8cece725b04b9136e955aba970b79f51c59781506b6b5b321
Instruction Fuzzy Hash: 3D4115B290021DABCB209FB9DD49EBB77BCEB84354F108669FA15DB180E6719D818B50

Function 00A1D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00A1D28C

Strings

X64, xrefs: 00A1D2A8

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 1695578db9da8f503b07b48ff042c5e48742d2765c31d035f6a8c4e640f9a57c
Instruction ID: acc0a2373ce9dacb34697a30922ab8c4afe4373b2d53525d0dcee5f080c44333
Opcode Fuzzy Hash: 1695578db9da8f503b07b48ff042c5e48742d2765c31d035f6a8c4e640f9a57c
Instruction Fuzzy Hash: A7D0C9B480122DEECF90CB90DC88DD9B3BCBB04306F104552F106A2140D77495498F10

Function 009ECAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: 06928e100d66fef5ffc5f852a2e91ced7cb9be1ea11820f8270e54bf4b1e432e
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 7C022DB1E002599BDF15CFA9C8806ADBBF5FF88314F254569E959E7380D731AD42CB80

Function 00A368EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00A36918
FindClose.KERNEL32(00000000), ref: 00A36961

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 9443df4b17c2da3e4671ff697051e783b4066a2d6c5c52305ca01da0f340cbd6
Instruction ID: 4ca6a4f4e9de2c35881a3987c3195bbf41cffa64dba46e1fc1b9f13f2fc359f5
Opcode Fuzzy Hash: 9443df4b17c2da3e4671ff697051e783b4066a2d6c5c52305ca01da0f340cbd6
Instruction Fuzzy Hash: E7117C71604200AFC710DF69D485B1ABBE5FF85329F14C69DF4698B6A2C730EC06CB91

Function 00A337B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00A44891,?,?,00000035,?), ref: 00A337E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00A44891,?,?,00000035,?), ref: 00A337F4

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: bae2b9184d842d98917c54e0229bf072c31579942271da2034d3f4a8d91a6608
Instruction ID: f4f0d8a8cf0b1fd82280d29f65a4f4a279d0f3f21d74f33d51a6a37dcd51235a
Opcode Fuzzy Hash: bae2b9184d842d98917c54e0229bf072c31579942271da2034d3f4a8d91a6608
Instruction Fuzzy Hash: 27F0E5B1A043292AEB20A7A69C4DFEB7AAEEFC4771F000165F509D22D5D9609904C7B0

Function 00A2B226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00A2B25D
keybd_event.USER32(?,75A4C0D0,?,00000000), ref: 00A2B270

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: c4bc73eaa0d604a140ab1b1987ee35a0827d7ffca9681be46113e478da539284
Instruction ID: 08d7e06faed8c43024a91c28698990c8b33645ddd8c630c326525515cdb7e7e7
Opcode Fuzzy Hash: c4bc73eaa0d604a140ab1b1987ee35a0827d7ffca9681be46113e478da539284
Instruction Fuzzy Hash: 86F0F97181434DABDB059FA4D805BEE7BB4FF08315F008019E955A5192D3798611DFA4

Function 00A210BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00A211FC), ref: 00A210D4
CloseHandle.KERNEL32(?,?,00A211FC), ref: 00A210E9

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 631b1cf0f0031731fcc0c4fa869847e0c592808a1c4674ff4324b907fcdedcec
Instruction ID: ec13c08eef91b778a94ecd30bf8629b627b0aaa1acbc08c416a2cfa51b342016
Opcode Fuzzy Hash: 631b1cf0f0031731fcc0c4fa869847e0c592808a1c4674ff4324b907fcdedcec
Instruction Fuzzy Hash: CBE04F32008710AEE7252B51FC06F7377A9FB04321F10C82EF4A6804B5DB626C90DB50

Function 009CCAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00A10C40

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.
API String ID: 0-1840281001
Opcode ID: d3fe0937e9bcf6b68c313ddc912f6b98522f6a20c918f8ac31762f365657091e
Instruction ID: 03e405512723c5f90a7c15ac464e69b38f69dbc3a20445eef39cab1cfc20603a
Opcode Fuzzy Hash: d3fe0937e9bcf6b68c313ddc912f6b98522f6a20c918f8ac31762f365657091e
Instruction Fuzzy Hash: A8327BB4D002189BCF14DF90C981FEDBBB5BF45344F14845DE80AAB292D775AE86CB62

Function 009F676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,009F6766,?,?,00000008,?,?,009FFEFE,00000000), ref: 009F6998

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 506d60cf43294dc85f358998b2b8e25046893975168f0a9431e156ecd8e3ec0d
Instruction ID: 3f2b6f1b282b5b53a9d29ca9264cddddf29dbd8d4cf38c16d02b00c3c382f7b3
Opcode Fuzzy Hash: 506d60cf43294dc85f358998b2b8e25046893975168f0a9431e156ecd8e3ec0d
Instruction Fuzzy Hash: 6AB13A316107099FD719CF28C48AB657BE0FF45364F25865CEA9ACF2A2C335E991CB40

Function 009DB119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 00A1851F

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 404dc48e31a8fb4bebb7917fd363419c1add269dd0352fa2422b2fced1ca6393
Instruction ID: 059bcf2bb0bd337496411e9df02cfc61103f14ba5c5d9eae2934fbc75be9f283
Opcode Fuzzy Hash: 404dc48e31a8fb4bebb7917fd363419c1add269dd0352fa2422b2fced1ca6393
Instruction Fuzzy Hash: F5124E75A00229DFDB14CF58C881BEEB7B5FF48710F15819AE849EB255EB349E81CB90

Function 00A3EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00A3EABD

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 51e618186bc6e575716fd40150f4c55836c0dcfca9d7f6ea40ce1a23050364f0
Instruction ID: f920f6e23a4d2688c141ce0138d63babe6c3b20555c8a499eaf64c3ca1ec2f77
Opcode Fuzzy Hash: 51e618186bc6e575716fd40150f4c55836c0dcfca9d7f6ea40ce1a23050364f0
Instruction Fuzzy Hash: 19E01A316002059FC710EF59D805E9ABBE9AF987A1F00841AFC49C7391DA70A9418B91

Function 009E09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,009E03EE), ref: 009E09DA

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 93c6f04194f3bbd6773e1b0c8df38218a485f85c41408c66ebbefb8d5704121b
Instruction ID: b0644e232b4a1001ef44734275d23ff8f7d3d80cbaed6a25a8c224af8e7f55a4
Opcode Fuzzy Hash: 93c6f04194f3bbd6773e1b0c8df38218a485f85c41408c66ebbefb8d5704121b
Instruction Fuzzy Hash:

Function 009E781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 009E798B

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: 94db70461fff6b521c801271b043417a4245253dcebea68de565175d7478c66f
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: 9E51437160C6C56BDB3B85EB889A7BFE78D9F62340F180919D886C7283CA19DE01D353

Function 009F6DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 113640d2205e8c45d866bb1d4ba0f2b5f0bc3dcdc4ec1e9955eff53d34c49d3b
Instruction ID: d7bce63c0f02abee9b5b80305560cf07343eb9e220010d0a8fe353110825f77b
Opcode Fuzzy Hash: 113640d2205e8c45d866bb1d4ba0f2b5f0bc3dcdc4ec1e9955eff53d34c49d3b
Instruction Fuzzy Hash: D5325522D29F054DD7239674CC22335A69DAFB73D5F14C737F81AB59A9EB69C4834200

Function 009DCC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79b8c83f0a61b5e72db4c1bdfc27b0e7707056c3a590412f17ce46a5a56cf6e2
Instruction ID: 26a406b16abf35759cfb94c9594d7fc6846aeebf99086a998c45c8a167c6fa58
Opcode Fuzzy Hash: 79b8c83f0a61b5e72db4c1bdfc27b0e7707056c3a590412f17ce46a5a56cf6e2
Instruction Fuzzy Hash: 62321272A841168BDF28CB28C5946FD7BB2EF45360F28896BD59ACB391D234DDC1DB40

Function 009C7920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccaf9b55e0f2c0a48c899591701f190fc89302ce567d0a0a331e16f239767194
Instruction ID: 500c95a3e027b6feb9e50ec2a06566ecd38d48379c45f873b1238bd0f7972b2a
Opcode Fuzzy Hash: ccaf9b55e0f2c0a48c899591701f190fc89302ce567d0a0a331e16f239767194
Instruction Fuzzy Hash: 4222AF70E0060A9FDF14CFA5D881BAEB7B6FF48300F144529E816AB291EB36AD51CF51

Function 009C91C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b67ea5ce20702a4c4732a191eb0714ffa5d7574d4d0881cd0da7a8d9512ee58f
Instruction ID: 6a72034f14dac3a325332756c21ecdc1cf07b6c2a7e8a0fdd985f81a3cbc0e6c
Opcode Fuzzy Hash: b67ea5ce20702a4c4732a191eb0714ffa5d7574d4d0881cd0da7a8d9512ee58f
Instruction Fuzzy Hash: 5902B4B1E00209EBDB04DF54D881BAEB7B1FF44300F508569E81A9B2D1EB35AE61DB91

Function 009E1C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: c4e239ca10a0fbe3dd6c96a20f7b6235c9d565959ef4cae99c9c92f3c21b01d3
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: 909157726080E34ADB2F463B857447EFFE55A923A131A0B9DE4F2CA1C5EE34DD94D620

Function 009E19B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: 6b6090f08d588e0aaf634fc1cfe45a61a2a9146dfd483d3e9e976529d022031d
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 8A9121722090E34ADB6B467B957403DFFE55A923A131E07AED4F2CA1C5FE348D54D620

Function 009E7A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7840a9bc01fae0124cbad6268698df2b7d559836f21870626695f1d30f5da421
Instruction ID: 45f66d0bbf8fdd857f5ecde1d0ae76997beb973b2cd24c7a0258d507ff3cb951
Opcode Fuzzy Hash: 7840a9bc01fae0124cbad6268698df2b7d559836f21870626695f1d30f5da421
Instruction Fuzzy Hash: A3615B716087C996DA3799EB8C95BBFF39CDF81700F280D2DE882DB281D6159E428357

Function 009E7CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15b60899ca933000c86e26c1023145e9d744a4506c5a5486e1a812c52ceb9111
Instruction ID: f419640b93972dbe1ad49459f1c6a92276a578c30c0a32162f54eb1ee38edef0
Opcode Fuzzy Hash: 15b60899ca933000c86e26c1023145e9d744a4506c5a5486e1a812c52ceb9111
Instruction Fuzzy Hash: A0616A712087C9A6DA3B49EB4C55BBFE38DAF42700F100D5DE946CB2D1DA159DC2C217

Function 009E1706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: f21813994fb3bf864efb30dceb780425fb5eefb4d6b1c749e3faa08bcd37d48a
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: 8D8163766090E34ADB6F423B857447EFFE55A923A131A079ED4F2CA1C2EE34CD54E620

Function 015E9A10 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1271287847.00000000015E6000.00000040.00000020.00020000.00000000.sdmp, Offset: 015E6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15e6000_RFQ_AS0101402025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction ID: da6b167f212d426994cb1a964ff9ca036b63ff26cac48c1d3f14aea4e043b18e
Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction Fuzzy Hash: E741D371D1051CEBCF48CFADC991AEEBBF2AF88201F548299D516AB345D730AB41DB40

Function 00A32046 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bb6063584bfe506f909a47f03a9f83457f4daa18b7199b09553cd7f925bf4ff
Instruction ID: f2678cae62188eeb17b7feb1d1b42a9ccbdd2aaf210bf95fa4d5ae5572c3d653
Opcode Fuzzy Hash: 6bb6063584bfe506f909a47f03a9f83457f4daa18b7199b09553cd7f925bf4ff
Instruction Fuzzy Hash: E62181327216118BDB28CF79C8227BE73E5A754310F15862EA4A7C76D0DE35A9048B80

Function 015E9900 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1271287847.00000000015E6000.00000040.00000020.00020000.00000000.sdmp, Offset: 015E6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15e6000_RFQ_AS0101402025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction ID: ef199a8c91127ad2e432ed16d5b23a3a766d8f3d12c3d86f9298d072bff39555
Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction Fuzzy Hash: DB019279E0110AEFCB48DF99C5949AEF7F5FB88314F208599D819AB341E730AE41DB80

Function 015E98A0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1271287847.00000000015E6000.00000040.00000020.00020000.00000000.sdmp, Offset: 015E6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15e6000_RFQ_AS0101402025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction ID: 1b9f037921ede49f57587806cadfd3c8808e50b91a87775dab65bed281581307
Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction Fuzzy Hash: 6F018078E04209EFCB48DF99C5949AEF7F5FB88214F208599D819AB301D730AE41DB80

Function 015E8260 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1271287847.00000000015E6000.00000040.00000020.00020000.00000000.sdmp, Offset: 015E6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15e6000_RFQ_AS0101402025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48

Function 00A42ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00A42B30
DeleteObject.GDI32(00000000), ref: 00A42B43
DestroyWindow.USER32 ref: 00A42B52
GetDesktopWindow.USER32 ref: 00A42B6D
GetWindowRect.USER32(00000000), ref: 00A42B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00A42CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00A42CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A42CF8
GetClientRect.USER32(00000000,?), ref: 00A42D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00A42D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A42D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A42D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A42D80
GlobalLock.KERNEL32(00000000), ref: 00A42D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A42D98
GlobalUnlock.KERNEL32(00000000), ref: 00A42DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A42DA8
GlobalFree.KERNEL32(00000000), ref: 00A42DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A42DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,00A5FC38,00000000), ref: 00A42DDB
GlobalFree.KERNEL32(00000000), ref: 00A42DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00A42E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00A42E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A42E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A4303F

Strings

AutoIt v3, xrefs: 00A42CF2
DISPLAY, xrefs: 00A42EA2
static, xrefs: 00A42D3A, 00A42E91
, xrefs: 00A42FC5

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 92034dafbcb1b288700d8c96af1ad7f48fb95df9097aafff0b87ed16749dc47d
Instruction ID: 6ab0cdfc3333e58e5ad0095726c89de5f7862fe156affed6831831d5cb5ff178
Opcode Fuzzy Hash: 92034dafbcb1b288700d8c96af1ad7f48fb95df9097aafff0b87ed16749dc47d
Instruction Fuzzy Hash: 1F026E75A00205AFDB14DFA4CC89FAE7BB9FB88721F108558F915AB2A1DB749D01CF60

Function 00A570D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00A5712F
GetSysColorBrush.USER32(0000000F), ref: 00A57160
GetSysColor.USER32(0000000F), ref: 00A5716C
SetBkColor.GDI32(?,000000FF), ref: 00A57186
SelectObject.GDI32(?,?), ref: 00A57195
InflateRect.USER32(?,000000FF,000000FF), ref: 00A571C0
GetSysColor.USER32(00000010), ref: 00A571C8
CreateSolidBrush.GDI32(00000000), ref: 00A571CF
FrameRect.USER32(?,?,00000000), ref: 00A571DE
DeleteObject.GDI32(00000000), ref: 00A571E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00A57230
FillRect.USER32(?,?,?), ref: 00A57262
GetWindowLongW.USER32(?,000000F0), ref: 00A57284

Part of subcall function 00A573E8: GetSysColor.USER32(00000012), ref: 00A57421
Part of subcall function 00A573E8: SetTextColor.GDI32(?,?), ref: 00A57425
Part of subcall function 00A573E8: GetSysColorBrush.USER32(0000000F), ref: 00A5743B
Part of subcall function 00A573E8: GetSysColor.USER32(0000000F), ref: 00A57446
Part of subcall function 00A573E8: GetSysColor.USER32(00000011), ref: 00A57463
Part of subcall function 00A573E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00A57471
Part of subcall function 00A573E8: SelectObject.GDI32(?,00000000), ref: 00A57482
Part of subcall function 00A573E8: SetBkColor.GDI32(?,00000000), ref: 00A5748B
Part of subcall function 00A573E8: SelectObject.GDI32(?,?), ref: 00A57498
Part of subcall function 00A573E8: InflateRect.USER32(?,000000FF,000000FF), ref: 00A574B7
Part of subcall function 00A573E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00A574CE
Part of subcall function 00A573E8: GetWindowLongW.USER32(00000000,000000F0), ref: 00A574DB

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 48f2d0cfa0148e640dfbfeb74a9c97ed5efd7f23f936d081b01718c09469bbd5
Instruction ID: 4cb7b0b771ca09ff79ddb7ecbf13c715db175f32d0d2f6be953bc25ca875e386
Opcode Fuzzy Hash: 48f2d0cfa0148e640dfbfeb74a9c97ed5efd7f23f936d081b01718c09469bbd5
Instruction Fuzzy Hash: 20A18072008701AFDB11DFA4EC48A5FBBA9FB49332F100B19F962A61E1E771E945CB51

Function 009D8D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 009D8E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00A16AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00A16AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00A16F43

Part of subcall function 009D8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,009D8BE8,?,00000000,?,?,?,?,009D8BBA,00000000,?), ref: 009D8FC5

SendMessageW.USER32(?,00001053), ref: 00A16F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00A16F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00A16FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00A16FB7

Strings

0, xrefs: 00A16DCF

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: 0b55f717456b7b186f75b1c14acb2e0180ff2f155652834f10edf2ca5ea4bfb2
Instruction ID: 2a9a23ec0090feb1748484b23e932447ae983cdce67a74813f114c6722d3033a
Opcode Fuzzy Hash: 0b55f717456b7b186f75b1c14acb2e0180ff2f155652834f10edf2ca5ea4bfb2
Instruction Fuzzy Hash: 51129C30204211EFDB25DF24D984BEAB7E5FB44311F14856AE485CB6A2CB35EC92DF91

Function 00A42711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00A4273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00A4286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00A428A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00A428B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00A42900
GetClientRect.USER32(00000000,?), ref: 00A4290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00A42955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00A42964
GetStockObject.GDI32(00000011), ref: 00A42974
SelectObject.GDI32(00000000,00000000), ref: 00A42978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00A42988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A42991
DeleteDC.GDI32(00000000), ref: 00A4299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00A429C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 00A429DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00A42A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00A42A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00A42A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00A42A77
GetStockObject.GDI32(00000011), ref: 00A42A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00A42A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00A42A97

Strings

msctls_progress32, xrefs: 00A42A13
AutoIt v3, xrefs: 00A428F8
DISPLAY, xrefs: 00A4295A
static, xrefs: 00A4294F, 00A42A71

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 3ee20290ada6052db1bc47e0a8618cb937a80f5fbe14941ef10a23ca21ee3bbd
Instruction ID: e8cfb4680a1229ee93055fce825cbf2a8ff02b0add93ac92d1c380e27851101a
Opcode Fuzzy Hash: 3ee20290ada6052db1bc47e0a8618cb937a80f5fbe14941ef10a23ca21ee3bbd
Instruction Fuzzy Hash: BDB15B75A00205AFEB14DFA8CC8AFAE7BB9FB48711F004519F915EB290DB70AD41CB90

Function 00A34ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00A34AED
GetDriveTypeW.KERNEL32(?,00A5CB68,?,\\.\,00A5CC08), ref: 00A34BCA
SetErrorMode.KERNEL32(00000000,00A5CB68,?,\\.\,00A5CC08), ref: 00A34D36

Strings

SAS, xrefs: 00A34CC9
ATAPI, xrefs: 00A34C91
Fibre, xrefs: 00A34CAD
ATA, xrefs: 00A34C98
PhysicalDrive, xrefs: 00A34B76
Removable, xrefs: 00A34C10, 00A34C15
FileBackedVirtual, xrefs: 00A34CEC
Fixed, xrefs: 00A34C09
SSA, xrefs: 00A34CA6
RAMDisk, xrefs: 00A34BF4
SATA, xrefs: 00A34CD0
1394, xrefs: 00A34C9F
SSD, xrefs: 00A34C4A
iSCSI, xrefs: 00A34CC2
CDROM, xrefs: 00A34BFB
USB, xrefs: 00A34CB4
\\.\, xrefs: 00A34B3F
MMC, xrefs: 00A34CDE
RAID, xrefs: 00A34CBB
Unknown, xrefs: 00A34BED, 00A34C83
Network, xrefs: 00A34C02
Virtual, xrefs: 00A34CE5
SCSI, xrefs: 00A34C8A

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 6dd20704ce5646d98e676f0a2e94528290e60af309924ba422f14bb6f4c83b6c
Instruction ID: 7d76c03db2c4d06e93d58fcf251c0d02d3db15193a2f74c894573021065763ce
Opcode Fuzzy Hash: 6dd20704ce5646d98e676f0a2e94528290e60af309924ba422f14bb6f4c83b6c
Instruction Fuzzy Hash: 6C619230605605AFDB04EF24CA82E6DB7B0FB4C744F24941AF806AB692DB35FD41DB42

Function 00A573E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00A57421
SetTextColor.GDI32(?,?), ref: 00A57425
GetSysColorBrush.USER32(0000000F), ref: 00A5743B
GetSysColor.USER32(0000000F), ref: 00A57446
CreateSolidBrush.GDI32(?), ref: 00A5744B
GetSysColor.USER32(00000011), ref: 00A57463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00A57471
SelectObject.GDI32(?,00000000), ref: 00A57482
SetBkColor.GDI32(?,00000000), ref: 00A5748B
SelectObject.GDI32(?,?), ref: 00A57498
InflateRect.USER32(?,000000FF,000000FF), ref: 00A574B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00A574CE
GetWindowLongW.USER32(00000000,000000F0), ref: 00A574DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00A5752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00A57554
InflateRect.USER32(?,000000FD,000000FD), ref: 00A57572
DrawFocusRect.USER32(?,?), ref: 00A5757D
GetSysColor.USER32(00000011), ref: 00A5758E
SetTextColor.GDI32(?,00000000), ref: 00A57596
DrawTextW.USER32(?,00A570F5,000000FF,?,00000000), ref: 00A575A8
SelectObject.GDI32(?,?), ref: 00A575BF
DeleteObject.GDI32(?), ref: 00A575CA
SelectObject.GDI32(?,?), ref: 00A575D0
DeleteObject.GDI32(?), ref: 00A575D5
SetTextColor.GDI32(?,?), ref: 00A575DB
SetBkColor.GDI32(?,?), ref: 00A575E5

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 5573eb78c2a09766bff56d2551ec70c2e15cd267caf547e71c402dbfd23a4d36
Instruction ID: 78bcebc3ea515af67573435e0c1e8359ba88a6513c5a077e71ef4c5af5ee2aeb
Opcode Fuzzy Hash: 5573eb78c2a09766bff56d2551ec70c2e15cd267caf547e71c402dbfd23a4d36
Instruction Fuzzy Hash: 54614A72900318AFDB01DFA4DC49EAEBFB9FB08322F114215F915BB2A1E7749941CB90

Function 00A50FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00A51128
GetDesktopWindow.USER32 ref: 00A5113D
GetWindowRect.USER32(00000000), ref: 00A51144
GetWindowLongW.USER32(?,000000F0), ref: 00A51199
DestroyWindow.USER32(?), ref: 00A511B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00A511ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00A5120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00A5121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00A51232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00A51245
IsWindowVisible.USER32(00000000), ref: 00A512A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00A512BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00A512D0
GetWindowRect.USER32(00000000,?), ref: 00A512E8
MonitorFromPoint.USER32(?,?,00000002), ref: 00A5130E
GetMonitorInfoW.USER32(00000000,?), ref: 00A51328
CopyRect.USER32(?,?), ref: 00A5133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 00A513AA

Strings

(, xrefs: 00A5131B
0, xrefs: 00A510D3
tooltips_class32, xrefs: 00A511E6

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 827fb15b7761319300aae94e066ad6333214c79c87ad6d3efebe166ed09480b9
Instruction ID: 644917cedddceb0203ef1fb40fe0f604533814ad54cf3a6ede6a396c42ed5e71
Opcode Fuzzy Hash: 827fb15b7761319300aae94e066ad6333214c79c87ad6d3efebe166ed09480b9
Instruction Fuzzy Hash: 5FB17A71604341AFD700DF64C885F6ABBE4FF88755F00891CF9999B2A1D771E849CB92

Function 00A50241 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00A502E5
_wcslen.LIBCMT ref: 00A5031F
_wcslen.LIBCMT ref: 00A50389
_wcslen.LIBCMT ref: 00A503F1
_wcslen.LIBCMT ref: 00A50475
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00A504C5
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00A50504

Part of subcall function 009DF9F2: _wcslen.LIBCMT ref: 009DF9FD

Part of subcall function 00A2223F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00A22258
Part of subcall function 00A2223F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00A2228A

Strings

FINDITEM, xrefs: 00A50627
GETTEXT, xrefs: 00A503EC, 00A50407
ISSELECTED, xrefs: 00A504DD
SELECTALL, xrefs: 00A50515
SELECTCLEAR, xrefs: 00A5052D
GETITEMCOUNT, xrefs: 00A50316, 00A50337
GETSELECTED, xrefs: 00A505E1
VIEWCHANGE, xrefs: 00A50675
DESELECT, xrefs: 00A5059C
GETSUBITEMCOUNT, xrefs: 00A50384, 00A5039F
SELECT, xrefs: 00A50548
GETSELECTEDCOUNT, xrefs: 00A50470, 00A5048B
SELECTINVERT, xrefs: 00A5057E

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: 074e9679ac8a9daf0cbc94ee205ebf57b1232a3cbc05cd30ce1ba715f8a1eda3
Instruction ID: 6c3578b3066925b4e9e4f8b85ab08b1b9ce1fc708dd5110989c98414dcc67fbf
Opcode Fuzzy Hash: 074e9679ac8a9daf0cbc94ee205ebf57b1232a3cbc05cd30ce1ba715f8a1eda3
Instruction Fuzzy Hash: 66E19A316082019FC714EF24C551E2EB7E6BFD8315B14896DF896AB3A1DB30ED49CB82

Function 009D8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 009D8968
GetSystemMetrics.USER32(00000007), ref: 009D8970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 009D899B
GetSystemMetrics.USER32(00000008), ref: 009D89A3
GetSystemMetrics.USER32(00000004), ref: 009D89C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 009D89E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 009D89F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 009D8A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 009D8A3C
GetClientRect.USER32(00000000,000000FF), ref: 009D8A5A
GetStockObject.GDI32(00000011), ref: 009D8A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 009D8A81

Part of subcall function 009D912D: GetCursorPos.USER32(?), ref: 009D9141
Part of subcall function 009D912D: ScreenToClient.USER32(00000000,?), ref: 009D915E
Part of subcall function 009D912D: GetAsyncKeyState.USER32(00000001), ref: 009D9183
Part of subcall function 009D912D: GetAsyncKeyState.USER32(00000002), ref: 009D919D

SetTimer.USER32(00000000,00000000,00000028,009D90FC), ref: 009D8AA8

Strings

AutoIt v3 GUI, xrefs: 009D8A20

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: af63dc08fb5f1f5e48fa37a4b4451db6c7fa647ea2fbf53748505d95b01ee1b4
Instruction ID: 2412d4bd56085cd9fad7bc668291f9191e7e4d4dafca4b9442ed66317f61ae11
Opcode Fuzzy Hash: af63dc08fb5f1f5e48fa37a4b4451db6c7fa647ea2fbf53748505d95b01ee1b4
Instruction Fuzzy Hash: 0AB16D75A4030A9FDB14DFA8CC95BEE3BB5FB48315F10822AFA15E7290DB34A941CB51

Function 00A20D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A210F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00A21114
Part of subcall function 00A210F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00A20B9B,?,?,?), ref: 00A21120
Part of subcall function 00A210F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00A20B9B,?,?,?), ref: 00A2112F
Part of subcall function 00A210F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00A20B9B,?,?,?), ref: 00A21136
Part of subcall function 00A210F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00A2114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00A20DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00A20E29
GetLengthSid.ADVAPI32(?), ref: 00A20E40
GetAce.ADVAPI32(?,00000000,?), ref: 00A20E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00A20E96
GetLengthSid.ADVAPI32(?), ref: 00A20EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00A20EB5
HeapAlloc.KERNEL32(00000000), ref: 00A20EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00A20EDD
CopySid.ADVAPI32(00000000), ref: 00A20EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00A20F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00A20F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00A20F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A20F6E
HeapFree.KERNEL32(00000000), ref: 00A20F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A20F7E
HeapFree.KERNEL32(00000000), ref: 00A20F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A20F8E
HeapFree.KERNEL32(00000000), ref: 00A20F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00A20FA1
HeapFree.KERNEL32(00000000), ref: 00A20FA8

Part of subcall function 00A21193: GetProcessHeap.KERNEL32(00000008,00A20BB1,?,00000000,?,00A20BB1,?), ref: 00A211A1
Part of subcall function 00A21193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00A20BB1,?), ref: 00A211A8
Part of subcall function 00A21193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00A20BB1,?), ref: 00A211B7

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 88e518ae62be6c3105aa111d863bb82ebc307244893df50daf8ac814c0bc20c3
Instruction ID: 6b3d2acec63cbba19e138f7458f9e61bfd1f8269febf8deb4106329986c1c7ab
Opcode Fuzzy Hash: 88e518ae62be6c3105aa111d863bb82ebc307244893df50daf8ac814c0bc20c3
Instruction Fuzzy Hash: 4C714A7290032AAFDF20DFA8ED44FAEBBB8FF04311F144125E919E6192D7719905CB60

Function 00A4C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A4C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,00A5CC08,00000000,?,00000000,?,?), ref: 00A4C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00A4C5A4
_wcslen.LIBCMT ref: 00A4C5F4
_wcslen.LIBCMT ref: 00A4C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00A4C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00A4C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00A4C84D
RegCloseKey.ADVAPI32(?), ref: 00A4C881
RegCloseKey.ADVAPI32(00000000), ref: 00A4C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00A4C960

Strings

REG_SZ, xrefs: 00A4C644
REG_BINARY, xrefs: 00A4C913
REG_DWORD, xrefs: 00A4C804
REG_MULTI_SZ, xrefs: 00A4C6F5
REG_QWORD, xrefs: 00A4C8C3
REG_EXPAND_SZ, xrefs: 00A4C5CD

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: dba7007849da01059ce32761c4416ace3bd9a960c41a3641254ec87a8dd20dc1
Instruction ID: 1ce1630fde55d646763f2d78105039030341f46511ca7d62055e590f0b7f8938
Opcode Fuzzy Hash: dba7007849da01059ce32761c4416ace3bd9a960c41a3641254ec87a8dd20dc1
Instruction Fuzzy Hash: 0D1225756042019FD754DF24C891F2AB7E5EF88724F14889DF88A9B2A2DB31ED41CB86

Function 00A5091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00A509C6
_wcslen.LIBCMT ref: 00A50A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00A50A54
_wcslen.LIBCMT ref: 00A50A8A
_wcslen.LIBCMT ref: 00A50B06
_wcslen.LIBCMT ref: 00A50B81

Part of subcall function 009DF9F2: _wcslen.LIBCMT ref: 009DF9FD

Part of subcall function 00A22BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00A22BFA

Strings

COLLAPSE, xrefs: 00A50B01, 00A50B1C
ISCHECKED, xrefs: 00A50CE1
GETTEXT, xrefs: 00A50C97
UNCHECK, xrefs: 00A50D3E
CHECK, xrefs: 00A50A85, 00A50AA0
SELECT, xrefs: 00A50D11
GETSELECTED, xrefs: 00A50C4E
GETITEMCOUNT, xrefs: 00A50C1E
EXISTS, xrefs: 00A50B7C, 00A50B97
EXPAND, xrefs: 00A50BF8
GETTOTALCOUNT, xrefs: 00A509F2, 00A50A17

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 92e7a40f9ffb91c6a1853f6a845124017625150860b313a7ba861d98c07363ab
Instruction ID: 8f28ad8852a10f534b199eff2941f5e2d7b9fd53dd699ba18fbabcd90ff1e1e7
Opcode Fuzzy Hash: 92e7a40f9ffb91c6a1853f6a845124017625150860b313a7ba861d98c07363ab
Instruction Fuzzy Hash: 9FE18B326087019FCB14EF24C490E2AB7E2BFD8355B15895DF8969B362D730ED49CB82

Function 00A4C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A4B6AE,?,?), ref: 00A4C9B5
_wcslen.LIBCMT ref: 00A4C9F1
_wcslen.LIBCMT ref: 00A4CA68
_wcslen.LIBCMT ref: 00A4CA9E
_wcslen.LIBCMT ref: 00A4CAF9
_wcslen.LIBCMT ref: 00A4CB2F
_wcslen.LIBCMT ref: 00A4CB7F

Strings

HKLM, xrefs: 00A4CA98, 00A4CA9D
HKEY_CURRENT_USER, xrefs: 00A4CBBD
HKEY_CURRENT_CONFIG, xrefs: 00A4CB79, 00A4CB7E
HKCC, xrefs: 00A4CBAC
HKEY_LOCAL_MACHINE, xrefs: 00A4CA62, 00A4CA67
HKEY_USERS, xrefs: 00A4CBDF
HKEY_CLASSES_ROOT, xrefs: 00A4CAF3, 00A4CAF8
HKCU, xrefs: 00A4CBCE
HKCR, xrefs: 00A4CB29, 00A4CB2E
HKU, xrefs: 00A4CBF0

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 818b5e59ffda9bfa50b359b822f0ae3b8eb8849cba4e2f7f187787a9fe4e7208
Instruction ID: 3bb71bca32dccb5d28c102bdac17b7014bbda67eea194a52e296b2c7cbfe0291
Opcode Fuzzy Hash: 818b5e59ffda9bfa50b359b822f0ae3b8eb8849cba4e2f7f187787a9fe4e7208
Instruction Fuzzy Hash: 7071F83660116A8BCB50DF78CD516BE33A2AFE07B4B254528F85AA7285EA31CD45C790

Function 00A5833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A5835A
_wcslen.LIBCMT ref: 00A5836E
_wcslen.LIBCMT ref: 00A58391
_wcslen.LIBCMT ref: 00A583B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00A583F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00A55BF2), ref: 00A5844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00A58487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00A584CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00A58501
FreeLibrary.KERNEL32(?), ref: 00A5850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00A5851D
DestroyIcon.USER32(?,?,?,?,?,00A55BF2), ref: 00A5852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00A58549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00A58555

Strings

.icl, xrefs: 00A58368
.dll, xrefs: 00A583AB
.exe, xrefs: 00A58388

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: bd8df81fdec29635196209b11af4e99d69b936f774e107be690d8c969af4d533
Instruction ID: 80fed713e2fe7086fdebcd69bf4b6a17f90ae9b48eea1630be96224f0b8f0c6c
Opcode Fuzzy Hash: bd8df81fdec29635196209b11af4e99d69b936f774e107be690d8c969af4d533
Instruction Fuzzy Hash: 6D61D171940315BEEB14DFA4CC41BBE77B8BB48B22F104509FC15EA1D1EB78A984CBA0

Function 009C7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

Unterminated group of comments, xrefs: 00A0528C
#include, xrefs: 009C7847
#pragma compile, xrefs: 009C77D3
Bad directive syntax error, xrefs: 00A0519A
', xrefs: 00A05169
#comments-end, xrefs: 009C78D9
#comments-start, xrefs: 009C785F, 009C78B1
#requireadmin, xrefs: 009C77FF
#include-once, xrefs: 009C782F
#ce, xrefs: 009C78ED
", xrefs: 00A05153
Cannot parse #include, xrefs: 00A05279
#cs, xrefs: 009C7873, 009C78C5
#notrayicon, xrefs: 009C77E7
#OnAutoItStartRegister, xrefs: 009C7817

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: f19e58aca7f85efb9b0fd097fe32cac430a7b4c4dd30bde096d9646b341cb070
Instruction ID: e0ffa0bb5af31cc60073e1eeb7dc8a838bc8b2361831460aab7bd0e68ef28421
Opcode Fuzzy Hash: f19e58aca7f85efb9b0fd097fe32cac430a7b4c4dd30bde096d9646b341cb070
Instruction Fuzzy Hash: 4981F871E40209BBDB11BFA0DD53FAF7768BF55300F044429F905AA196EB70DA15CBA2

Function 00A25A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00A25A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00A25A40
SetWindowTextW.USER32(?,?), ref: 00A25A57
GetDlgItem.USER32(?,000003EA), ref: 00A25A6C
SetWindowTextW.USER32(00000000,?), ref: 00A25A72
GetDlgItem.USER32(?,000003E9), ref: 00A25A82
SetWindowTextW.USER32(00000000,?), ref: 00A25A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00A25AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00A25AC3
GetWindowRect.USER32(?,?), ref: 00A25ACC
_wcslen.LIBCMT ref: 00A25B33
SetWindowTextW.USER32(?,?), ref: 00A25B6F
GetDesktopWindow.USER32 ref: 00A25B75
GetWindowRect.USER32(00000000), ref: 00A25B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00A25BD3
GetClientRect.USER32(?,?), ref: 00A25BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00A25C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00A25C2F

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: fa83756a5a39b9df32c6633235ed83a5dda347cf1be22c9a55976dab7f670f47
Instruction ID: 87e1d2ee05d9cb7d1c738671dbdd6c1d5dce576b4592e904f9e2ec63fc73edd0
Opcode Fuzzy Hash: fa83756a5a39b9df32c6633235ed83a5dda347cf1be22c9a55976dab7f670f47
Instruction Fuzzy Hash: 06718C31900B19AFDB20DFB8DE89AAEBBF5FF48715F104528E542A25A0E774E944CB50

Function 009E00C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 009E00C6

Part of subcall function 009E00ED: InitializeCriticalSectionAndSpinCount.KERNEL32(00A9070C,00000FA0,3BAB9C05,?,?,?,?,00A023B3,000000FF), ref: 009E011C
Part of subcall function 009E00ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00A023B3,000000FF), ref: 009E0127
Part of subcall function 009E00ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00A023B3,000000FF), ref: 009E0138
Part of subcall function 009E00ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 009E014E
Part of subcall function 009E00ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 009E015C
Part of subcall function 009E00ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 009E016A
Part of subcall function 009E00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 009E0195
Part of subcall function 009E00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 009E01A0

___scrt_fastfail.LIBCMT ref: 009E00E7

Part of subcall function 009E00A3: __onexit.LIBCMT ref: 009E00A9

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 009E0122
WakeAllConditionVariable, xrefs: 009E0162
kernel32.dll, xrefs: 009E0133
InitializeConditionVariable, xrefs: 009E0148
SleepConditionVariableCS, xrefs: 009E0154

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 71d5733b14e2188b41e36f7aa039e6eb4ffc3dbacdeb4980cbbcbbeae83f85ff
Instruction ID: e719fa3a6ba59ce057b94b490cce879099357981a7a31118e85496acac121cbd
Opcode Fuzzy Hash: 71d5733b14e2188b41e36f7aa039e6eb4ffc3dbacdeb4980cbbcbbeae83f85ff
Instruction Fuzzy Hash: 5521FC33648B507FD7129BF5AC06F2A37A8FB85F76F000526F801A7295DFB45C418A90

Function 00A230F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A2318D
_wcslen.LIBCMT ref: 00A231F8

Strings

INSTANCE, xrefs: 00A23453
REGEXPCLASS, xrefs: 00A23255, 00A23266
TEXT, xrefs: 00A2347C
CLASSNN, xrefs: 00A231F3, 00A23204
CLASS, xrefs: 00A23188, 00A231A5
NAME, xrefs: 00A23335, 00A23346

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: c88866170a1acffe078e4feac180023396bd30204c205af459650e1bc5409953
Instruction ID: 77877c09a0fc223bb5682bdc3803edd0e66199dd83fee120e16cb85f984821db
Opcode Fuzzy Hash: c88866170a1acffe078e4feac180023396bd30204c205af459650e1bc5409953
Instruction Fuzzy Hash: 77E1D233E00526ABCF14EFBCD451BEDBBB0BF55750F14816AE856A7240DB34AE858790

Function 00A344C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,00A5CC08), ref: 00A34527
_wcslen.LIBCMT ref: 00A3453B
_wcslen.LIBCMT ref: 00A34599
_wcslen.LIBCMT ref: 00A345F4
_wcslen.LIBCMT ref: 00A3463F
_wcslen.LIBCMT ref: 00A346A7

Part of subcall function 009DF9F2: _wcslen.LIBCMT ref: 009DF9FD

GetDriveTypeW.KERNEL32(?,00A86BF0,00000061), ref: 00A34743

Strings

removable, xrefs: 00A345EA, 00A345EF
ramdisk, xrefs: 00A346F1
unknown, xrefs: 00A34708
all, xrefs: 00A34531, 00A34536
cdrom, xrefs: 00A3458F, 00A34594
fixed, xrefs: 00A34635, 00A3463A
network, xrefs: 00A3469D, 00A346A2

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: b060375935805698a3b8d970e5480c72cbf1af1e61e5e8050beec5c283d80ddd
Instruction ID: ebd115208ffa86db22a30e6b44368660d50c60515fae1c2f5a8e406ff8806893
Opcode Fuzzy Hash: b060375935805698a3b8d970e5480c72cbf1af1e61e5e8050beec5c283d80ddd
Instruction Fuzzy Hash: D9B1DF71A083029FC710EF28C891A6AB7E5BFE9764F50491DF496C7291E730ED45CBA2

Function 00A4AFF9 Relevance: 24.4, APIs: 16, Instructions: 418processCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A4B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00A4B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00A4B1D4
_wcslen.LIBCMT ref: 00A4B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00A4B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00A4B236
_wcslen.LIBCMT ref: 00A4B332

Part of subcall function 00A305A7: GetStdHandle.KERNEL32(000000F6), ref: 00A305C6

_wcslen.LIBCMT ref: 00A4B34B
_wcslen.LIBCMT ref: 00A4B366
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00A4B3B6
GetLastError.KERNEL32(00000000), ref: 00A4B407
CloseHandle.KERNEL32(?), ref: 00A4B439
CloseHandle.KERNEL32(00000000), ref: 00A4B44A
CloseHandle.KERNEL32(00000000), ref: 00A4B45C
CloseHandle.KERNEL32(00000000), ref: 00A4B46E
CloseHandle.KERNEL32(?), ref: 00A4B4E3

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 8109edf15fb9014bc4f2f356e832c33144703d881e64e052afb68d182d57073a
Instruction ID: 6c26bff94c08d091aef4a70341c4f3f02f36ad61ebfc1392c16832ab546faed9
Opcode Fuzzy Hash: 8109edf15fb9014bc4f2f356e832c33144703d881e64e052afb68d182d57073a
Instruction Fuzzy Hash: 75F1AB356183409FC724EF24C891B6EBBE5AFC5710F14895DF8999B2A2CB31EC41CB62

Function 009C326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00A91990), ref: 00A02F8D
GetMenuItemCount.USER32(00A91990), ref: 00A0303D
GetCursorPos.USER32(?), ref: 00A03081
SetForegroundWindow.USER32(00000000), ref: 00A0308A
TrackPopupMenuEx.USER32(00A91990,00000000,?,00000000,00000000,00000000), ref: 00A0309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00A030A9

Strings

0, xrefs: 009C327D

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 3de1b31a2f5a8150b94a48cc38cf754e1c48c20f2d51470d30819c5dfc7c11d6
Instruction ID: 84ef5f59820021af7d1b93c876717b9f53a6ba0ec29b3df31ece90cff0056b78
Opcode Fuzzy Hash: 3de1b31a2f5a8150b94a48cc38cf754e1c48c20f2d51470d30819c5dfc7c11d6
Instruction Fuzzy Hash: 9A71087164031ABFEB258F64EC49FAABF68FF04364F208216F5256A1E0C7B1A910CB51

Function 00A56CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00A56DEB

Part of subcall function 009C6B57: _wcslen.LIBCMT ref: 009C6B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00A56E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00A56E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00A56E94
DestroyWindow.USER32(?), ref: 00A56EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,009C0000,00000000), ref: 00A56EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00A56EFD
GetDesktopWindow.USER32 ref: 00A56F16
GetWindowRect.USER32(00000000), ref: 00A56F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00A56F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00A56F4D

Part of subcall function 009D9944: GetWindowLongW.USER32(?,000000EB), ref: 009D9952

Strings

0, xrefs: 00A56D98
tooltips_class32, xrefs: 00A56E58, 00A56EDD

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: e7483ba50f5cf9e3d897292a3ec1bb240e40bde79b5501b53093786ebd4a9fc3
Instruction ID: 73e0dacf9506853b05303df2f99ecc27d07c8d02dc0bca734febb91d02649b2a
Opcode Fuzzy Hash: e7483ba50f5cf9e3d897292a3ec1bb240e40bde79b5501b53093786ebd4a9fc3
Instruction Fuzzy Hash: EA716770504345AFDB21CF58DC48FAABBE9FB99315F44091EF98987261CB74A90ACB12

Function 00A5911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 009D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009D9BB2

DragQueryPoint.SHELL32(?,?), ref: 00A59147

Part of subcall function 00A57674: ClientToScreen.USER32(?,?), ref: 00A5769A
Part of subcall function 00A57674: GetWindowRect.USER32(?,?), ref: 00A57710
Part of subcall function 00A57674: PtInRect.USER32(?,?,00A58B89), ref: 00A57720

SendMessageW.USER32(?,000000B0,?,?), ref: 00A591B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00A591BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00A591DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00A59225
SendMessageW.USER32(?,000000B0,?,?), ref: 00A5923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00A59255
SendMessageW.USER32(?,000000B1,?,?), ref: 00A59277
DragFinish.SHELL32(?), ref: 00A5927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00A59371

Strings

@GUI_DRAGFILE, xrefs: 00A59320
@GUI_DRAGID, xrefs: 00A592E9
@GUI_DROPID, xrefs: 00A5929E

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: 54170f5e232ecf955bfddcf104393fc0d5855270993515783b838f0ec67b12cd
Instruction ID: 942c3381323ad9ae1e1426f83a75180277cc8c9eec61ee24af82f610333cb10d
Opcode Fuzzy Hash: 54170f5e232ecf955bfddcf104393fc0d5855270993515783b838f0ec67b12cd
Instruction Fuzzy Hash: 9A614771508301AFC701EFA4DC89EAFBBE9FBC9750F00092EF595961A1DB309A49CB52

Function 00A3C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00A3C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00A3C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00A3C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00A3C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00A3C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00A3C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00A3C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00A3C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00A3C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00A3C5F0
InternetCloseHandle.WININET(00000000), ref: 00A3C5FB

Strings

, xrefs: 00A3C575

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: f52a8fb083119685ca3ba0435197a45932cfc9ef00e702c466bbdea13a81bac6
Instruction ID: d7940666685ecb6325c42f6cb5b5ec82dff50676df44b6eb6ea8873a9e8a3a74
Opcode Fuzzy Hash: f52a8fb083119685ca3ba0435197a45932cfc9ef00e702c466bbdea13a81bac6
Instruction Fuzzy Hash: C5514AB1540308BFDB21DFA4CD88AAB7BBCFF08765F00441AF946A6610DB34E945DB60

Function 00A5856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00000000,?,000000EC), ref: 00A58592
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00A585A2
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00A585AD
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00A585BA
GlobalLock.KERNEL32(00000000), ref: 00A585C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00A585D7
GlobalUnlock.KERNEL32(00000000), ref: 00A585E0
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00A585E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,000000F0,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00A585F8
OleLoadPicture.OLEAUT32(000000F0,00000000,00000000,00A5FC38,?), ref: 00A58611
GlobalFree.KERNEL32(00000000), ref: 00A58621
GetObjectW.GDI32(?,00000018,?), ref: 00A58641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00A58671
DeleteObject.GDI32(?), ref: 00A58699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00A586AF

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: d4342909890c7d7a131994673ff055d6cde5b1c88c86fa934c27ada374efd2a6
Instruction ID: 522a1798ad7263413b606fdccbc193f0e60ff1178dac15a87f882fa9cc89a48b
Opcode Fuzzy Hash: d4342909890c7d7a131994673ff055d6cde5b1c88c86fa934c27ada374efd2a6
Instruction Fuzzy Hash: 3241E875600308BFDB11DFA5DC48EAE7BB8FB89722F104158F906EB260DB349946DB60

Function 00A314BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00A31502
VariantCopy.OLEAUT32(?,?), ref: 00A3150B
VariantClear.OLEAUT32(?), ref: 00A31517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00A315FB
VarR8FromDec.OLEAUT32(?,?), ref: 00A31657
VariantInit.OLEAUT32(?), ref: 00A31708
SysFreeString.OLEAUT32(?), ref: 00A3178C
VariantClear.OLEAUT32(?), ref: 00A317D8
VariantClear.OLEAUT32(?), ref: 00A317E7
VariantInit.OLEAUT32(00000000), ref: 00A31823

Strings

Default, xrefs: 00A316AF
%4d%02d%02d%02d%02d%02d, xrefs: 00A31625

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 36d7bd406e4fbd6a486d85615076bbf82e923199b3762b0e22bc41bf3ca4f7b0
Instruction ID: e3bafa55b712f4ddecfc795ea0c52d4d607133dfa4a6af15130f7cba1b8a7a4a
Opcode Fuzzy Hash: 36d7bd406e4fbd6a486d85615076bbf82e923199b3762b0e22bc41bf3ca4f7b0
Instruction Fuzzy Hash: 1AD1F271A00215EFDB10EFA5E889B7DB7B5BF84700F14845AF846AB680DB30ED45DB62

Function 00A4B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 009C9CB3: _wcslen.LIBCMT ref: 009C9CBD

Part of subcall function 00A4C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A4B6AE,?,?), ref: 00A4C9B5
Part of subcall function 00A4C998: _wcslen.LIBCMT ref: 00A4C9F1
Part of subcall function 00A4C998: _wcslen.LIBCMT ref: 00A4CA68
Part of subcall function 00A4C998: _wcslen.LIBCMT ref: 00A4CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A4B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00A4B772
RegDeleteValueW.ADVAPI32(?,?), ref: 00A4B80A
RegCloseKey.ADVAPI32(?), ref: 00A4B87E
RegCloseKey.ADVAPI32(?), ref: 00A4B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 00A4B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00A4B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 00A4B922
FreeLibrary.KERNEL32(00000000), ref: 00A4B983
RegCloseKey.ADVAPI32(00000000), ref: 00A4B994

Strings

advapi32.dll, xrefs: 00A4B8ED
RegDeleteKeyExW, xrefs: 00A4B8FE

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: f43e3e817c4d22de67f99c02f73ca2239d6f54322e8dc96653daa453c77e08c3
Instruction ID: bc367b7d4fb45e43d455916410a2553fa24ecf672409969db090de09fb81ec8e
Opcode Fuzzy Hash: f43e3e817c4d22de67f99c02f73ca2239d6f54322e8dc96653daa453c77e08c3
Instruction Fuzzy Hash: B3C17D34618201AFD714DF24C495F2ABBE5BFC4318F14855CF49A8B2A2CB75ED46CBA2

Function 00A4255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00A425D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00A425E8
CreateCompatibleDC.GDI32(?), ref: 00A425F4
SelectObject.GDI32(00000000,?), ref: 00A42601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00A4266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00A426AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00A426D0
SelectObject.GDI32(?,?), ref: 00A426D8
DeleteObject.GDI32(?), ref: 00A426E1
DeleteDC.GDI32(?), ref: 00A426E8
ReleaseDC.USER32(00000000,?), ref: 00A426F3

Strings

(, xrefs: 00A4268D

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 0058b8dc2203785bbaaf5347cad0795db03995c9524bf2914cc2415393045a6b
Instruction ID: ef6cbbe1b229dccf9a3fc9c2d7696391cd313243df2d5b4a519eb311b279ff39
Opcode Fuzzy Hash: 0058b8dc2203785bbaaf5347cad0795db03995c9524bf2914cc2415393045a6b
Instruction Fuzzy Hash: 0261D175D00219EFCF14CFE8D984AAEBBB5FF48310F208529E956A7250E770A951CF64

Function 009FDA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 009FDAA1

Part of subcall function 009FD63C: _free.LIBCMT ref: 009FD659
Part of subcall function 009FD63C: _free.LIBCMT ref: 009FD66B
Part of subcall function 009FD63C: _free.LIBCMT ref: 009FD67D
Part of subcall function 009FD63C: _free.LIBCMT ref: 009FD68F
Part of subcall function 009FD63C: _free.LIBCMT ref: 009FD6A1
Part of subcall function 009FD63C: _free.LIBCMT ref: 009FD6B3
Part of subcall function 009FD63C: _free.LIBCMT ref: 009FD6C5
Part of subcall function 009FD63C: _free.LIBCMT ref: 009FD6D7
Part of subcall function 009FD63C: _free.LIBCMT ref: 009FD6E9
Part of subcall function 009FD63C: _free.LIBCMT ref: 009FD6FB
Part of subcall function 009FD63C: _free.LIBCMT ref: 009FD70D
Part of subcall function 009FD63C: _free.LIBCMT ref: 009FD71F
Part of subcall function 009FD63C: _free.LIBCMT ref: 009FD731

_free.LIBCMT ref: 009FDA96

Part of subcall function 009F29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,009FD7D1,00000000,00000000,00000000,00000000,?,009FD7F8,00000000,00000007,00000000,?,009FDBF5,00000000), ref: 009F29DE
Part of subcall function 009F29C8: GetLastError.KERNEL32(00000000,?,009FD7D1,00000000,00000000,00000000,00000000,?,009FD7F8,00000000,00000007,00000000,?,009FDBF5,00000000,00000000), ref: 009F29F0

_free.LIBCMT ref: 009FDAB8
_free.LIBCMT ref: 009FDACD
_free.LIBCMT ref: 009FDAD8
_free.LIBCMT ref: 009FDAFA
_free.LIBCMT ref: 009FDB0D
_free.LIBCMT ref: 009FDB1B
_free.LIBCMT ref: 009FDB26
_free.LIBCMT ref: 009FDB5E
_free.LIBCMT ref: 009FDB65
_free.LIBCMT ref: 009FDB82
_free.LIBCMT ref: 009FDB9A

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 9ef609beac75fac2c989c299e2ba2b29606bcd31b3248c22417f591ebf266eb7
Instruction ID: ae66c3670022219bd06e6851a396f0a3feec487c6a13d69f88e477d786d6f4eb
Opcode Fuzzy Hash: 9ef609beac75fac2c989c299e2ba2b29606bcd31b3248c22417f591ebf266eb7
Instruction Fuzzy Hash: A231583164520E9FEB22AF38E945B7AB7EEFF40321F114529E648D7191DB71EC808B24

Function 00A2365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00A2369C
_wcslen.LIBCMT ref: 00A236A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00A23797
GetClassNameW.USER32(?,?,00000400), ref: 00A2380C
GetDlgCtrlID.USER32(?), ref: 00A2385D
GetWindowRect.USER32(?,?), ref: 00A23882
GetParent.USER32(?), ref: 00A238A0
ScreenToClient.USER32(00000000), ref: 00A238A7
GetClassNameW.USER32(?,?,00000100), ref: 00A23921
GetWindowTextW.USER32(?,?,00000400), ref: 00A2395D

Strings

%s%u, xrefs: 00A23734

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: 13d3018e66b96c0316be3140fd7729c7e8e5943ad5c8c26bb7fe603b5658712d
Instruction ID: efc2fde7ddfea340dd9dcc5abb149071e9922f1092532849ba5e5c58a89131a2
Opcode Fuzzy Hash: 13d3018e66b96c0316be3140fd7729c7e8e5943ad5c8c26bb7fe603b5658712d
Instruction Fuzzy Hash: 5F91F572200316AFDB09DF68D894FAAF7E9FF46310F004529F999C6190DB34EA46CB91

Function 00A24954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00A24994
GetWindowTextW.USER32(?,?,00000400), ref: 00A249DA
_wcslen.LIBCMT ref: 00A249EB
CharUpperBuffW.USER32(?,00000000), ref: 00A249F7
_wcsstr.LIBVCRUNTIME ref: 00A24A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00A24A64
GetWindowTextW.USER32(?,?,00000400), ref: 00A24A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00A24AE6
GetClassNameW.USER32(?,?,00000400), ref: 00A24B20
GetWindowRect.USER32(?,?), ref: 00A24B8B

Strings

ThumbnailClass, xrefs: 00A24A6F, 00A24AF1

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 86915633aadebbe5cdc285a11aa6509a8af0e64d9b8757f024e7eb06fb46dd3b
Instruction ID: 47aa791ac01c8440910453e3e30f457e3dbd6ed521b3c10de2b690f505259407
Opcode Fuzzy Hash: 86915633aadebbe5cdc285a11aa6509a8af0e64d9b8757f024e7eb06fb46dd3b
Instruction Fuzzy Hash: 9391CE710043159FDB04DF18E985BAA7BE8FF88354F048479FD859A196EB30EE45CBA1

Function 00A58D0E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009D9BB2

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00A58D5A
GetFocus.USER32 ref: 00A58D6A
GetDlgCtrlID.USER32(00000000), ref: 00A58D75
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?,?,?,?), ref: 00A58E1D
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00A58ECF
GetMenuItemCount.USER32(?), ref: 00A58EEC
GetMenuItemID.USER32(?,00000000), ref: 00A58EFC
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00A58F2E
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00A58F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00A58FA1

Strings

0, xrefs: 00A58E9F

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0
API String ID: 1026556194-4108050209
Opcode ID: 45be794aec89165c43ed8e7cc70223945ddb1ad6321cbdcc8020c040c37df13c
Instruction ID: 98ba618b8657c8cad234dfcef34e0b8207f6cbb9818b1dd416621c180ce5a14f
Opcode Fuzzy Hash: 45be794aec89165c43ed8e7cc70223945ddb1ad6321cbdcc8020c040c37df13c
Instruction Fuzzy Hash: 8E81AF71508301AFDB10CF24C885AAB7BF9FB88755F04091AFD85A7291DB78DD09CBA1

Function 00A2DC0E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00A2DC20
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00A2DC46
_wcslen.LIBCMT ref: 00A2DC50
_wcsstr.LIBVCRUNTIME ref: 00A2DCA0
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00A2DCBC

Strings

StringFileInfo\, xrefs: 00A2DC8F
04090000, xrefs: 00A2DCF2
\VarFileInfo\Translation, xrefs: 00A2DCB4
%u.%u.%u.%u, xrefs: 00A2DD9A
DefaultLangCodepage, xrefs: 00A2DD1F

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 1939486746-1459072770
Opcode ID: d14b4e9caae06c5674774877e863cc382778caa3d7c2ff33904716419f083318
Instruction ID: 5f7a4f01e90f5e777053c3d3acc8b54c058e402cf1694a707719b410b0246079
Opcode Fuzzy Hash: d14b4e9caae06c5674774877e863cc382778caa3d7c2ff33904716419f083318
Instruction Fuzzy Hash: 894113329403107AEB01B775AC07FBF37ACEF85721F10446AF905A6283EB719E0187A5

Function 00A4CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00A4CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00A4CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00A4CD48

Part of subcall function 00A4CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00A4CCAA
Part of subcall function 00A4CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00A4CCBD
Part of subcall function 00A4CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00A4CCCF
Part of subcall function 00A4CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00A4CD05
Part of subcall function 00A4CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00A4CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 00A4CCF3

Strings

advapi32.dll, xrefs: 00A4CCB8
RegDeleteKeyExW, xrefs: 00A4CCC9

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: a04c15101ec7698f0962d2e16cda030b761c8566dfe5377bd33a38028728f6ce
Instruction ID: deaa6e96e9b3065ac74ee05b94bf1f385f37acf685b1ab8b6e535704b0a5de0b
Opcode Fuzzy Hash: a04c15101ec7698f0962d2e16cda030b761c8566dfe5377bd33a38028728f6ce
Instruction Fuzzy Hash: A4318075902229BFD760DB90DC88EFFBB7CFF45761F000165A909E3154DB349A46DAA0

Function 00A2E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00A2E6B4

Part of subcall function 009DE551: timeGetTime.WINMM(?,?,00A2E6D4), ref: 009DE555

Sleep.KERNEL32(0000000A), ref: 00A2E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 00A2E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00A2E727
SetActiveWindow.USER32 ref: 00A2E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00A2E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 00A2E773
Sleep.KERNEL32(000000FA), ref: 00A2E77E
IsWindow.USER32 ref: 00A2E78A
EndDialog.USER32(00000000), ref: 00A2E79B

Strings

BUTTON, xrefs: 00A2E719

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 39ebc8070d06976e5a2a15ecc55f00afaddf341ff301d6d59a29e38230073e09
Instruction ID: 4f076fe5244ecd09a2d1d3fd3968b26a2b4bf94ac89bf665e58186ba3741ae6a
Opcode Fuzzy Hash: 39ebc8070d06976e5a2a15ecc55f00afaddf341ff301d6d59a29e38230073e09
Instruction Fuzzy Hash: 36214CB0204315BFEB10DFA8FCC9B263A69F75575AB101436F506826A2DE65AC528B24

Function 00A2E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 009C9CB3: _wcslen.LIBCMT ref: 009C9CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00A2EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00A2EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00A2EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00A2EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00A2EAA7

Strings

play PlayMe, xrefs: 00A2EAA2
status PlayMe mode, xrefs: 00A2EA58
close PlayMe, xrefs: 00A2EA6E, 00A2EA9B
play PlayMe wait, xrefs: 00A2EA91
alias PlayMe, xrefs: 00A2EA36
open , xrefs: 00A2EA0C

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 939451ba2741c8b495800bd7a86e6d21f0d81b7a1c9197a746caad13d4f27a8e
Instruction ID: 3b4215a81059596d56d4ac53dde910fe986df5283176b7b930a6881e38c17ec7
Opcode Fuzzy Hash: 939451ba2741c8b495800bd7a86e6d21f0d81b7a1c9197a746caad13d4f27a8e
Instruction Fuzzy Hash: 63115E31A9026979E724F7A5EC4AFFF7A7CFBD1B40F400829B811A20D1EAB00955C6B1

Function 00A25CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00A25CE2
GetWindowRect.USER32(00000000,?), ref: 00A25CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00A25D59
GetDlgItem.USER32(?,00000002), ref: 00A25D69
GetWindowRect.USER32(00000000,?), ref: 00A25D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00A25DCF
GetDlgItem.USER32(?,000003E9), ref: 00A25DDD
GetWindowRect.USER32(00000000,?), ref: 00A25DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00A25E31
GetDlgItem.USER32(?,000003EA), ref: 00A25E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00A25E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00A25E67

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 004c4679233b27e3a4a53d19ee6bfbaf7e594c9a6750a66681ef693b37cfdcbc
Instruction ID: c9aabfeb73c161ab8e9ea7a989bb66b9353b84870aebc7ee4ccb24dfb21c2a72
Opcode Fuzzy Hash: 004c4679233b27e3a4a53d19ee6bfbaf7e594c9a6750a66681ef693b37cfdcbc
Instruction Fuzzy Hash: 19512C70E00715AFDF18CFA8DD89AAEBBB5FB48311F148129F915E6694D7709E01CB50

Function 009D8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 009D8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,009D8BE8,?,00000000,?,?,?,?,009D8BBA,00000000,?), ref: 009D8FC5

DestroyWindow.USER32(?), ref: 009D8C81
KillTimer.USER32(00000000,?,?,?,?,009D8BBA,00000000,?), ref: 009D8D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00A16973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,009D8BBA,00000000,?), ref: 00A169A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,009D8BBA,00000000,?), ref: 00A169B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,009D8BBA,00000000), ref: 00A169D4
DeleteObject.GDI32(00000000), ref: 00A169E6

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: cbb2e111858215e0a3a52c9f5c560d1e412eb28a00618c2c0d2e6aa883acdf59
Instruction ID: 11a4c3854aed6cc81884d1542c0ea4547b0946f26ae3924927c624a27ae41c0c
Opcode Fuzzy Hash: cbb2e111858215e0a3a52c9f5c560d1e412eb28a00618c2c0d2e6aa883acdf59
Instruction Fuzzy Hash: BA618E30552701DFCB25DF64D988B6A77F5FB50322F14891AE0829BAA1CB35A9C2DF90

Function 009D9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 009D9944: GetWindowLongW.USER32(?,000000EB), ref: 009D9952

GetSysColor.USER32(0000000F), ref: 009D9862

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 88ad99ab739fdf913394b673798b2053b924e0c420240c7ef3e6e4b5df388f68
Instruction ID: 414ee3ba8683eaf4075efd3905939e5ea576bb07ecb7bed2bd4f6bd1220dcc0c
Opcode Fuzzy Hash: 88ad99ab739fdf913394b673798b2053b924e0c420240c7ef3e6e4b5df388f68
Instruction Fuzzy Hash: F641A6311447449FDF20AF789C84BB9376AFB06731F148616F9A2872E5D7319D42EB10

Function 00A296E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,00A0F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00A29717
LoadStringW.USER32(00000000,?,00A0F7F8,00000001), ref: 00A29720

Part of subcall function 009C9CB3: _wcslen.LIBCMT ref: 009C9CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00A0F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00A29742
LoadStringW.USER32(00000000,?,00A0F7F8,00000001), ref: 00A29745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00A29866

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00A2984A
^ ERROR, xrefs: 00A297FB
Error: , xrefs: 00A2981D
Line %d (File "%s"):, xrefs: 00A2978F
Line %d:, xrefs: 00A297A0

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: f534ea4aeec8239fc486dda8f665817d9b140c5f2496d05152798c439e14d1d2
Instruction ID: b0461f4438b3025dd9e9c20842c00e95f15107d0cb39db11d55cc39522cd33df
Opcode Fuzzy Hash: f534ea4aeec8239fc486dda8f665817d9b140c5f2496d05152798c439e14d1d2
Instruction Fuzzy Hash: B7415D72D00219AADB04FBE0DE46FEE7378AF94740F504129B60672092EB356F49CB62

Function 00A206DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 009C6B57: _wcslen.LIBCMT ref: 009C6B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00A207A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00A207BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00A207DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00A20804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00A2082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00A20837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00A2083C

Strings

\IPC$, xrefs: 00A20784
SOFTWARE\Classes\, xrefs: 00A2070E
\CLSID, xrefs: 00A20724

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 43dc75fe00457624c6f4ce2b08de82bda1cf51ac848ec7fc4e78908f229f917c
Instruction ID: dfd0e0dd56b1d0d8de0a5d90208b8baa500768f2d66b7799124b17b6eda8ff6b
Opcode Fuzzy Hash: 43dc75fe00457624c6f4ce2b08de82bda1cf51ac848ec7fc4e78908f229f917c
Instruction Fuzzy Hash: B341F472D10629AFDF15EBA4EC95EEEB778FF44354B444129E901A31A1EB309E04CBA1

Function 00A43C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A43C5C
CoInitialize.OLE32(00000000), ref: 00A43C8A
CoUninitialize.OLE32 ref: 00A43C94
_wcslen.LIBCMT ref: 00A43D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00A43DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00A43ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00A43F0E
CoGetObject.OLE32(?,00000000,00A5FB98,?), ref: 00A43F2D
SetErrorMode.KERNEL32(00000000), ref: 00A43F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00A43FC4
VariantClear.OLEAUT32(?), ref: 00A43FD8

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: d965c168becba83c277ed4cad40c321fcd0930628d1729ba0c00e8e918997711
Instruction ID: 30c070249bf29bffece4f11be6afedb374f86b3653eb8945fb3120951be108f9
Opcode Fuzzy Hash: d965c168becba83c277ed4cad40c321fcd0930628d1729ba0c00e8e918997711
Instruction Fuzzy Hash: 0EC11376A08301AFDB00DF68C88592AB7E9FFC9754F10491DF98A9B251D731EE06CB52

Function 00A37A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00A37AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00A37B8F
SHGetDesktopFolder.SHELL32(?), ref: 00A37BA3
CoCreateInstance.OLE32(00A5FD08,00000000,00000001,00A86E6C,?), ref: 00A37BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00A37C74
CoTaskMemFree.OLE32(?,?), ref: 00A37CCC
SHBrowseForFolderW.SHELL32(?), ref: 00A37D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00A37D7A
CoTaskMemFree.OLE32(00000000), ref: 00A37D81
CoTaskMemFree.OLE32(00000000), ref: 00A37DD6
CoUninitialize.OLE32 ref: 00A37DDC

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: d3365e43245b9c1f361d61390db8471b4b0ef395901d2e5a6119d1dbb13656b2
Instruction ID: 98824941810586c924e2a9ce8445499bbb63c15d050663c5a83e9081f9dd8de9
Opcode Fuzzy Hash: d3365e43245b9c1f361d61390db8471b4b0ef395901d2e5a6119d1dbb13656b2
Instruction Fuzzy Hash: 9EC1EB75A04219AFCB14DFA4C884EAEBBF5FF48314F148499F41A9B261D731ED45CB90

Function 00A5541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00A55504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00A55515
CharNextW.USER32(00000158), ref: 00A55544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00A55585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00A5559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00A555AC

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: 789ddc91323418d73ead6dba1a70c683c66145d635c8f19dcc32abceba21f3aa
Instruction ID: c6bc1ed734ffbdf1c8d5ba637f91185e742cbdddaa94d945da16738d047c0381
Opcode Fuzzy Hash: 789ddc91323418d73ead6dba1a70c683c66145d635c8f19dcc32abceba21f3aa
Instruction Fuzzy Hash: E3617D70D00609EFDF10CFA4CC94AFE7BB9FB09722F108145F925A6290D7788A89DB60

Function 00A1FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00A1FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 00A1FB08
VariantInit.OLEAUT32(?), ref: 00A1FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00A1FB3A
VariantCopy.OLEAUT32(?,?), ref: 00A1FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00A1FBA1
VariantClear.OLEAUT32(?), ref: 00A1FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 00A1FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00A1FBCC
VariantClear.OLEAUT32(?), ref: 00A1FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00A1FBE9

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: fcbc157223d4084587d88b8995cff1d5819dc793b478ba9f6dab4cb386b9f337
Instruction ID: 914d0fbbea5656e06fc48439017a673691142ead33b386c89e432589a1005139
Opcode Fuzzy Hash: fcbc157223d4084587d88b8995cff1d5819dc793b478ba9f6dab4cb386b9f337
Instruction Fuzzy Hash: 6B414275A04319AFCB00DFA8C858DEDBBB9FF48355F008069E956A7265C734AA46CF90

Function 00A29C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00A29CA1
GetAsyncKeyState.USER32(000000A0), ref: 00A29D22
GetKeyState.USER32(000000A0), ref: 00A29D3D
GetAsyncKeyState.USER32(000000A1), ref: 00A29D57
GetKeyState.USER32(000000A1), ref: 00A29D6C
GetAsyncKeyState.USER32(00000011), ref: 00A29D84
GetKeyState.USER32(00000011), ref: 00A29D96
GetAsyncKeyState.USER32(00000012), ref: 00A29DAE
GetKeyState.USER32(00000012), ref: 00A29DC0
GetAsyncKeyState.USER32(0000005B), ref: 00A29DD8
GetKeyState.USER32(0000005B), ref: 00A29DEA

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: c496ecba508c7017389c3819cc714f2d6f410409a6f08a3fdc3030f36958ed75
Instruction ID: ad03f5a077e4beb9c49121786f25d4ccf60c744fcbebcebf000ef82ccd70f61d
Opcode Fuzzy Hash: c496ecba508c7017389c3819cc714f2d6f410409a6f08a3fdc3030f36958ed75
Instruction Fuzzy Hash: C241E7345047D96DFF3487A8E8043B7BEE07F11B44F04807ADAC6565C2EBA499C8D7A2

Function 00A4055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00A405BC
inet_addr.WSOCK32(?), ref: 00A4061C
gethostbyname.WSOCK32(?), ref: 00A40628
IcmpCreateFile.IPHLPAPI ref: 00A40636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00A406C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00A406E5
IcmpCloseHandle.IPHLPAPI(?), ref: 00A407B9
WSACleanup.WSOCK32 ref: 00A407BF

Strings

Ping, xrefs: 00A40676

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: f3265084a92678391df185d801b65d051ad75bab91b12749996c0e2f7c5932b9
Instruction ID: 78afe8c3c60fb574c4a0473795ad5f09b754f55eba3734da6f2aa91d388f88ec
Opcode Fuzzy Hash: f3265084a92678391df185d801b65d051ad75bab91b12749996c0e2f7c5932b9
Instruction Fuzzy Hash: 03917C396047019FD320DF15C489F1ABBE0BF88318F1585A9F56A8B6A2C770ED41DF92

Function 00A48CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00A48CF3

Part of subcall function 00A28E54: _wcslen.LIBCMT ref: 00A28E77

_wcslen.LIBCMT ref: 00A48D4E
_wcslen.LIBCMT ref: 00A48D9C
_wcslen.LIBCMT ref: 00A48DDC
_wcslen.LIBCMT ref: 00A48E6E

Strings

winapi, xrefs: 00A48D96, 00A48D9B
none, xrefs: 00A48E65, 00A48E6A
stdcall, xrefs: 00A48DD6, 00A48DDB
cdecl, xrefs: 00A48D48, 00A48D4D

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 5ac38d9dedf2c9eb13315bd5ce535341b2e624579ccaf1ec6addb2cc3f27d6a9
Instruction ID: a307dddd8a6383ddbdd0aa96a57734bb34d575b78b83ca14a5af6b91cb6e6c5e
Opcode Fuzzy Hash: 5ac38d9dedf2c9eb13315bd5ce535341b2e624579ccaf1ec6addb2cc3f27d6a9
Instruction Fuzzy Hash: 0C519035E011169BCF14EF6CD9419BEB7B5BFA4724B204229E826E72C5EB39DD40C790

Function 00A4372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00A43774
CoUninitialize.OLE32 ref: 00A4377F
CoCreateInstance.OLE32(?,00000000,00000017,00A5FB78,?), ref: 00A437D9
IIDFromString.OLE32(?,?), ref: 00A4384C
VariantInit.OLEAUT32(?), ref: 00A438E4
VariantClear.OLEAUT32(?), ref: 00A43936

Strings

Failed to create object, xrefs: 00A437E4, 00A4389A
Invalid parameter, xrefs: 00A43865
NULL Pointer assignment, xrefs: 00A4381E

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: d2bbf7fcea149bf75cbc623f205972a2edbb659791b43867348089982800e869
Instruction ID: b6c7060e837f9dba3a5396fd84ffe82f19b03541a48a8c2f77789e330b4d6146
Opcode Fuzzy Hash: d2bbf7fcea149bf75cbc623f205972a2edbb659791b43867348089982800e869
Instruction Fuzzy Hash: A761AC76608311AFDB10DF54C889F6ABBE8FF88711F104819F9859B291D770EE49CB92

Function 00A33388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00A333CF

Part of subcall function 009C9CB3: _wcslen.LIBCMT ref: 009C9CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00A333F0

Strings

"%s" (%d) : ==> %s:, xrefs: 00A33522
Error: , xrefs: 00A334D1
Line %d (File "%s"):, xrefs: 00A33443, 00A3345C
^ ERROR , xrefs: 00A3349E
"%s" (%d) : ==> %s:%s%s, xrefs: 00A33504
Incorrect parameters to object property !, xrefs: 00A334AB

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 958f27664f771521af5688670d01030f6ff711293c1c0afc701ac6d740f82acf
Instruction ID: ba21bea0186e265c72785cde7a695fcc7e83f611c78ed2f4e7cafe6f776f0c64
Opcode Fuzzy Hash: 958f27664f771521af5688670d01030f6ff711293c1c0afc701ac6d740f82acf
Instruction Fuzzy Hash: 4C516D32D40209BADF15EBE0DE46FEEB778AF44740F108569B50572092EB356F58CB61

Function 00A2B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00A2B5FC
_wcslen.LIBCMT ref: 00A2B608
_wcslen.LIBCMT ref: 00A2B64D
_wcslen.LIBCMT ref: 00A2B68C
_wcslen.LIBCMT ref: 00A2B6C7

Strings

APPEND, xrefs: 00A2B6C1, 00A2B6C6
KEYS, xrefs: 00A2B647, 00A2B64C
EXISTS, xrefs: 00A2B686, 00A2B68B
REMOVE, xrefs: 00A2B602, 00A2B607

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 4ead0f05c26552516beee98527644e3dddc3f4de9d47b8f46968ae2f44ada3b4
Instruction ID: 46c1c9c884d373bcdcf3cb40374bfdd291e83e4672a6a43a76fbbd1da6c5ac51
Opcode Fuzzy Hash: 4ead0f05c26552516beee98527644e3dddc3f4de9d47b8f46968ae2f44ada3b4
Instruction Fuzzy Hash: 9D41B632A111379BCB206F7D9C905BE77B5BFA0B94B244539E462DB284E735CD81C7A0

Function 00A35393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00A353A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00A35416
GetLastError.KERNEL32 ref: 00A35420
SetErrorMode.KERNEL32(00000000,READY), ref: 00A354A7

Strings

NOTREADY, xrefs: 00A3544B
READONLY, xrefs: 00A35452
READY, xrefs: 00A35460, 00A35468
UNKNOWN, xrefs: 00A35444
INVALID, xrefs: 00A35459

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 49722581a54e62b998974119564c751df4237b646541218a1d241b8bbb6b08e0
Instruction ID: 04240408bdc60675215ff405ce279f1ecdc8c625705f0380657f9d3416175fdd
Opcode Fuzzy Hash: 49722581a54e62b998974119564c751df4237b646541218a1d241b8bbb6b08e0
Instruction Fuzzy Hash: 7F318935E006049FD718EF6CC884BAABBB5FF44305F148069F8068B2A2DB31DD82CB91

Function 00A53C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00A53C79
SetMenu.USER32(?,00000000), ref: 00A53C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A53D10
IsMenu.USER32(?), ref: 00A53D24
CreatePopupMenu.USER32 ref: 00A53D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00A53D5B
DrawMenuBar.USER32 ref: 00A53D63

Strings

F, xrefs: 00A53D4E
0, xrefs: 00A53C54

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: dd332463ce5fbf6d6771435325e064225c671b7954f3b491acdbd2c70d90db56
Instruction ID: 685daa3a907af66e306d3af82fb65fa458535ce5e18ceb9dd864fa5a495cce0d
Opcode Fuzzy Hash: dd332463ce5fbf6d6771435325e064225c671b7954f3b491acdbd2c70d90db56
Instruction Fuzzy Hash: 80415676A01309AFDF14CFA4D884BAA7BB5FF89391F140429ED46A7360D730AA15CB90

Function 00A53A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00A53A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00A53AA0
GetWindowLongW.USER32(?,000000F0), ref: 00A53AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00A53AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00A53B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00A53BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00A53BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00A53BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00A53BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00A53C13

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: fe82c94943c949cc1c27eaf8f6c07b422911fe9be4218e809d8b783c7d38fee3
Instruction ID: efff284dba8c88168c84f0f4a9c49356ee50787f2ba08ac695f2c7cfb00af348
Opcode Fuzzy Hash: fe82c94943c949cc1c27eaf8f6c07b422911fe9be4218e809d8b783c7d38fee3
Instruction Fuzzy Hash: 01616C75A00248AFDB11DFA8CC81EEE77B8FB49710F10419AFA15E7291C774AE49DB50

Function 00A2B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00A2B151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00A2A1E1,?,00000001), ref: 00A2B165
GetWindowThreadProcessId.USER32(00000000), ref: 00A2B16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00A2A1E1,?,00000001), ref: 00A2B17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 00A2B18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00A2A1E1,?,00000001), ref: 00A2B1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00A2A1E1,?,00000001), ref: 00A2B1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00A2A1E1,?,00000001), ref: 00A2B1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00A2A1E1,?,00000001), ref: 00A2B212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00A2A1E1,?,00000001), ref: 00A2B21D

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 05adbb51ab8344e0cb604bf94cf934eb17b2e3bb0c36babfe7e236ce677a019e
Instruction ID: 8062cafe65b66a0e9f64780ac72f558c77f9f18d415a8c6ce2694c8996e3f3a0
Opcode Fuzzy Hash: 05adbb51ab8344e0cb604bf94cf934eb17b2e3bb0c36babfe7e236ce677a019e
Instruction Fuzzy Hash: D0317F72620314EFDB10DFA8EC44BAE7BB9BB51322F104125FA05D61A1DBB49A42CB70

Function 009F2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 009F2C94

Part of subcall function 009F29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,009FD7D1,00000000,00000000,00000000,00000000,?,009FD7F8,00000000,00000007,00000000,?,009FDBF5,00000000), ref: 009F29DE
Part of subcall function 009F29C8: GetLastError.KERNEL32(00000000,?,009FD7D1,00000000,00000000,00000000,00000000,?,009FD7F8,00000000,00000007,00000000,?,009FDBF5,00000000,00000000), ref: 009F29F0

_free.LIBCMT ref: 009F2CA0
_free.LIBCMT ref: 009F2CAB
_free.LIBCMT ref: 009F2CB6
_free.LIBCMT ref: 009F2CC1
_free.LIBCMT ref: 009F2CCC
_free.LIBCMT ref: 009F2CD7
_free.LIBCMT ref: 009F2CE2
_free.LIBCMT ref: 009F2CED
_free.LIBCMT ref: 009F2CFB

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7098d777ad2dcf9e01eabea6d5be60adc47228819ebe3932f22528762ad55077
Instruction ID: f18dabf9773c837c5f498eb9640a99ff93b51a3ca78c7f45fa91dedbc2f84536
Opcode Fuzzy Hash: 7098d777ad2dcf9e01eabea6d5be60adc47228819ebe3932f22528762ad55077
Instruction Fuzzy Hash: 5511B97614010DBFCB02EF54D942EED3BA5FF45350F5144A5FA485F222D671EE909B90

Function 009C1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 009C1459
OleUninitialize.OLE32(?,00000000), ref: 009C14F8
UnregisterHotKey.USER32(?), ref: 009C16DD
DestroyWindow.USER32(?), ref: 00A024B9
FreeLibrary.KERNEL32(?), ref: 00A0251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00A0254B

Strings

close all, xrefs: 009C1454

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 3b4f9c22c593feb1406ba2e944b6a67121c536bda10cd5516cfec37cd59bd722
Instruction ID: 5d1e7840eb4240213c6f89b4bf5d3e9225d7c50f6209b6974d8739cc19d4aba9
Opcode Fuzzy Hash: 3b4f9c22c593feb1406ba2e944b6a67121c536bda10cd5516cfec37cd59bd722
Instruction Fuzzy Hash: C9D17931B012128FCB19EF14D999F29F7A4BF45710F1442ADE84A6B2A2CB31AD12CF59

Function 00A37DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00A37FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00A37FC1
GetFileAttributesW.KERNEL32(?), ref: 00A37FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00A38005
SetCurrentDirectoryW.KERNEL32(?), ref: 00A38017
SetCurrentDirectoryW.KERNEL32(?), ref: 00A38060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00A380B0

Strings

*.*, xrefs: 00A38066

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: c99522fb81ca215728e80c788bd38e599d86f5f0d038a5dd2372169a1198cd6c
Instruction ID: 1cd60bbb6f589dbf2b75bda43ff4d9eadd1acbd67181b40387ef3bed7579f4fc
Opcode Fuzzy Hash: c99522fb81ca215728e80c788bd38e599d86f5f0d038a5dd2372169a1198cd6c
Instruction Fuzzy Hash: FD818DB25083459FCB24EF54C885AAEB3E8BF89310F64486EF885D7251EB34DD498B52

Function 009C5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 009C5C7A

Part of subcall function 009C5D0A: GetClientRect.USER32(?,?), ref: 009C5D30
Part of subcall function 009C5D0A: GetWindowRect.USER32(?,?), ref: 009C5D71
Part of subcall function 009C5D0A: ScreenToClient.USER32(?,?), ref: 009C5D99

GetDC.USER32 ref: 00A046F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00A04708
SelectObject.GDI32(00000000,00000000), ref: 00A04716
SelectObject.GDI32(00000000,00000000), ref: 00A0472B
ReleaseDC.USER32(?,00000000), ref: 00A04733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00A047C4

Strings

U, xrefs: 00A04693

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: ec46d368ad7d47d1aa0cf0495153ee9d34e5fb9d6b9cb4f5d057b66f355ad337
Instruction ID: 89d53a4b71033b593fbd07978b82893c46c937217923639438c3ae5c60378a48
Opcode Fuzzy Hash: ec46d368ad7d47d1aa0cf0495153ee9d34e5fb9d6b9cb4f5d057b66f355ad337
Instruction Fuzzy Hash: BB71F070900209DFCF21CF64D984ABA3BB5FF4A360F144269EE515A2A6D7319C81DF60

Function 00A3359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00A335E4

Part of subcall function 009C9CB3: _wcslen.LIBCMT ref: 009C9CBD

LoadStringW.USER32(00A92390,?,00000FFF,?), ref: 00A3360A

Strings

"%s" (%d) : ==> %s:, xrefs: 00A33742
^ ERROR, xrefs: 00A336C9
Error: , xrefs: 00A336EF
Line %d (File "%s"):, xrefs: 00A3366B
"%s" (%d) : ==> %s:%s%s, xrefs: 00A33724

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 9d099aba199816a8f40b80d64a58038afbbfad38db7117388abedf8badd15d4c
Instruction ID: 3dfe3cee3e3a7a9a5cd1f29dba94d9a6a3a12c67675f44bb9b5e8b2f353ee087
Opcode Fuzzy Hash: 9d099aba199816a8f40b80d64a58038afbbfad38db7117388abedf8badd15d4c
Instruction Fuzzy Hash: 1B516B72D0020ABBDF14EBE0DD46FEEBB38AF44340F148129F105721A1EB305A99DBA1

Function 00A58B02 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009D9BB2

Part of subcall function 009D912D: GetCursorPos.USER32(?), ref: 009D9141
Part of subcall function 009D912D: ScreenToClient.USER32(00000000,?), ref: 009D915E
Part of subcall function 009D912D: GetAsyncKeyState.USER32(00000001), ref: 009D9183
Part of subcall function 009D912D: GetAsyncKeyState.USER32(00000002), ref: 009D919D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?,?), ref: 00A58B6B
ImageList_EndDrag.COMCTL32 ref: 00A58B71
ReleaseCapture.USER32 ref: 00A58B77
SetWindowTextW.USER32(?,00000000), ref: 00A58C12
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00A58C25
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?,?), ref: 00A58CFF

Strings

@GUI_DRAGFILE, xrefs: 00A58C9A
@GUI_DROPID, xrefs: 00A58C51

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 49fb5c4a35f54087e4f13235c991987acc3c3a9d752f1f625734a8601e37f115
Instruction ID: a2c9fbf947e658a5cebf53b8c841ca9662481e16fc0d193529782218c54f2675
Opcode Fuzzy Hash: 49fb5c4a35f54087e4f13235c991987acc3c3a9d752f1f625734a8601e37f115
Instruction Fuzzy Hash: 7051AC70604300AFD700EF60CC9AFAA77E4FB88715F000A2DF996672E1DB749909CB62

Function 00A3C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00A3C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00A3C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00A3C2CA
GetLastError.KERNEL32 ref: 00A3C322
SetEvent.KERNEL32(?), ref: 00A3C336
InternetCloseHandle.WININET(00000000), ref: 00A3C341

Strings

, xrefs: 00A3C2BB

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 7a2a062f4e718716671884571721ab220e7a0bdab03ab8e2ab6a5641fdfd0854
Instruction ID: 21ecadc133153b52e691adc6900676ab8025897685610b8533b1ac23a9c95c85
Opcode Fuzzy Hash: 7a2a062f4e718716671884571721ab220e7a0bdab03ab8e2ab6a5641fdfd0854
Instruction Fuzzy Hash: 75316BB1600308AFD721EFA49D88AABBBFCFB49764F14851EF446A7200DB34DD059B61

Function 00A2989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00A03AAF,?,?,Bad directive syntax error,00A5CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 00A298BC
LoadStringW.USER32(00000000,?,00A03AAF,?), ref: 00A298C3

Part of subcall function 009C9CB3: _wcslen.LIBCMT ref: 009C9CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00A29987

Strings

., xrefs: 00A2996D
Error: , xrefs: 00A29955
Line %d (File "%s"):, xrefs: 00A2992D
Line %d:, xrefs: 00A29912
%s (%d) : ==> %s.: %s %s, xrefs: 00A298F1

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 5f3dba15db2e947310edda89792828c6460a5810207107cd28a5ccadb8c0f72d
Instruction ID: db61908732acc9cc4f730683d0c0c6a4630617381dba5477b2fb1f28e4d20457
Opcode Fuzzy Hash: 5f3dba15db2e947310edda89792828c6460a5810207107cd28a5ccadb8c0f72d
Instruction Fuzzy Hash: 9B216B31D4021ABBDF11AF90DC0AFEE7739FF18700F04882AF519660A2EA319658DB11

Function 00A2209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00A220AB
GetClassNameW.USER32(00000000,?,00000100), ref: 00A220C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00A2214D

Strings

list, xrefs: 00A2212F
largeicons, xrefs: 00A220E1
smallicons, xrefs: 00A22115
details, xrefs: 00A220FB
SHELLDLL_DefView, xrefs: 00A220CC

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 2f092f4716b4a770c6d576b728d5725853ceca18ee8d1e5c188baf3d5cddc1ef
Instruction ID: 40fa0dd4af0c8073c0c5e5fa2c6dfd83c2841f6b881b820a0f00748c51c4b145
Opcode Fuzzy Hash: 2f092f4716b4a770c6d576b728d5725853ceca18ee8d1e5c188baf3d5cddc1ef
Instruction Fuzzy Hash: 9211E77AA88716B9F6017665EC0AEE637ACEF14334B200236FB04A50D1FE655D225718

Function 009F8D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee7b904fb85da3b0f44a599a8b6be82bb48e1cdb56ecea73b9aef6431d3b99fc
Instruction ID: 22f30bd5c1cb97e8eeefd3e9bcfe2860d1b49dbf751a11b5ad49ea1c0c213513
Opcode Fuzzy Hash: ee7b904fb85da3b0f44a599a8b6be82bb48e1cdb56ecea73b9aef6431d3b99fc
Instruction Fuzzy Hash: 45C1F475A0424DAFCB11DFA9D841BBEBBB4BF49310F18409AE614A7392CB359D41CB61

Function 009FCE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 009FCEB7
_free.LIBCMT ref: 009FCF22
_free.LIBCMT ref: 009FCF48
_free.LIBCMT ref: 009FCF71
_free.LIBCMT ref: 009FCFA9
_free.LIBCMT ref: 009FCFDA
_free.LIBCMT ref: 009FD01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 009FD09C
_free.LIBCMT ref: 009FD0B5

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 4fdb27b4b6715a9a18357bc025351570e74cc4017675db5f8ecd8b9b46514a7e
Instruction ID: a5404ddf25dcbbce005c6b01227dbdf8af0c46539cc397e41768558626701ab3
Opcode Fuzzy Hash: 4fdb27b4b6715a9a18357bc025351570e74cc4017675db5f8ecd8b9b46514a7e
Instruction Fuzzy Hash: 64614AB1A0430DAFDB21AFB49981B7EBBA9EF45350F04816EFB419B281DB319D018790

Function 00A550D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00A55186
ShowWindow.USER32(?,00000000), ref: 00A551C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 00A551CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 00A551D1

Part of subcall function 00A56FBA: DeleteObject.GDI32(00000000), ref: 00A56FE6

GetWindowLongW.USER32(?,000000F0), ref: 00A5520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00A5521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00A5524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00A55287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00A55296

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 907c32edd3a28a417a179961453b7841faf26ae70a819bcecfd5c746578b49db
Instruction ID: 0913c2a350449938e83e17379cf4799f7ee40227283e48aa1c2007e78c07f0ba
Opcode Fuzzy Hash: 907c32edd3a28a417a179961453b7841faf26ae70a819bcecfd5c746578b49db
Instruction Fuzzy Hash: D3518F30E50A08BEEF20AF74CC66BD93BB5FB15322F148112FE15966E0C775A988DB41

Function 009D8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00A16890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00A168A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00A168B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00A168D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00A168F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,009D8874,00000000,00000000,00000000,000000FF,00000000), ref: 00A16901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00A1691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,009D8874,00000000,00000000,00000000,000000FF,00000000), ref: 00A1692D

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 22144a6c0bba86b306839d8217eaf2462d78c15343bd456f5ce7bec7bc1a148a
Instruction ID: 23c7c6d811c38b28ec1093c531a93377bba6bb758189a1a9e1e8445b2aa4420b
Opcode Fuzzy Hash: 22144a6c0bba86b306839d8217eaf2462d78c15343bd456f5ce7bec7bc1a148a
Instruction Fuzzy Hash: 2B51A770640309AFDB20CF64CC95FAA7BB5FB48760F10891AF912D72A0DB78E991DB40

Function 00A3C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00A3C182
GetLastError.KERNEL32 ref: 00A3C195
SetEvent.KERNEL32(?), ref: 00A3C1A9

Part of subcall function 00A3C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00A3C272
Part of subcall function 00A3C253: GetLastError.KERNEL32 ref: 00A3C322
Part of subcall function 00A3C253: SetEvent.KERNEL32(?), ref: 00A3C336
Part of subcall function 00A3C253: InternetCloseHandle.WININET(00000000), ref: 00A3C341

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 19074fee050ae2b69a8df91ccf850a2abf3c504d0170a7160deb0aa4d85286c0
Instruction ID: c086b16b7af2cef39879392ac1115fa89f3fab25390a5b3911d3d2b4022adaf1
Opcode Fuzzy Hash: 19074fee050ae2b69a8df91ccf850a2abf3c504d0170a7160deb0aa4d85286c0
Instruction Fuzzy Hash: 7331AD71200705AFDB21AFE5DD04AABBBF8FF18321F00451DF956A6610D730E811EBA0

Function 00A225A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A23A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00A23A57
Part of subcall function 00A23A3D: GetCurrentThreadId.KERNEL32 ref: 00A23A5E
Part of subcall function 00A23A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00A225B3), ref: 00A23A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 00A225BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00A225DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00A225DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 00A225E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00A22601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00A22605
MapVirtualKeyW.USER32(00000025,00000000), ref: 00A2260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00A22623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00A22627

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: eb5ff3b719197696e6828b1152eddafa1f6d4babe30a748a96de5856c1516165
Instruction ID: 72f41db1474bf3037cb47f62c79c20b3fd5f7889cf83735b759789c9de85b1d3
Opcode Fuzzy Hash: eb5ff3b719197696e6828b1152eddafa1f6d4babe30a748a96de5856c1516165
Instruction Fuzzy Hash: 3501D831390720BBFB10A7A89C8AF593F99EB4EB62F100021F314AE1D5C9E614458A69

Function 00A21803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00A21449,?,?,00000000), ref: 00A2180C
HeapAlloc.KERNEL32(00000000,?,00A21449,?,?,00000000), ref: 00A21813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00A21449,?,?,00000000), ref: 00A21828
GetCurrentProcess.KERNEL32(?,00000000,?,00A21449,?,?,00000000), ref: 00A21830
DuplicateHandle.KERNEL32(00000000,?,00A21449,?,?,00000000), ref: 00A21833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00A21449,?,?,00000000), ref: 00A21843
GetCurrentProcess.KERNEL32(00A21449,00000000,?,00A21449,?,?,00000000), ref: 00A2184B
DuplicateHandle.KERNEL32(00000000,?,00A21449,?,?,00000000), ref: 00A2184E
CreateThread.KERNEL32(00000000,00000000,00A21874,00000000,00000000,00000000), ref: 00A21868

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 5fa010962e0b6b4119442f0c2e939298762a60e67f09be3a77cc9d6c20d5106b
Instruction ID: d622d8b65d7fc294c201bb71b8f02a9076502d8d9dcf8e53de61808a525ed6f3
Opcode Fuzzy Hash: 5fa010962e0b6b4119442f0c2e939298762a60e67f09be3a77cc9d6c20d5106b
Instruction Fuzzy Hash: B401A8B5640708BFE610EBA5DC49F6B7BACFB89B21F004511FA05DB1A5CA709841CB20

Function 00A4A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00A2D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 00A2D501
Part of subcall function 00A2D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 00A2D50F
Part of subcall function 00A2D4DC: CloseHandle.KERNEL32(00000000), ref: 00A2D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00A4A16D
GetLastError.KERNEL32 ref: 00A4A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00A4A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 00A4A268
GetLastError.KERNEL32(00000000), ref: 00A4A273
CloseHandle.KERNEL32(00000000), ref: 00A4A2C4

Strings

SeDebugPrivilege, xrefs: 00A4A18F

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: c784fbb44add528c0490a74e99635dac321b84ba451faf75c11452482592b3d6
Instruction ID: 2be7522708b51bf6ac4cff7b4ab264379872e02291b2ce69215832eb8e9743ed
Opcode Fuzzy Hash: c784fbb44add528c0490a74e99635dac321b84ba451faf75c11452482592b3d6
Instruction Fuzzy Hash: 51618F742443429FD710DF18C494F5ABBE1AFA4318F54849CE46A4B7A3C7B2ED46CB92

Function 00A53886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00A53925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00A5393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00A53954
_wcslen.LIBCMT ref: 00A53999
SendMessageW.USER32(?,00001057,00000000,?), ref: 00A539C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00A539F4

Strings

SysListView32, xrefs: 00A538F7

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 184969448054d604b9ad85b6af41027ae8e33ba0b798d2feb39d6db4a2ebf9e6
Instruction ID: cef958324c92eb24ef89d4788cd9b9ce14e06f366da1eab4d859dcb8f0013177
Opcode Fuzzy Hash: 184969448054d604b9ad85b6af41027ae8e33ba0b798d2feb39d6db4a2ebf9e6
Instruction Fuzzy Hash: 03419172A00319ABEF21DF64CC45BEA7BA9FF48391F100526F958E7281D7759E84CB90

Function 00A2BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A2BCFD
IsMenu.USER32(00000000), ref: 00A2BD1D
CreatePopupMenu.USER32 ref: 00A2BD53
GetMenuItemCount.USER32(015AC1B8), ref: 00A2BDA4
InsertMenuItemW.USER32(015AC1B8,?,00000001,00000030), ref: 00A2BDCC

Strings

2, xrefs: 00A2BD37
0, xrefs: 00A2BCA8

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 3845b95a520b1c6db6d0911503631a44aae587312c5f279bb4fe148341b85749
Instruction ID: c12c45fa74112f2377c1ffadb060de870918776238c834145b87532dc36f8a54
Opcode Fuzzy Hash: 3845b95a520b1c6db6d0911503631a44aae587312c5f279bb4fe148341b85749
Instruction Fuzzy Hash: 7C519C70A103259BDB10DFACE988BEEBBF4BF45324F148169E45197291E7709941CB61

Function 00A2C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00A2C913

Strings

question, xrefs: 00A2C8CC
stop, xrefs: 00A2C8E4
warning, xrefs: 00A2C8FC
blank, xrefs: 00A2C895
info, xrefs: 00A2C8B4

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: be6fff0c48c63f89e920c80d6efce394a11944409f3e01227ca0c7e35642982c
Instruction ID: 3ae0f581ef27fe770e2cdc067c9010c83d6792d501b0504f8ed624e27048cc82
Opcode Fuzzy Hash: be6fff0c48c63f89e920c80d6efce394a11944409f3e01227ca0c7e35642982c
Instruction Fuzzy Hash: 7D113D32689316BEF701AB58BC83DAE27ACDF19334B10003AF500A7282D7B05E4053A8

Function 00A2ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00A2ED2A
_wcslen.LIBCMT ref: 00A2ED3B
_wcslen.LIBCMT ref: 00A2ED79
_wcslen.LIBCMT ref: 00A2EDAF
_wcslen.LIBCMT ref: 00A2EDDF
_wcslen.LIBCMT ref: 00A2EDEF
_wcslen.LIBCMT ref: 00A2EE2B
_wcslen.LIBCMT ref: 00A2EE5A

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 31bf65e4a22e6f36d43859d9a6abcaa763d7082fe901afcabda2e2fd9f625614
Instruction ID: fecf3b83c5b56faa0f81d36a22a793f455db46bcb5a44e353a707c0e96d5e3c3
Opcode Fuzzy Hash: 31bf65e4a22e6f36d43859d9a6abcaa763d7082fe901afcabda2e2fd9f625614
Instruction Fuzzy Hash: F8419665C1025875CB12EBF6888ABCF77A8AF85750F504462E624F3222FB34E655C3E5

Function 009DF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00A1682C,00000004,00000000,00000000), ref: 009DF953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,00A1682C,00000004,00000000,00000000), ref: 00A1F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00A1682C,00000004,00000000,00000000), ref: 00A1F454

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 767684f6d9d5016411b6ae4400fea46cc13a60ae7e778467f450d882e7772c5b
Instruction ID: e32887da2a9b9ec5d230e4fd9b43f5f0673e450d80536fbcf2497c1de39f6163
Opcode Fuzzy Hash: 767684f6d9d5016411b6ae4400fea46cc13a60ae7e778467f450d882e7772c5b
Instruction Fuzzy Hash: 9A412A30A48BC0BEC739CB2988B976A7B95BB46360F14C43EE09B56B64D635A8C1C711

Function 00A52D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00A52D1B
GetDC.USER32(00000000), ref: 00A52D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A52D2E
ReleaseDC.USER32(00000000,00000000), ref: 00A52D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00A52D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00A52D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00A55A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00A52DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00A52DE1

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: fd586f3dea595a75a1a2b13a677c0a7f7231fb16b8f89cb5e1a1ff3846c20dbe
Instruction ID: ba27686fa9750dd47c8310d09ac92ca67f92ebb7c3476b7364c0d7277b23362c
Opcode Fuzzy Hash: fd586f3dea595a75a1a2b13a677c0a7f7231fb16b8f89cb5e1a1ff3846c20dbe
Instruction Fuzzy Hash: 93317C72201314BFEB118F50DC8AFEB3BA9FF0A726F044055FE08AA295C6759C51CBA4

Function 00A25622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00A25637
_memcmp.LIBVCRUNTIME ref: 00A25659
_memcmp.LIBVCRUNTIME ref: 00A25671
_memcmp.LIBVCRUNTIME ref: 00A25684
_memcmp.LIBVCRUNTIME ref: 00A2569E
_memcmp.LIBVCRUNTIME ref: 00A256B1
_memcmp.LIBVCRUNTIME ref: 00A256C9
_memcmp.LIBVCRUNTIME ref: 00A256E4

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 6b31a505825406c2427ccdbee23fbcf64827f92d111f919c041eed0ec94c93f8
Instruction ID: 26085453b9522d1b021574b408eee4cdac33ada9f945fafe9c592f017927ca58
Opcode Fuzzy Hash: 6b31a505825406c2427ccdbee23fbcf64827f92d111f919c041eed0ec94c93f8
Instruction Fuzzy Hash: E821C671E41A69BFD2159639AE82FFB335CBF61385F480430FD049A685F731ED1481A5

Function 00A44FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00A4502E, 00A45383
Not an Object type, xrefs: 00A45007

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 91b00ed529466ed99a930ffc6b186f3cf2ecfc420b57642f338ee61615145fd7
Instruction ID: 66c57d26816538262c30e8bd052666d73ad59977d80c6481e1add6e713b8f2e1
Opcode Fuzzy Hash: 91b00ed529466ed99a930ffc6b186f3cf2ecfc420b57642f338ee61615145fd7
Instruction Fuzzy Hash: BCD1C579E0060AAFDF10DFA8C891FAEB7B5BF88344F148569E915AB282D770DD41CB50

Function 00A01522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,00A017FB,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 00A015CE
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00A017FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00A01651
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00A017FB,?,00A017FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00A016E4
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00A017FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00A016FB

Part of subcall function 009F3820: RtlAllocateHeap.NTDLL(00000000,?,00A91444,?,009DFDF5,?,?,009CA976,00000010,00A91440,009C13FC,?,009C13C6,?,009C1129), ref: 009F3852

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,00A017FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00A01777
__freea.LIBCMT ref: 00A017A2
__freea.LIBCMT ref: 00A017AE

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: df0acc829f2e39c598079b7c7b229ba022d2c37f0aa1e7c66fe3b1b8c73fdc8a
Instruction ID: 629e0004947073b9f5506804952b5f74fe37e01b65e9784bb4216b1ebf6cb7ec
Opcode Fuzzy Hash: df0acc829f2e39c598079b7c7b229ba022d2c37f0aa1e7c66fe3b1b8c73fdc8a
Instruction Fuzzy Hash: 09919471E0021E9FDB208FA4ED81AEEBBB5AF89710F584659E901EB1C1D735DD41CB60

Function 00A44523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A44648
VariantInit.OLEAUT32(?), ref: 00A44749
VariantClear.OLEAUT32(?), ref: 00A44753
VariantClear.OLEAUT32(?), ref: 00A447B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00A4472C
Null Object assignment in FOR..IN loop, xrefs: 00A445D8, 00A44706, 00A447BE

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 6ebb397bb261e352eb758195a5368f48f75600a8852ea27c1e34fd113a5dac65
Instruction ID: cd9bb8ef91f97c671ab755a0fe3dd8f82b637ed3391e92d5b168b65f2df538ab
Opcode Fuzzy Hash: 6ebb397bb261e352eb758195a5368f48f75600a8852ea27c1e34fd113a5dac65
Instruction Fuzzy Hash: 10917275A00215AFDF20CFA5C848FAEBBB8FF8A715F108559F515AB280D7709945CFA0

Function 00A31187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 00A3125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00A31284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 00A312A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00A312D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00A3135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00A313C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00A31430

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 8cf91cebc2d25e153f1ae85cb3211f1fe0425768d80b2d1d953c152549d35b13
Instruction ID: 5d9bcf18b03634654ca06409898b0f307ff6321dab347a39eaad49e0db749a0d
Opcode Fuzzy Hash: 8cf91cebc2d25e153f1ae85cb3211f1fe0425768d80b2d1d953c152549d35b13
Instruction Fuzzy Hash: 7791BBB5A00308AFDB00DFA8C895BBEB7B5FF44325F108029F911EB291D774A942CB90

Function 009D948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 08e8478a1b84f8c9d9a214b3797e506c710d3f5f2b1d9d0c612bd0a7162af22d
Instruction ID: 70415f35a4ce1a9c5d3f7eed90e31ca86ee71d06b5038d509390a16091849ac3
Opcode Fuzzy Hash: 08e8478a1b84f8c9d9a214b3797e506c710d3f5f2b1d9d0c612bd0a7162af22d
Instruction Fuzzy Hash: B3913771D44219EFCB10DFA9CC84AEEBBB8FF49320F148556E915B7251D378AA42CB60

Function 00A43947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A4396B
CharUpperBuffW.USER32(?,?), ref: 00A43A7A
_wcslen.LIBCMT ref: 00A43A8A
VariantClear.OLEAUT32(?), ref: 00A43C1F

Part of subcall function 00A30CDF: VariantInit.OLEAUT32(00000000), ref: 00A30D1F
Part of subcall function 00A30CDF: VariantCopy.OLEAUT32(?,?), ref: 00A30D28
Part of subcall function 00A30CDF: VariantClear.OLEAUT32(?), ref: 00A30D34

Strings

AUTOIT.ERROR, xrefs: 00A43A80, 00A43A85
Incorrect Parameter format, xrefs: 00A439A6, 00A43BA1

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 19a430b84c28b963636d6acfa8e43ae63d2489de2f5a2b07d0b1b4fa69605fba
Instruction ID: 54c6768444538cf74f5112b348755246efae473b8d92413e90ef840e52365534
Opcode Fuzzy Hash: 19a430b84c28b963636d6acfa8e43ae63d2489de2f5a2b07d0b1b4fa69605fba
Instruction Fuzzy Hash: C3912575A083059FCB00EF64C481A6AB7E5FBC8314F14896DF88A97351DB31EE06CB92

Function 00A44BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00A2000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A1FF41,80070057,?,?,?,00A2035E), ref: 00A2002B
Part of subcall function 00A2000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A1FF41,80070057,?,?), ref: 00A20046
Part of subcall function 00A2000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A1FF41,80070057,?,?), ref: 00A20054
Part of subcall function 00A2000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A1FF41,80070057,?), ref: 00A20064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00A44C51
_wcslen.LIBCMT ref: 00A44D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00A44DCF
CoTaskMemFree.OLE32(?), ref: 00A44DDA

Strings

NULL Pointer assignment, xrefs: 00A44E23, 00A44E52

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: c7c2c8256a6a2f17b022e6cbab837743fbf747f9861af4d59d51a3447b9acfa9
Instruction ID: f392a8b7e3cdb4b011822ed0c9fba58127139b6a80f8b9bdfb54f8d512d1dd72
Opcode Fuzzy Hash: c7c2c8256a6a2f17b022e6cbab837743fbf747f9861af4d59d51a3447b9acfa9
Instruction Fuzzy Hash: 28912371D0021DAFDF10DFA4D891FEEB7B9BF88314F10816AE915A7241EB309A458FA1

Function 00A520FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00A52183
GetMenuItemCount.USER32(00000000), ref: 00A521B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00A521DD
_wcslen.LIBCMT ref: 00A52213
GetMenuItemID.USER32(?,?), ref: 00A5224D
GetSubMenu.USER32(?,?), ref: 00A5225B

Part of subcall function 00A23A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00A23A57
Part of subcall function 00A23A3D: GetCurrentThreadId.KERNEL32 ref: 00A23A5E
Part of subcall function 00A23A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00A225B3), ref: 00A23A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00A522E3

Part of subcall function 00A2E97B: Sleep.KERNEL32 ref: 00A2E9F3

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: bd9c2982bdbbb0be997b3e11721c5e1088bcbceab7e8354088d5d27e0f0e3493
Instruction ID: 71d2d517eef75bd4ca1e6d98441ccd1ffdd425eaccd3cf7c9ffcf1cbb3644b4e
Opcode Fuzzy Hash: bd9c2982bdbbb0be997b3e11721c5e1088bcbceab7e8354088d5d27e0f0e3493
Instruction Fuzzy Hash: 6A717E75E00205AFCB10DFA4C885BAEB7F1FF89321F148469E816EB341D734AE468B90

Function 00A2AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00A2AEF9
GetKeyboardState.USER32(?), ref: 00A2AF0E
SetKeyboardState.USER32(?), ref: 00A2AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 00A2AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 00A2AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 00A2AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00A2B020

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: e2412235ef9ed417ed04b6e42b3f461fcb77260eb78860e0a0b5d7211ba1028b
Instruction ID: 98b8c205a8aacec8425306c9af26ad7a17d41661f46e417403d8b27392f679ff
Opcode Fuzzy Hash: e2412235ef9ed417ed04b6e42b3f461fcb77260eb78860e0a0b5d7211ba1028b
Instruction Fuzzy Hash: D051E4A06187E53EFB37833C9D45BBA7FE95B06304F0884A9E1D9558C2C398ADC4D761

Function 00A2ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00A2AD19
GetKeyboardState.USER32(?), ref: 00A2AD2E
SetKeyboardState.USER32(?), ref: 00A2AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00A2ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00A2ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00A2AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00A2AE38

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 6b98179ae4b024ef44651cf7cb5ea11082e24ce4a4356f252c6524d35f830019
Instruction ID: c9cac96c878e4a76778ea29ffa22ca1acbbe313ede37835ab13344d64ea2f11c
Opcode Fuzzy Hash: 6b98179ae4b024ef44651cf7cb5ea11082e24ce4a4356f252c6524d35f830019
Instruction Fuzzy Hash: 4D5106A16047F13FFB3683389C55BBABEA96B55300F0884A8E1D5568C3D294EC85D762

Function 009F542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00A03CD6,?,?,?,?,?,?,?,?,009F5BA3,?,?,00A03CD6,?,?), ref: 009F5470
__fassign.LIBCMT ref: 009F54EB
__fassign.LIBCMT ref: 009F5506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00A03CD6,00000005,00000000,00000000), ref: 009F552C
WriteFile.KERNEL32(?,00A03CD6,00000000,009F5BA3,00000000,?,?,?,?,?,?,?,?,?,009F5BA3,?), ref: 009F554B
WriteFile.KERNEL32(?,?,00000001,009F5BA3,00000000,?,?,?,?,?,?,?,?,?,009F5BA3,?), ref: 009F5584

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 27cc4e38359b5fa17095d415452ea3615f7c01c22fb26d520bdd3e6f0a08f2b7
Instruction ID: 1165453c6e6a8b04f742a526fcc032ce816941365ea38b1788c12ee9d9209cc5
Opcode Fuzzy Hash: 27cc4e38359b5fa17095d415452ea3615f7c01c22fb26d520bdd3e6f0a08f2b7
Instruction Fuzzy Hash: EA51C071A00749AFDB10CFA8D885AEEBBF9FF09310F15451AFA55E7291D7309A41CB60

Function 009E2D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 009E2D4B
___except_validate_context_record.LIBVCRUNTIME ref: 009E2D53
_ValidateLocalCookies.LIBCMT ref: 009E2DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 009E2E0C
_ValidateLocalCookies.LIBCMT ref: 009E2E61

Strings

csm, xrefs: 009E2DF6

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: d2f50e24c62c868baccc0f652450a4ae48dc5f8792a6c7eb2e548caf9c7b064e
Instruction ID: 970970c67ef3ccbec44202e6ef53f88c4a35f5e35629603493f2e5fa15bd1b18
Opcode Fuzzy Hash: d2f50e24c62c868baccc0f652450a4ae48dc5f8792a6c7eb2e548caf9c7b064e
Instruction Fuzzy Hash: 8E41B234E00289EBCF11DF6ACC45B9EBBB9BF84324F148155E914AB392D771AE41CB90

Function 00A410B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00A4304E: inet_addr.WSOCK32(?), ref: 00A4307A
Part of subcall function 00A4304E: _wcslen.LIBCMT ref: 00A4309B

socket.WSOCK32(00000002,00000001,00000006), ref: 00A41112
WSAGetLastError.WSOCK32 ref: 00A41121
WSAGetLastError.WSOCK32 ref: 00A411C9
closesocket.WSOCK32(00000000), ref: 00A411F9

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 9c8b10a81f44f0b4c6e0d824a60ccad193b921c8921aef0510b07a6850be8f4c
Instruction ID: 6847f8b71a16599638dc736ec40ad5bd733c7fcaecaf0a113f4f0cb68d11682d
Opcode Fuzzy Hash: 9c8b10a81f44f0b4c6e0d824a60ccad193b921c8921aef0510b07a6850be8f4c
Instruction Fuzzy Hash: 2341F435600204AFDB10DF68C884BA9BBE9FF85325F14815DF9099B295D770AE82CBE1

Function 00A2CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A2DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00A2CF22,?), ref: 00A2DDFD

Part of subcall function 00A2DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00A2CF22,?), ref: 00A2DE16

lstrcmpiW.KERNEL32(?,?), ref: 00A2CF45
MoveFileW.KERNEL32(?,?), ref: 00A2CF7F
_wcslen.LIBCMT ref: 00A2D005
_wcslen.LIBCMT ref: 00A2D01B
SHFileOperationW.SHELL32(?), ref: 00A2D061

Strings

\*.*, xrefs: 00A2CFF3

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 858386d9af6da6a1ef110c2c03a765f186d3a7b51838f474de1c5384a3c46c3a
Instruction ID: c7e9f68f40f12babb2a1102471f1beb4aa79e289e2ee3c54618a87f552034010
Opcode Fuzzy Hash: 858386d9af6da6a1ef110c2c03a765f186d3a7b51838f474de1c5384a3c46c3a
Instruction Fuzzy Hash: 8F4176718452285FDF12EBA8DA81FDDB7B9AF48790F1000F6E545EB142EA34AA84CB50

Function 00A52DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00A52E1C
GetWindowLongW.USER32(00000000,000000F0), ref: 00A52E4F
GetWindowLongW.USER32(00000000,000000F0), ref: 00A52E84
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00A52EB6
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00A52EE0
GetWindowLongW.USER32(00000000,000000F0), ref: 00A52EF1
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00A52F0B

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 2c702d6fe918643b6a3269f21077f74e94b654190e34b2311dd05968b298df45
Instruction ID: 022aee297edbf8752b1bfccf3c4e5d046e8119f14b3c94e37770a63fe68a537d
Opcode Fuzzy Hash: 2c702d6fe918643b6a3269f21077f74e94b654190e34b2311dd05968b298df45
Instruction Fuzzy Hash: DC310330644251AFEB21CF98EC86F653BE1FB9A722F150165FD008F2B6CB75A849DB41

Function 00A27726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A27769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A2778F
SysAllocString.OLEAUT32(00000000), ref: 00A27792
SysAllocString.OLEAUT32(?), ref: 00A277B0
SysFreeString.OLEAUT32(?), ref: 00A277B9
StringFromGUID2.OLE32(?,?,00000028), ref: 00A277DE
SysAllocString.OLEAUT32(?), ref: 00A277EC

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 83f0ff989202acc4a080b72462f852bb309ccb52ee0785cc95b8faf949dbe53f
Instruction ID: b75a0df1b386a1887ac290eedd5bf38d8a4f42522bf1a9488e88ec1b33e6c0df
Opcode Fuzzy Hash: 83f0ff989202acc4a080b72462f852bb309ccb52ee0785cc95b8faf949dbe53f
Instruction Fuzzy Hash: 51217C76604229AFDB10DFACDC88DBE77ACFB09764B048135FA15DB254D6709E428760

Function 00A277FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A27842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A27868
SysAllocString.OLEAUT32(00000000), ref: 00A2786B
SysAllocString.OLEAUT32 ref: 00A2788C
SysFreeString.OLEAUT32 ref: 00A27895
StringFromGUID2.OLE32(?,?,00000028), ref: 00A278AF
SysAllocString.OLEAUT32(?), ref: 00A278BD

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 11dd46e00924450a52b7c0c2c9c6b9ca0cdb29999547fac7ef9cdee997b4d488
Instruction ID: d3ca7766327b0fa63df4cbc0246ed0bc053be1d41cafea352c68b917eca0ded8
Opcode Fuzzy Hash: 11dd46e00924450a52b7c0c2c9c6b9ca0cdb29999547fac7ef9cdee997b4d488
Instruction Fuzzy Hash: 49215E36608224AFDB109BEDEC8DDAA77ECFB097607108125F915CB2A5E670DD81CB64

Function 00A304D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00A304F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00A3052E

Strings

nul, xrefs: 00A30567

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 123897e87d29d431a23bd6fe19828c88b508a2fd87200a026670faf0c349e4ad
Instruction ID: 2e9258b09b9b833c2252c235592fdd770ab74d9d8f61913b1755b0fb43d7443f
Opcode Fuzzy Hash: 123897e87d29d431a23bd6fe19828c88b508a2fd87200a026670faf0c349e4ad
Instruction Fuzzy Hash: F8214A75600305AFDF209F69DC54E9ABBB4BF54765F208A19F8A1E72E0E7709981CF20

Function 00A305A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00A305C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00A30601

Strings

nul, xrefs: 00A30639

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: ac7d1fcb6bf9b314e771ee6ead18e6aecf290ae94e87e29dd8d0746e3d758f9a
Instruction ID: 0e8a2674fd9c68ef4db527165c30455cab90c9284f544f534035fe98b7cfa226
Opcode Fuzzy Hash: ac7d1fcb6bf9b314e771ee6ead18e6aecf290ae94e87e29dd8d0746e3d758f9a
Instruction Fuzzy Hash: 452181755003059FDB209F69DC15E9ABBE8BF95B30F200A19F8A1E72E8D7B09861CB10

Function 00A540AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009C600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 009C604C
Part of subcall function 009C600E: GetStockObject.GDI32(00000011), ref: 009C6060
Part of subcall function 009C600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 009C606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00A54112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00A5411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00A5412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00A54139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00A54145

Strings

Msctls_Progress32, xrefs: 00A540E3

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: de764536c061e533d0c05dd3ee33c48d84c36d1e1f4e9dc3ce1616e2502e03e2
Instruction ID: 89b39b4bf5b3551c8ba924adc1e950b4fc76b627e6c909fe5b33cd1adc8ae567
Opcode Fuzzy Hash: de764536c061e533d0c05dd3ee33c48d84c36d1e1f4e9dc3ce1616e2502e03e2
Instruction Fuzzy Hash: 3511B6B11402197EEF119F64CC85EE77F5DFF18798F104111BA18A2050C776DC61DBA4

Function 009FD7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009FD7A3: _free.LIBCMT ref: 009FD7CC

_free.LIBCMT ref: 009FD82D

Part of subcall function 009F29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,009FD7D1,00000000,00000000,00000000,00000000,?,009FD7F8,00000000,00000007,00000000,?,009FDBF5,00000000), ref: 009F29DE
Part of subcall function 009F29C8: GetLastError.KERNEL32(00000000,?,009FD7D1,00000000,00000000,00000000,00000000,?,009FD7F8,00000000,00000007,00000000,?,009FDBF5,00000000,00000000), ref: 009F29F0

_free.LIBCMT ref: 009FD838
_free.LIBCMT ref: 009FD843
_free.LIBCMT ref: 009FD897
_free.LIBCMT ref: 009FD8A2
_free.LIBCMT ref: 009FD8AD
_free.LIBCMT ref: 009FD8B8

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 44caa126003322478b66d817fd61cf4af55d29d2f87bc6801ffe68ce9552bbc2
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 481151B1582B0CAAE521BFB0CC47FEB7BDD6F80710F400825B399AA0A2DA65B5454750

Function 00A2DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00A2DA74
LoadStringW.USER32(00000000), ref: 00A2DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00A2DA91
LoadStringW.USER32(00000000), ref: 00A2DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00A2DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00A2DAB9

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: bc1ab289d7b1bc2e760a59bea3f90ad90e1393de7d9b94d461687d636ba9a6f7
Instruction ID: 3eff78d89a8140595d94ab53e94f4b4a901b3b26c7b2858fb1480e1e4077c83b
Opcode Fuzzy Hash: bc1ab289d7b1bc2e760a59bea3f90ad90e1393de7d9b94d461687d636ba9a6f7
Instruction Fuzzy Hash: 3F0162F25003187FE710EBE49D89EEB326CF708716F4045A1B706E2046EA749E858F74

Function 00A3096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0159D550,0159D550), ref: 00A3097B
EnterCriticalSection.KERNEL32(0159D530,00000000), ref: 00A3098D
TerminateThread.KERNEL32(00000009,000001F6), ref: 00A3099B
WaitForSingleObject.KERNEL32(00000009,000003E8), ref: 00A309A9
CloseHandle.KERNEL32(00000009), ref: 00A309B8
InterlockedExchange.KERNEL32(0159D550,000001F6), ref: 00A309C8
LeaveCriticalSection.KERNEL32(0159D530), ref: 00A309CF

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 5f4cee97581f78b9dbe2a07d0ffa6e2e5195d3d4e92f1ecf88dd094054159b24
Instruction ID: 62e56c5480f10bd5082c917ba0231d11a4f05025d1b137b389e8eed819176691
Opcode Fuzzy Hash: 5f4cee97581f78b9dbe2a07d0ffa6e2e5195d3d4e92f1ecf88dd094054159b24
Instruction Fuzzy Hash: 3CF01D31442B12AFD741AB94EE88BDABA25FF01712F401015F202548A4CB749466CF90

Function 00A41C60 Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?), ref: 00A41DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00A41DE1
WSAGetLastError.WSOCK32 ref: 00A41DF2
htons.WSOCK32(?), ref: 00A41EDB
inet_ntoa.WSOCK32(?), ref: 00A41E8C

Part of subcall function 00A239E8: _strlen.LIBCMT ref: 00A239F2

Part of subcall function 00A43224: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,00A3EC0C), ref: 00A43240

_strlen.LIBCMT ref: 00A41F35

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
String ID:
API String ID: 3203458085-0
Opcode ID: 88e782ea9c2ee3d28b0c55d27cbf4864baed823af9de2d9aac72564153d9d00f
Instruction ID: a900cc11b316dbf5f6a7f1b5abee7ec3f06faad5cefc9a152cf59ee2ce4ac245
Opcode Fuzzy Hash: 88e782ea9c2ee3d28b0c55d27cbf4864baed823af9de2d9aac72564153d9d00f
Instruction Fuzzy Hash: F7B1CD39604340AFC324DF24C895F2A7BA5AFC4318F54894DF45A5B2E2DB71ED86CB92

Function 009F01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 009F00BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009F00D6
__allrem.LIBCMT ref: 009F00ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009F010B
__allrem.LIBCMT ref: 009F0122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009F0140

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction ID: 6d83fda93c773b68462c7e3a679fdf52a875278de0e7c25f28254b384f15110c
Opcode Fuzzy Hash: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction Fuzzy Hash: 2181E672B00B0A9BE7219F69CC51B7A73EDEF81724F24453AF651D6682EB70DD008B50

Function 009F61FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,009E82D9,009E82D9,?,?,?,009F644F,00000001,00000001,8BE85006), ref: 009F6258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,009F644F,00000001,00000001,8BE85006,?,?,?), ref: 009F62DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 009F63D8
__freea.LIBCMT ref: 009F63E5

Part of subcall function 009F3820: RtlAllocateHeap.NTDLL(00000000,?,00A91444,?,009DFDF5,?,?,009CA976,00000010,00A91440,009C13FC,?,009C13C6,?,009C1129), ref: 009F3852

__freea.LIBCMT ref: 009F63EE
__freea.LIBCMT ref: 009F6413

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 4ed47ea5dcab834b2a90f225a045049738748f06bace5ad4bbfb799bbee46e9a
Instruction ID: 9c915a6c766733d21bb0f96ed3f08f69a32520caa420762abfe7edb788ee49f7
Opcode Fuzzy Hash: 4ed47ea5dcab834b2a90f225a045049738748f06bace5ad4bbfb799bbee46e9a
Instruction Fuzzy Hash: 6F51DF72A0031AABEB258F64CC81FBF77AAEB94760F154629FA05D7140DB74DC44C7A0

Function 00A4BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009C9CB3: _wcslen.LIBCMT ref: 009C9CBD

Part of subcall function 00A4C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A4B6AE,?,?), ref: 00A4C9B5
Part of subcall function 00A4C998: _wcslen.LIBCMT ref: 00A4C9F1
Part of subcall function 00A4C998: _wcslen.LIBCMT ref: 00A4CA68
Part of subcall function 00A4C998: _wcslen.LIBCMT ref: 00A4CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A4BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00A4BD25
RegCloseKey.ADVAPI32(00000000), ref: 00A4BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00A4BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00A4BDF3
RegCloseKey.ADVAPI32(?), ref: 00A4BDFF

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: f90f52629bf61ab2db656a5911bd5cb78da945317680e360782eea63c2a3d334
Instruction ID: d639215aa0bc5b7aa8c5ee623c848c7c965b199e5ab65e8e75dae41cf791f747
Opcode Fuzzy Hash: f90f52629bf61ab2db656a5911bd5cb78da945317680e360782eea63c2a3d334
Instruction Fuzzy Hash: 4A816C34618241AFD714DF24C895E2ABBE5FFC4318F14899CF4594B2A2DB31ED45CBA2

Function 00A1F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 00A1F7B9
SysAllocString.OLEAUT32(00000001), ref: 00A1F860
VariantCopy.OLEAUT32(00A1FA64,00000000), ref: 00A1F889
VariantClear.OLEAUT32(00A1FA64), ref: 00A1F8AD
VariantCopy.OLEAUT32(00A1FA64,00000000), ref: 00A1F8B1
VariantClear.OLEAUT32(?), ref: 00A1F8BB

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: b5f6830749a95fd8cfc4463c9abee1d5e1e549290b87bcdf374799bdd3e54c0d
Instruction ID: 613fc56f2b1c4a11272abb5bb5d2f21ac6553de4f0a0886610ba59ee78e61b63
Opcode Fuzzy Hash: b5f6830749a95fd8cfc4463c9abee1d5e1e549290b87bcdf374799bdd3e54c0d
Instruction Fuzzy Hash: 2B51C735500390BFCF10AB65D895BA9B3B9EF45710F24846BF806DF295DB708C80CB96

Function 00A3910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 009C7620: _wcslen.LIBCMT ref: 009C7625

Part of subcall function 009C6B57: _wcslen.LIBCMT ref: 009C6B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 00A394E5
_wcslen.LIBCMT ref: 00A39506
_wcslen.LIBCMT ref: 00A3952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00A39585

Strings

X, xrefs: 00A39412

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 609eabef86b7a4d1629093798a4c22312ef9152a5b4fef40bf42ecd54a4e75c3
Instruction ID: d8b51d059d8ac962ffb958bafaf98d81d451af176eab10800d71809e77624743
Opcode Fuzzy Hash: 609eabef86b7a4d1629093798a4c22312ef9152a5b4fef40bf42ecd54a4e75c3
Instruction Fuzzy Hash: 2DE17B71A083409FD724EF24C885F6AB7E4BF84314F04896DF8999B2A2DB71DD45CB92

Function 009D920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 009D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009D9BB2

BeginPaint.USER32(?,?,?), ref: 009D9241
GetWindowRect.USER32(?,?), ref: 009D92A5
ScreenToClient.USER32(?,?), ref: 009D92C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 009D92D3
EndPaint.USER32(?,?,?,?,?), ref: 009D9321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00A171EA

Part of subcall function 009D9339: BeginPath.GDI32(00000000), ref: 009D9357

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 9ed566b442f2045092ae5bd241658bd0fc5a4f23703a44a7ce96b7f0dd1f1ff5
Instruction ID: a4f98d113d95cf1fb1f1d62634e2d1717c87c0fc03de78b771d907cb995a3437
Opcode Fuzzy Hash: 9ed566b442f2045092ae5bd241658bd0fc5a4f23703a44a7ce96b7f0dd1f1ff5
Instruction Fuzzy Hash: B941B030244301AFD711EFA4DC84FBA7BB8FB45761F14462AFA64972B1C7319846DB61

Function 00A307EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00A3080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00A30847
EnterCriticalSection.KERNEL32(?), ref: 00A30863
LeaveCriticalSection.KERNEL32(?), ref: 00A308DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00A308F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00A30921

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: f1c45b2cc102b1eb759e0859a7a2ed7ec0ee2e8abeb3b5562c4fa2c47a5a508f
Instruction ID: 4fedb1d12b0eb6a4de78d1b857fec03937c1b6b199ebe0242f5799075b847367
Opcode Fuzzy Hash: f1c45b2cc102b1eb759e0859a7a2ed7ec0ee2e8abeb3b5562c4fa2c47a5a508f
Instruction Fuzzy Hash: 94416A71900205EFDF15EF94DC85AAAB7B8FF44310F1480A9FD059A29ADB30DE61DBA0

Function 00A581DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,00A1F3AB,00000000,?,?,00000000,?,00A1682C,00000004,00000000,00000000), ref: 00A5824C
EnableWindow.USER32(00000000,00000000), ref: 00A58272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00A582D1
ShowWindow.USER32(00000000,00000004), ref: 00A582E5
EnableWindow.USER32(00000000,00000001), ref: 00A5830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00A5832F

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: daf8aa955616f003ea9b9ea77291a005614bf4910b7bad173096a44049488403
Instruction ID: 03ee6c846c8fbf17d3c039adc3292fd1f4d458b98839c9c5f3c865aa191c45d1
Opcode Fuzzy Hash: daf8aa955616f003ea9b9ea77291a005614bf4910b7bad173096a44049488403
Instruction Fuzzy Hash: 3641D530601740AFDF12CF54C899BE87BE0FB0A726F184169E9189F272CB35A84ACF40

Function 00A24C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00A24C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00A24CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00A24CEA
_wcslen.LIBCMT ref: 00A24D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00A24D10
_wcsstr.LIBVCRUNTIME ref: 00A24D1A

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 329f8e29a4de6cd47561baf75fdf4e47f4f8789d1a81b89cbd543d29969552f3
Instruction ID: 12246e373b8ec9051f63942e9d61c66ab54254c52c177afac1f335ad5eb97b2b
Opcode Fuzzy Hash: 329f8e29a4de6cd47561baf75fdf4e47f4f8789d1a81b89cbd543d29969552f3
Instruction Fuzzy Hash: FA21D7722042107BEB159B7DAC4AE7B7BACDF49760F10803AF805CA192EA65DD0196A0

Function 00A3581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 009C3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009C3A97,?,?,009C2E7F,?,?,?,00000000), ref: 009C3AC2

_wcslen.LIBCMT ref: 00A3587B
CoInitialize.OLE32(00000000), ref: 00A35995
CoCreateInstance.OLE32(00A5FCF8,00000000,00000001,00A5FB68,?), ref: 00A359AE
CoUninitialize.OLE32 ref: 00A359CC

Strings

.lnk, xrefs: 00A35876, 00A358C1, 00A35985

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 2a3fade1a11e507a7d645c0e97224e870b9a3cf96fea2608597214a313a992c5
Instruction ID: 77115dcb78eca86dea337c100989d110a0f1b10dc61149803eff26b5abba703a
Opcode Fuzzy Hash: 2a3fade1a11e507a7d645c0e97224e870b9a3cf96fea2608597214a313a992c5
Instruction Fuzzy Hash: 36D13F71A087019FC714DF28C484A2ABBE5FF89724F14895DF88A9B361DB31ED45CB92

Function 00A2175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A20FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00A20FCA
Part of subcall function 00A20FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00A20FD6
Part of subcall function 00A20FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00A20FE5
Part of subcall function 00A20FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00A20FEC
Part of subcall function 00A20FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00A21002

GetLengthSid.ADVAPI32(?,00000000,00A21335), ref: 00A217AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00A217BA
HeapAlloc.KERNEL32(00000000), ref: 00A217C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 00A217DA
GetProcessHeap.KERNEL32(00000000,00000000,00A21335), ref: 00A217EE
HeapFree.KERNEL32(00000000), ref: 00A217F5

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 26aecefc009bf473cfae1e515bd95a75ec0f84eba84a000361f2e0b06f65f6a3
Instruction ID: 37e322c2237fa6e27f1a651cb898078b3a7f1c029dc3b9e817b69e89d0c55df5
Opcode Fuzzy Hash: 26aecefc009bf473cfae1e515bd95a75ec0f84eba84a000361f2e0b06f65f6a3
Instruction Fuzzy Hash: 4C119A31500725EFDB10DFA8EC49FAE7BA9FB95366F104128F48197211D735A941CFA0

Function 00A214CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00A214FF
OpenProcessToken.ADVAPI32(00000000), ref: 00A21506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00A21515
CloseHandle.KERNEL32(00000004), ref: 00A21520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00A2154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00A21563

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: d1c331e70677ceef0788a1489e138fcc5ac294f9ec3ebb026433ce5edae889ec
Instruction ID: 3531b80786a4f5d1717a5f948305c14e71a2d0889a8c8271a12646cd5753e06e
Opcode Fuzzy Hash: d1c331e70677ceef0788a1489e138fcc5ac294f9ec3ebb026433ce5edae889ec
Instruction Fuzzy Hash: 431144B250020DAFDB11CFA8ED49FDA7BA9FB48719F044064FA05A20A0C3768E61DB60

Function 009E3382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,009E3379,009E2FE5), ref: 009E3390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 009E339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 009E33B7
SetLastError.KERNEL32(00000000,?,009E3379,009E2FE5), ref: 009E3409

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 2a484c23c775c83537c60e02e7c48cbd94784fe08d9a94cbe17ace4cef15b9d1
Instruction ID: e18cb16184b849f6355636b67814ce9433ec07b6a89e02d5cb75fbd3da38d57e
Opcode Fuzzy Hash: 2a484c23c775c83537c60e02e7c48cbd94784fe08d9a94cbe17ace4cef15b9d1
Instruction Fuzzy Hash: 8E012832208751BFE72727B7FC8EA662AA8EB457B57308229F410871F0FF614D025A64

Function 009F2D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,009F5686,00A03CD6,?,00000000,?,009F5B6A,?,?,?,?,?,009EE6D1,?,00A88A48), ref: 009F2D78
_free.LIBCMT ref: 009F2DAB
_free.LIBCMT ref: 009F2DD3
SetLastError.KERNEL32(00000000,?,?,?,?,009EE6D1,?,00A88A48,00000010,009C4F4A,?,?,00000000,00A03CD6), ref: 009F2DE0
SetLastError.KERNEL32(00000000,?,?,?,?,009EE6D1,?,00A88A48,00000010,009C4F4A,?,?,00000000,00A03CD6), ref: 009F2DEC
_abort.LIBCMT ref: 009F2DF2

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 781d43eed886a7a21b58f41bebb0b78d744b7f2519d9ea0b818ad35acdd6641b
Instruction ID: c6a11bbe99ad3460f61fe65f04af7a0a15a4199d76bce4fd91546fc9df160e61
Opcode Fuzzy Hash: 781d43eed886a7a21b58f41bebb0b78d744b7f2519d9ea0b818ad35acdd6641b
Instruction Fuzzy Hash: 4AF0F431545B0C2BC2126774BC0AF7A265DBFC27B1F214518FB24971E6EE2888024320

Function 00A58A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 009D9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 009D9693
Part of subcall function 009D9639: SelectObject.GDI32(?,00000000), ref: 009D96A2
Part of subcall function 009D9639: BeginPath.GDI32(?), ref: 009D96B9
Part of subcall function 009D9639: SelectObject.GDI32(?,00000000), ref: 009D96E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00A58A4E
LineTo.GDI32(?,00000003,00000000), ref: 00A58A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00A58A70
LineTo.GDI32(?,00000000,00000003), ref: 00A58A80
EndPath.GDI32(?), ref: 00A58A90
StrokePath.GDI32(?), ref: 00A58AA0

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: a6f12be63bec60b261dd4e114f91a6404ae471ada204548fefb5f83ae465ea80
Instruction ID: cb39401e3f09484ed1a44951059a37c45c33645ec3e23e16fb13209c8364facb
Opcode Fuzzy Hash: a6f12be63bec60b261dd4e114f91a6404ae471ada204548fefb5f83ae465ea80
Instruction Fuzzy Hash: 2811FA76000209FFDF119FD0DC88EAA7F6CFB043A1F048012BA15951A1C7719D56DB60

Function 00A251FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00A25218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00A25229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A25230
ReleaseDC.USER32(00000000,00000000), ref: 00A25238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00A2524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00A25261

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: ec8b84313eab89c88dd68d892dbaa0fcd036efc3ad195a598cfd04f4b906c712
Instruction ID: 46b919f025f80c9d3650ac21726d8f080fda1b3df3d9d13bdfd1f88a4f39589a
Opcode Fuzzy Hash: ec8b84313eab89c88dd68d892dbaa0fcd036efc3ad195a598cfd04f4b906c712
Instruction Fuzzy Hash: 18014F75E00718BFEB109BF99C49A9EBFB8FF48762F044065FA04A7285D6709901CBA0

Function 009C1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 009C1BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 009C1BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 009C1C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 009C1C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 009C1C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 009C1C22

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: c407002500a2bbd5898746fe3d60fa32d5f5ad510b18c5b2ce6054823c12cd18
Instruction ID: 51e9c427b8d3cb60cfc0559d9ad52e9a8ea3171e8bf38dc2ac342fbd4367f2aa
Opcode Fuzzy Hash: c407002500a2bbd5898746fe3d60fa32d5f5ad510b18c5b2ce6054823c12cd18
Instruction Fuzzy Hash: E80167B0902B5ABDE3008F6A8C85B52FFA8FF19354F00411BA15C4BA42C7F5A864CBE5

Function 00A2EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00A2EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00A2EB46
GetWindowThreadProcessId.USER32(?,?), ref: 00A2EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00A2EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00A2EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00A2EB75

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: e85543da0b3f463bc6ee0f386937fc9765154cbdb5e37769769e220c0f2e2315
Instruction ID: 0c7e86555d45c2b58d94884bdba392e16280a14173a0c667a3ea7e3f78bd8ddf
Opcode Fuzzy Hash: e85543da0b3f463bc6ee0f386937fc9765154cbdb5e37769769e220c0f2e2315
Instruction Fuzzy Hash: 0CF01D72240758BFE62197929C0DEAB7A7CFBCAB22F004158F601D109596A45A4286B5

Function 00A17439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00A17452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00A17469
GetWindowDC.USER32(?), ref: 00A17475
GetPixel.GDI32(00000000,?,?), ref: 00A17484
ReleaseDC.USER32(?,00000000), ref: 00A17496
GetSysColor.USER32(00000005), ref: 00A174B0

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 88d438d942bfb536f5660e2efe6d53e33cc03982ac960911670bd27e6aa7e2fa
Instruction ID: 7115640b6d2f84ab27346bcfbf18caabb29bc0932462ea9e7235f5bdb2c8f066
Opcode Fuzzy Hash: 88d438d942bfb536f5660e2efe6d53e33cc03982ac960911670bd27e6aa7e2fa
Instruction Fuzzy Hash: 4A018631440305EFEB519FA4DC08BEE7BB5FB04322F201160F916A31A0CB311E82EB10

Function 00A21874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A2187F
UnloadUserProfile.USERENV(?,?), ref: 00A2188B
CloseHandle.KERNEL32(?), ref: 00A21894
CloseHandle.KERNEL32(?), ref: 00A2189C
GetProcessHeap.KERNEL32(00000000,?), ref: 00A218A5
HeapFree.KERNEL32(00000000), ref: 00A218AC

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: d5b33c0a827b1587be1838579e54fcec40ef31991e066a678d16e93f36798c28
Instruction ID: 37e6e74aef339838fa05d0353f23f01b70714713bef854e9e944427e19cdb884
Opcode Fuzzy Hash: d5b33c0a827b1587be1838579e54fcec40ef31991e066a678d16e93f36798c28
Instruction Fuzzy Hash: D4E0C236004705BFDA019BE1ED0C90ABB69FB49B32B108220F22685478CB32A4A2DB50

Function 00A2C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009C7620: _wcslen.LIBCMT ref: 009C7625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00A2C6EE
_wcslen.LIBCMT ref: 00A2C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00A2C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00A2C7CA

Strings

0, xrefs: 00A2C6AF

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: fbeaa55c1af01c1c90b9bd5c76b54b867927559d65f91befee184b6e48d54919
Instruction ID: 83cbebaf6d02694e6fbd24a26ef22d97a9696ca499745d2122e0dc0c476873a7
Opcode Fuzzy Hash: fbeaa55c1af01c1c90b9bd5c76b54b867927559d65f91befee184b6e48d54919
Instruction Fuzzy Hash: 2551CC716043619BD7159F2CE885B6EB7E8AF89320F040A3DF995E32A1DB64DD04CB92

Function 00A4AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 00A4AEA3

Part of subcall function 009C7620: _wcslen.LIBCMT ref: 009C7625

GetProcessId.KERNEL32(00000000), ref: 00A4AF38
CloseHandle.KERNEL32(00000000), ref: 00A4AF67

Strings

@, xrefs: 00A4AE72
<, xrefs: 00A4AE6B

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 97747bf115f5960eef804cc761efeb8e8e8aae6904dfa825de78c3749e9a731e
Instruction ID: 1bc0dcfaa4502aaf5a3b4070beec89cd7b0182bf65523250eb6a487282a21942
Opcode Fuzzy Hash: 97747bf115f5960eef804cc761efeb8e8e8aae6904dfa825de78c3749e9a731e
Instruction Fuzzy Hash: BE714675A00619DFCB14DF94C485A9EBBF0BF88314F04849DE81AAB362CB74ED45CB92

Function 00A2719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00A27206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00A2723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00A2724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00A272CF

Strings

DllGetClassObject, xrefs: 00A27242

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: a791f42b6e3e5113fe61bd8c3da1662ce6975c09e132d79e434c7ff4c97713a1
Instruction ID: 25549621343fdb8f2cd52e5d6e0e893a8b617803f395b12e98d3728b2cb6d51d
Opcode Fuzzy Hash: a791f42b6e3e5113fe61bd8c3da1662ce6975c09e132d79e434c7ff4c97713a1
Instruction Fuzzy Hash: BE413971A04314EFDB15CF98D884A9E7BB9EF44710F1580A9FD059F20AD7B1DA45CBA0

Function 00A21DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009C9CB3: _wcslen.LIBCMT ref: 009C9CBD

Part of subcall function 00A23CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00A23CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00A21E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00A21E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00A21EA9

Part of subcall function 009C6B57: _wcslen.LIBCMT ref: 009C6B6A

Strings

ListBox, xrefs: 00A21E25
ComboBox, xrefs: 00A21DF0

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: d61f06dc3381b36afc40c9ecf6eb4e1850ffb34a686992882d32c69d0c68a540
Instruction ID: 6fee2507ee273df6297466753b304b081362fb42763243c09be16c2111b9140e
Opcode Fuzzy Hash: d61f06dc3381b36afc40c9ecf6eb4e1850ffb34a686992882d32c69d0c68a540
Instruction Fuzzy Hash: 7D212C71D00104BFDB14ABA8EC59DFF77B8EF95360B104539F825A71D1DB384D0A8620

Function 00A52F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00A52F8D
LoadLibraryW.KERNEL32(?), ref: 00A52F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00A52FA9
DestroyWindow.USER32(?), ref: 00A52FB1

Strings

SysAnimate32, xrefs: 00A52F68

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 2ed5cf98b2bbdc8b0f79f20dfc1bab9fc7ddbf6bab257920c2a9356de6654066
Instruction ID: 603d5df475bf422b397e9d6652faa8aaa767987c139528117e268cffd5fdf77f
Opcode Fuzzy Hash: 2ed5cf98b2bbdc8b0f79f20dfc1bab9fc7ddbf6bab257920c2a9356de6654066
Instruction Fuzzy Hash: 2C21AE71204205AFEB109FA4EC80FBB37B9FB5A366F104618FD50E6190D771DC6A9B60

Function 009E4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,009E4D1E,009F28E9,?,009E4CBE,009F28E9,00A888B8,0000000C,009E4E15,009F28E9,00000002), ref: 009E4D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 009E4DA0
FreeLibrary.KERNEL32(00000000,?,?,?,009E4D1E,009F28E9,?,009E4CBE,009F28E9,00A888B8,0000000C,009E4E15,009F28E9,00000002,00000000), ref: 009E4DC3

Strings

CorExitProcess, xrefs: 009E4D98
mscoree.dll, xrefs: 009E4D86

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 8afd0a15fe65fb02fb51ef78c6043fa0f4ecdcff21aa50a6405950ed9fd0d57d
Instruction ID: b249fee6ee9a261e30979b8f8c909d9b88fd5e50170881f56f1aaa12bb31143a
Opcode Fuzzy Hash: 8afd0a15fe65fb02fb51ef78c6043fa0f4ecdcff21aa50a6405950ed9fd0d57d
Instruction Fuzzy Hash: 1EF04F34A40708BFDB119FA1DC49BAEBBB9FF44762F0001A4F805A62A0CB746D81CB90

Function 009C4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,009C4EDD,?,00A91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009C4E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 009C4EAE
FreeLibrary.KERNEL32(00000000,?,?,009C4EDD,?,00A91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009C4EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 009C4EA8
kernel32.dll, xrefs: 009C4E94

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 1cdd6c375238f13f380b5917ff2f9411cc335422b4969c16886f32fdeb9b0ff7
Instruction ID: 4adc49a2f707233b92819a73f93b6021133b8cbf9a0e28af82b847aebb8a0077
Opcode Fuzzy Hash: 1cdd6c375238f13f380b5917ff2f9411cc335422b4969c16886f32fdeb9b0ff7
Instruction Fuzzy Hash: 8EE08636F01B226FD22157656C28F5B6658BF81F737060219FC00E3144DB64CD0281A1

Function 009C4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00A03CDE,?,00A91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009C4E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 009C4E74
FreeLibrary.KERNEL32(00000000,?,?,00A03CDE,?,00A91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009C4E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 009C4E6E
kernel32.dll, xrefs: 009C4E5B

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: d8518456d8545561fb208ff2632548a9106c015feeb802aa27f425c28517b7c4
Instruction ID: 8ed20ec35c1e22c3346b3336741f929ada43d57f3a52ab8c0300a300033b4680
Opcode Fuzzy Hash: d8518456d8545561fb208ff2632548a9106c015feeb802aa27f425c28517b7c4
Instruction Fuzzy Hash: 0BD01236A02B216FDA225B697C28E8B6A1CBF85F723060619BD05A3119CF64CD02C5D2

Function 00A32947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00A32C05
DeleteFileW.KERNEL32(?), ref: 00A32C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00A32C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00A32CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00A32CC0

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: ba1c45fa284e2d6de845adcebcff5c63d61ab27380aa8c8891a2ad642d65de40
Instruction ID: 36a4b653dfc39104a37f38f60dc55fd378e32ee4bd3c6d051a80bca6c410f565
Opcode Fuzzy Hash: ba1c45fa284e2d6de845adcebcff5c63d61ab27380aa8c8891a2ad642d65de40
Instruction Fuzzy Hash: 52B13D72D01219ABDF11EFA5CD85FDEB7BDEF48350F1040A6F609E6151EA30AE448B61

Function 00A4A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00A4A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00A4A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00A4A468
CloseHandle.KERNEL32(?), ref: 00A4A63D

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 8390071b8fc935f1c37cf195995f88efe1749e20aa8123c1d4fc16801245b558
Instruction ID: 601c4978ad8947a141f3c6086b75252414ed9ae430596ee286501cad028734c5
Opcode Fuzzy Hash: 8390071b8fc935f1c37cf195995f88efe1749e20aa8123c1d4fc16801245b558
Instruction Fuzzy Hash: 53A1AFB5644300AFD720DF24C886F2ABBE5AFD4714F14881DF59A9B392D7B0ED418B82

Function 009FBB27 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00A63700), ref: 009FBB91
WideCharToMultiByte.KERNEL32(00000000,00000000,00A9121C,000000FF,00000000,0000003F,00000000,?,?), ref: 009FBC09
WideCharToMultiByte.KERNEL32(00000000,00000000,00A91270,000000FF,?,0000003F,00000000,?), ref: 009FBC36
_free.LIBCMT ref: 009FBB7F

Part of subcall function 009F29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,009FD7D1,00000000,00000000,00000000,00000000,?,009FD7F8,00000000,00000007,00000000,?,009FDBF5,00000000), ref: 009F29DE
Part of subcall function 009F29C8: GetLastError.KERNEL32(00000000,?,009FD7D1,00000000,00000000,00000000,00000000,?,009FD7F8,00000000,00000007,00000000,?,009FDBF5,00000000,00000000), ref: 009F29F0

_free.LIBCMT ref: 009FBD4B

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: 14734ba82d3ad271373613ab0bb1f53caf18d3b9692e00bc9a0710ef2ceea2b4
Instruction ID: 2a0bda04f36d05584dc42e0d61dca085e75f50209e13d4b95ff7e979add6e940
Opcode Fuzzy Hash: 14734ba82d3ad271373613ab0bb1f53caf18d3b9692e00bc9a0710ef2ceea2b4
Instruction Fuzzy Hash: 1351CA7190020DEFCB10EFA9DC81ABEB7BCFF85760B10466AE664D7191EB709E418B50

Function 00A2E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A2DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00A2CF22,?), ref: 00A2DDFD

Part of subcall function 00A2DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00A2CF22,?), ref: 00A2DE16

Part of subcall function 00A2E199: GetFileAttributesW.KERNEL32(?,00A2CF95), ref: 00A2E19A

lstrcmpiW.KERNEL32(?,?), ref: 00A2E473
MoveFileW.KERNEL32(?,?), ref: 00A2E4AC
_wcslen.LIBCMT ref: 00A2E5EB
_wcslen.LIBCMT ref: 00A2E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00A2E650

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 056462cac1b3db5adcda8caa502c729b634126312c92e8408f07d1bc24d2081d
Instruction ID: 6284f406860a0d4bdd729e4b786b271df765b6d827e35e7f15d885a09edb1228
Opcode Fuzzy Hash: 056462cac1b3db5adcda8caa502c729b634126312c92e8408f07d1bc24d2081d
Instruction Fuzzy Hash: 2F5164B24083955BC724EB94DC81EDF73ECAF84350F00492EF689D3192EF75A6888766

Function 00A4B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009C9CB3: _wcslen.LIBCMT ref: 009C9CBD

Part of subcall function 00A4C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A4B6AE,?,?), ref: 00A4C9B5
Part of subcall function 00A4C998: _wcslen.LIBCMT ref: 00A4C9F1
Part of subcall function 00A4C998: _wcslen.LIBCMT ref: 00A4CA68
Part of subcall function 00A4C998: _wcslen.LIBCMT ref: 00A4CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A4BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00A4BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00A4BB63
RegCloseKey.ADVAPI32(?,?), ref: 00A4BBA6
RegCloseKey.ADVAPI32(00000000), ref: 00A4BBB3

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 4627323412da4afad51b79f5e20902d7c135e666c0b0a733bf11c20b8588dd65
Instruction ID: 91c66523dd78391de401fa6f11f3ee0a77361fefa4e49ead357d3cb3368a4545
Opcode Fuzzy Hash: 4627323412da4afad51b79f5e20902d7c135e666c0b0a733bf11c20b8588dd65
Instruction Fuzzy Hash: 29617C35218241AFC314DF14C895F2ABBE5FF84358F14896CF4994B2A2DB31ED46CBA2

Function 00A28BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A28BCD
VariantClear.OLEAUT32 ref: 00A28C3E
VariantClear.OLEAUT32 ref: 00A28C9D
VariantClear.OLEAUT32(?), ref: 00A28D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00A28D3B

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: fd4e6872a7498d7879c8ea0c4743100545007c1ef93aed04ff3d1c827864e236
Instruction ID: 2ef3d06381e0ec1b57dd94be0806ad4ef28737230e21983c7231af584d707789
Opcode Fuzzy Hash: fd4e6872a7498d7879c8ea0c4743100545007c1ef93aed04ff3d1c827864e236
Instruction Fuzzy Hash: E4516AB5A01219EFDB10CF68D884AAAB7F8FF89310B158569F905DB354E734E911CB90

Function 00A38AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00A38BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00A38BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00A38C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00A38C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00A38C5F

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 8e88340cd969deed67d5ff2fd879cecd5f8174e31a074b0f6bc6999dab7c7d07
Instruction ID: 93690779c729204bdc11c7a8d57f688f90f2f72311b4387d5f6a1e1b7ebb4c68
Opcode Fuzzy Hash: 8e88340cd969deed67d5ff2fd879cecd5f8174e31a074b0f6bc6999dab7c7d07
Instruction Fuzzy Hash: 3F513675A002159FCB00DF64C881EADBBF5BF88314F088059F849AB362CB35ED51CB91

Function 00A48EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00A48F40
GetProcAddress.KERNEL32(00000000,?), ref: 00A48FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00A48FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00A49032
FreeLibrary.KERNEL32(00000000), ref: 00A49052

Part of subcall function 009DF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00A31043,?,75C0E610), ref: 009DF6E6
Part of subcall function 009DF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00A1FA64,00000000,00000000,?,?,00A31043,?,75C0E610,?,00A1FA64), ref: 009DF70D

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 972b2eceefcdb4c4cfdb04fa76a578881720c83a8b5b5adaf9a0cf10241553ab
Instruction ID: b2d9c16977a7298313bb08ab2dc33a423fd174f6059d63e27477dc84fe2636dc
Opcode Fuzzy Hash: 972b2eceefcdb4c4cfdb04fa76a578881720c83a8b5b5adaf9a0cf10241553ab
Instruction Fuzzy Hash: 88513C39A00205DFC711DF58C495DAEBBF1FF89324B048199E8069B762DB31ED86CB91

Function 00A56B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00A56C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00A56C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00A56C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00A3AB79,00000000,00000000), ref: 00A56C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00A56CC7

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: a2caff63f8c18f4f94e335b5ab0f488d8e037b8ac7e022e358d4b8a9a62c3c0c
Instruction ID: 7d6be3e420fa2b27ac1172b24de73cde8c56e2dc9d282fd6e17aeafaf67716e2
Opcode Fuzzy Hash: a2caff63f8c18f4f94e335b5ab0f488d8e037b8ac7e022e358d4b8a9a62c3c0c
Instruction Fuzzy Hash: 7741D335A04204AFDB24CF68CC59FA97BB5FB09361F950228FC95A72E1D771ED45CA40

Function 009F2051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 009F20C3
_free.LIBCMT ref: 009F20E3

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 18d95eae4f80516a837a96277bc876945bacc70ef2d4d230fd3ff69132a8df20
Instruction ID: 3893f7c52b3efc4d8b405da366ab9ad04302816e6f578626e7f3845c3de3524c
Opcode Fuzzy Hash: 18d95eae4f80516a837a96277bc876945bacc70ef2d4d230fd3ff69132a8df20
Instruction Fuzzy Hash: CF41C432A002089FCB24DF78C981B6DB7F5EF89314F154569E615EB391DB31AD01CB90

Function 009D912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 009D9141
ScreenToClient.USER32(00000000,?), ref: 009D915E
GetAsyncKeyState.USER32(00000001), ref: 009D9183
GetAsyncKeyState.USER32(00000002), ref: 009D919D

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 96efc2b198263e40b5e9057e1dbbc04522a7fc9c53d6af3dfa2b6c1467b910bc
Instruction ID: b99bd760cf45d0e689e43e0d1fa4a4340d9607057e7649ffafab8e0e6b1d795d
Opcode Fuzzy Hash: 96efc2b198263e40b5e9057e1dbbc04522a7fc9c53d6af3dfa2b6c1467b910bc
Instruction Fuzzy Hash: 97413F71A4861AFFDF19AF64C844BEEB775FB05324F208316E425A72A0C7346994CB91

Function 00A33874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00A338CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00A33922
TranslateMessage.USER32(?), ref: 00A3394B
DispatchMessageW.USER32(?), ref: 00A33955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00A33966

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: da763e26ff45596ba9024348c5c3258eb137c479d7cac242ef549afa7fed1385
Instruction ID: b1ad9e76f15b6cbb1bae3a2fe27ef1b05628a909e833fdad0823fbd6d5494f1f
Opcode Fuzzy Hash: da763e26ff45596ba9024348c5c3258eb137c479d7cac242ef549afa7fed1385
Instruction Fuzzy Hash: 5731B77260C342DFEF35CBB59859BB637E8EB05305F04456AF462C61A0E7F49686CB11

Function 00A3CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,00A3C21E,00000000), ref: 00A3CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 00A3CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,00A3C21E,00000000), ref: 00A3CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,00A3C21E,00000000), ref: 00A3CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,00A3C21E,00000000), ref: 00A3CFF2

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 67d1e8afcedf2812f95e0beec6ec5b70476ee06312a5502df2b427be9f132608
Instruction ID: 4b0772d5cd3456644c104b42703313ba41fcae406307ad7637a540e160741845
Opcode Fuzzy Hash: 67d1e8afcedf2812f95e0beec6ec5b70476ee06312a5502df2b427be9f132608
Instruction Fuzzy Hash: E8314971600705AFDB20DFA5DD85AABBBF9EB14365F10842EF506E2241DB30AE41DB60

Function 00A21901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00A21915
PostMessageW.USER32(00000001,00000201,00000001), ref: 00A219C1
Sleep.KERNEL32(00000000,?,?,?), ref: 00A219C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 00A219DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 00A219E2

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: e61db13ad1787f5d67b093dfd92c7138d4768ac0e725e0b2d66f964ff77bc17a
Instruction ID: 5487145b33f18cad9276a0fbb01517c0a8d2b442df8cd17b6d4dcfdc4a3b294c
Opcode Fuzzy Hash: e61db13ad1787f5d67b093dfd92c7138d4768ac0e725e0b2d66f964ff77bc17a
Instruction Fuzzy Hash: 7931BF71A00229EFCB04CFACDD99ADE7BB5FB14325F104229F921A72D1C7709A84CB90

Function 00A55706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00A55745
SendMessageW.USER32(?,00001074,?,00000001), ref: 00A5579D
_wcslen.LIBCMT ref: 00A557AF
_wcslen.LIBCMT ref: 00A557BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00A55816

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 43d2a55e0d0fc0e46b80a93a71f4ffda6d741844076c41caa760f155ca5a24a1
Instruction ID: 98e2b1dcebe407ae30b72db8d2d04c76c83370d9113e4d86985f3d44e51ab09c
Opcode Fuzzy Hash: 43d2a55e0d0fc0e46b80a93a71f4ffda6d741844076c41caa760f155ca5a24a1
Instruction Fuzzy Hash: 74218271D04618DADB21DFB0CC85AEE77B8FF44726F108656ED29EA180D7748A89CF50

Function 00A40930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00A40951
GetForegroundWindow.USER32 ref: 00A40968
GetDC.USER32(00000000), ref: 00A409A4
GetPixel.GDI32(00000000,?,00000003), ref: 00A409B0
ReleaseDC.USER32(00000000,00000003), ref: 00A409E8

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 285ccd621b9be4f03413f4295fe3843fb89630ed1e23423e4442fbf6950bf69f
Instruction ID: 7022a4ff929deea5162ac21ac65ca696d21fdc96c4d3dbd03236cc60cd437a53
Opcode Fuzzy Hash: 285ccd621b9be4f03413f4295fe3843fb89630ed1e23423e4442fbf6950bf69f
Instruction Fuzzy Hash: FC219F35A00214AFD704EFA5D985EAEBBE5FF88711F00842CF84A97752CB30AD05CB50

Function 009FCDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 009FCDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009FCDE9

Part of subcall function 009F3820: RtlAllocateHeap.NTDLL(00000000,?,00A91444,?,009DFDF5,?,?,009CA976,00000010,00A91440,009C13FC,?,009C13C6,?,009C1129), ref: 009F3852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 009FCE0F
_free.LIBCMT ref: 009FCE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009FCE31

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: bbda2f66f692eb43bea1d0e6e7db80f30dc853126a6eec4358bfbb081a29e8c9
Instruction ID: 040cd05a34e99ac3bae1d2f6e808f3ba92af7befb0a87a9f758ae341eaccc3db
Opcode Fuzzy Hash: bbda2f66f692eb43bea1d0e6e7db80f30dc853126a6eec4358bfbb081a29e8c9
Instruction Fuzzy Hash: 7101D4B2A0171D7F632156B66D88DBB6A6DEEC6BB13158129FA05C7200EA658D0283F0

Function 009D9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 009D9693
SelectObject.GDI32(?,00000000), ref: 009D96A2
BeginPath.GDI32(?), ref: 009D96B9
SelectObject.GDI32(?,00000000), ref: 009D96E2

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 3e9e2d8fc9d37bb74f587d916399c8a5959998f331209b7bc86b24b1710a82f3
Instruction ID: 7957bea6bc8d93bdeb3d6a57df9eab904b47f7409c6f3c356a329506df99e378
Opcode Fuzzy Hash: 3e9e2d8fc9d37bb74f587d916399c8a5959998f331209b7bc86b24b1710a82f3
Instruction Fuzzy Hash: 02218030942306EFDF11EFA4DC087A93BB8BB50366F908217F420A62B0D7719892CB90

Function 00A25711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00A25726
_memcmp.LIBVCRUNTIME ref: 00A25744
_memcmp.LIBVCRUNTIME ref: 00A25757
_memcmp.LIBVCRUNTIME ref: 00A2576F
_memcmp.LIBVCRUNTIME ref: 00A25787

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 0a9666d30618f61ea1105391208cbd040bef542d623d73af74e7da1da9816514
Instruction ID: 7cdac20190813c0d2afe6ee1a4c47158e8b2783ebb4f04a264476c221fbeeba0
Opcode Fuzzy Hash: 0a9666d30618f61ea1105391208cbd040bef542d623d73af74e7da1da9816514
Instruction Fuzzy Hash: 0D01B9B1A81655FFD2089625EE42FBB735CBF613A5F004830FD04AA241F770ED1482A0

Function 009D990E Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 009D98CC
SetTextColor.GDI32(?,?), ref: 009D98D6
SetBkMode.GDI32(?,00000001), ref: 009D98E9
GetStockObject.GDI32(00000005), ref: 009D98F1
GetWindowLongW.USER32(?,000000EB), ref: 009D9952

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Color$LongModeObjectStockTextWindow
String ID:
API String ID: 1860813098-0
Opcode ID: b1cc51f2d9b755c33fb33c281a585bcec0fbfa8f880cf83990b1d68850a1e892
Instruction ID: 71d55c456c673bd89aea936b5bfdfb2d0587010ec39902e5d71760fdc7d2a750
Opcode Fuzzy Hash: b1cc51f2d9b755c33fb33c281a585bcec0fbfa8f880cf83990b1d68850a1e892
Instruction Fuzzy Hash: 891138312853509FCB12DF64EC64FE93B34FF06766B04404BF5428B2A2CB314991CB50

Function 009F2DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,009EF2DE,009F3863,00A91444,?,009DFDF5,?,?,009CA976,00000010,00A91440,009C13FC,?,009C13C6), ref: 009F2DFD
_free.LIBCMT ref: 009F2E32
_free.LIBCMT ref: 009F2E59
SetLastError.KERNEL32(00000000,009C1129), ref: 009F2E66
SetLastError.KERNEL32(00000000,009C1129), ref: 009F2E6F

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: b1ba77990d50e6746340f8980cc2eabdf5f88c7fcf9776bd502b0001e72675c1
Instruction ID: ca7bc8dc73916f8c6f71bd1955becac5e2773d1a69f9565c10f4fe0155a5cbc7
Opcode Fuzzy Hash: b1ba77990d50e6746340f8980cc2eabdf5f88c7fcf9776bd502b0001e72675c1
Instruction Fuzzy Hash: F901F93224570C6BC61267B46C49F7B2A5DBBC17B57314525FB6597192EA748C024320

Function 00A2000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A1FF41,80070057,?,?,?,00A2035E), ref: 00A2002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A1FF41,80070057,?,?), ref: 00A20046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A1FF41,80070057,?,?), ref: 00A20054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A1FF41,80070057,?), ref: 00A20064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A1FF41,80070057,?,?), ref: 00A20070

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: ae497c8a8f67d9b93cc85013afe564264a3b459bd65fa5d4ed99cb45f8629bde
Instruction ID: c241be6918a558443f9ed939db730794fb0b92a9871ec6337d62bdc54ead7584
Opcode Fuzzy Hash: ae497c8a8f67d9b93cc85013afe564264a3b459bd65fa5d4ed99cb45f8629bde
Instruction Fuzzy Hash: 10018B72600324BFEB108FACEC44FAA7AADEB447A2F144134F905D6225E771DD418BA0

Function 00A2E97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 00A2E997
QueryPerformanceFrequency.KERNEL32(?), ref: 00A2E9A5
Sleep.KERNEL32(00000000), ref: 00A2E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 00A2E9B7
Sleep.KERNEL32 ref: 00A2E9F3

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: de8407ed6980b2d84e3b5589eebfead668d1672c5dd5eedee2d2adfac540e8a9
Instruction ID: 2c0350bc327b8f73bbef4b24145c586dd8b8df7db650fed949b5fa1ad3da3301
Opcode Fuzzy Hash: de8407ed6980b2d84e3b5589eebfead668d1672c5dd5eedee2d2adfac540e8a9
Instruction Fuzzy Hash: CC010931C01639DBCF00EBE9ED59ADDFB78BB09711F000666E502B2245CB34959587A1

Function 00A210F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00A21114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00A20B9B,?,?,?), ref: 00A21120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00A20B9B,?,?,?), ref: 00A2112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00A20B9B,?,?,?), ref: 00A21136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00A2114D

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 2594a7693ffa52ea4bccbfc5b67656e2c340a52f29fd7b0997393cc36e0ef6c7
Instruction ID: 6e515fb5424936b81d358cb18b40ee1ae936f1db338c2fca2d00907e7d0a9a00
Opcode Fuzzy Hash: 2594a7693ffa52ea4bccbfc5b67656e2c340a52f29fd7b0997393cc36e0ef6c7
Instruction Fuzzy Hash: FA016D75100315BFDB118FA8EC49A6A3F6EFF89375B100428FA41D7350DA31DC11CA60

Function 00A20FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00A20FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00A20FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00A20FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00A20FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00A21002

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 4905f64eabc9217c8ed275ff0dfcd0e7a83315d3e0a8bfb18bd9dd802a2b8dd1
Instruction ID: 4aee6cef52e97ffba69e3028a090a67321a89e2adae678af66082e45bad88e0b
Opcode Fuzzy Hash: 4905f64eabc9217c8ed275ff0dfcd0e7a83315d3e0a8bfb18bd9dd802a2b8dd1
Instruction Fuzzy Hash: 88F04935200315AFDB218FA9AC49F5A3BADFF89762F104424FA46C6291CA70DC818A60

Function 00A21014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00A2102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00A21036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A21045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00A2104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A21062

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: a566e628d15d211f6cd193854a2475b316dddb92354c87847668c6cd61ed4d13
Instruction ID: 91e5ac3fa5581f4ca69fc7f9c423e51bbb9a96c626239b1374eb99431305d2cd
Opcode Fuzzy Hash: a566e628d15d211f6cd193854a2475b316dddb92354c87847668c6cd61ed4d13
Instruction Fuzzy Hash: F2F04935200355AFDB219FA9EC49F5A3BADFF89762F500424FA46C6290CA70D8818A60

Function 00A3030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,00A3017D,?,00A332FC,?,00000001,00A02592,?), ref: 00A30324
CloseHandle.KERNEL32(?,?,?,?,00A3017D,?,00A332FC,?,00000001,00A02592,?), ref: 00A30331
CloseHandle.KERNEL32(?,?,?,?,00A3017D,?,00A332FC,?,00000001,00A02592,?), ref: 00A3033E
CloseHandle.KERNEL32(?,?,?,?,00A3017D,?,00A332FC,?,00000001,00A02592,?), ref: 00A3034B
CloseHandle.KERNEL32(?,?,?,?,00A3017D,?,00A332FC,?,00000001,00A02592,?), ref: 00A30358
CloseHandle.KERNEL32(?,?,?,?,00A3017D,?,00A332FC,?,00000001,00A02592,?), ref: 00A30365

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 8c1d15764a55c0cd50903c576368f506e4983511fee4fe7880f5b7abca437160
Instruction ID: 6946285ccf2aaf60b83385efe758a7d5493c2397e28271ce24ed1364f05808ec
Opcode Fuzzy Hash: 8c1d15764a55c0cd50903c576368f506e4983511fee4fe7880f5b7abca437160
Instruction Fuzzy Hash: 4E01A272800B159FC7309F66D890812F7F9FF503153158A3FE19656931C371A955CF80

Function 009FD73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 009FD752

Part of subcall function 009F29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,009FD7D1,00000000,00000000,00000000,00000000,?,009FD7F8,00000000,00000007,00000000,?,009FDBF5,00000000), ref: 009F29DE
Part of subcall function 009F29C8: GetLastError.KERNEL32(00000000,?,009FD7D1,00000000,00000000,00000000,00000000,?,009FD7F8,00000000,00000007,00000000,?,009FDBF5,00000000,00000000), ref: 009F29F0

_free.LIBCMT ref: 009FD764
_free.LIBCMT ref: 009FD776
_free.LIBCMT ref: 009FD788
_free.LIBCMT ref: 009FD79A

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f3ec67cd27938a477ccede6ce3fa64c71e5d2dc6646864b6db231db41d45e509
Instruction ID: e81c61bfbe0b4ca1feb2c88a94c70441b7ffeab0382f7f5033c98ed6575bfac8
Opcode Fuzzy Hash: f3ec67cd27938a477ccede6ce3fa64c71e5d2dc6646864b6db231db41d45e509
Instruction Fuzzy Hash: 26F0127258520DABC621FBA4FAC5E3A77DEBB447207A40805F258EB511C770FC808B74

Function 00A25C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00A25C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00A25C6F
MessageBeep.USER32(00000000), ref: 00A25C87
KillTimer.USER32(?,0000040A), ref: 00A25CA3
EndDialog.USER32(?,00000001), ref: 00A25CBD

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: d836274a251513195687e8b654ea0348146b6f5317157e5712a679062bb2e406
Instruction ID: 574b55efd66bc99af546cd8c9910a4b77b43ea9c60ad40abcce63eea2b02de20
Opcode Fuzzy Hash: d836274a251513195687e8b654ea0348146b6f5317157e5712a679062bb2e406
Instruction Fuzzy Hash: 2101AE309007149FEB259B64ED4EF9577B8FF04706F001569B543614E1E7F0AA45CB50

Function 009F22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 009F22BE

Part of subcall function 009F29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,009FD7D1,00000000,00000000,00000000,00000000,?,009FD7F8,00000000,00000007,00000000,?,009FDBF5,00000000), ref: 009F29DE
Part of subcall function 009F29C8: GetLastError.KERNEL32(00000000,?,009FD7D1,00000000,00000000,00000000,00000000,?,009FD7F8,00000000,00000007,00000000,?,009FDBF5,00000000,00000000), ref: 009F29F0

_free.LIBCMT ref: 009F22D0
_free.LIBCMT ref: 009F22E3
_free.LIBCMT ref: 009F22F4
_free.LIBCMT ref: 009F2305

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 4a70a96a9c228d490ed09e848385b824484d88ec932522eafe3390c902f88eb1
Instruction ID: cc5c0051ae07cb306a8f7049a2d173ddd849b8c39195c045d3dc4038635ab719
Opcode Fuzzy Hash: 4a70a96a9c228d490ed09e848385b824484d88ec932522eafe3390c902f88eb1
Instruction Fuzzy Hash: 1AF03A71A801268BC612FFD8BD01EA83B68BB187A0700055BF524D72B1CB700993AFE4

Function 009D95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 009D95D4
StrokeAndFillPath.GDI32(?,?,00A171F7,00000000,?,?,?), ref: 009D95F0
SelectObject.GDI32(?,00000000), ref: 009D9603
DeleteObject.GDI32 ref: 009D9616
StrokePath.GDI32(?), ref: 009D9631

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: aa02fde2cbf0bfa729d1b2af6c6737ef527559e2721caabc0519a1b77fe438ec
Instruction ID: ffc67c8436969152dee694282ffbaf6e1dc8a8b94275124cdcae27ee1828662d
Opcode Fuzzy Hash: aa02fde2cbf0bfa729d1b2af6c6737ef527559e2721caabc0519a1b77fe438ec
Instruction Fuzzy Hash: A8F01930145705EFDB12EFA5ED187643B65BB01372F448216F425551F1CB318992DF20

Function 009F0F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 009F10F9
__freea.LIBCMT ref: 009F1117

Part of subcall function 009F1537: _free.LIBCMT ref: 009F154F

Strings

am/pm, xrefs: 009F117A
a/p, xrefs: 009F11DE

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: b08acab1262753b2003cceb2b06f4f4a6f92061422a24b3cbf6f0d40426f1563
Instruction ID: b9936d3bf3a9dec2c21606e7c8b836b04957dfa25b5f4f78d7215c779a3cd742
Opcode Fuzzy Hash: b08acab1262753b2003cceb2b06f4f4a6f92061422a24b3cbf6f0d40426f1563
Instruction Fuzzy Hash: 08D1F031A0420EDBDB289F68C855BFEB7B9EF05300F284519EB11AB650D7B99D80CBD1

Function 00A47B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 009E0242: EnterCriticalSection.KERNEL32(00A9070C,00A91884,?,?,009D198B,00A92518,?,?,?,009C12F9,00000000), ref: 009E024D
Part of subcall function 009E0242: LeaveCriticalSection.KERNEL32(00A9070C,?,009D198B,00A92518,?,?,?,009C12F9,00000000), ref: 009E028A

Part of subcall function 009C9CB3: _wcslen.LIBCMT ref: 009C9CBD

Part of subcall function 009E00A3: __onexit.LIBCMT ref: 009E00A9

__Init_thread_footer.LIBCMT ref: 00A47BFB

Part of subcall function 009E01F8: EnterCriticalSection.KERNEL32(00A9070C,?,?,009D8747,00A92514), ref: 009E0202
Part of subcall function 009E01F8: LeaveCriticalSection.KERNEL32(00A9070C,?,009D8747,00A92514), ref: 009E0235

Strings

Variable must be of type 'Object'., xrefs: 00A47C3A
5, xrefs: 00A47C78
G, xrefs: 00A47C7F

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: 5da1560dbc6aace6508f3a809d0dedfd0f3b18e2f386c84e51c54bee50ff8ebc
Instruction ID: 10afad40e811ba03e739ff781623aeab4da8176a36e8411ef432a4dc7ae36987
Opcode Fuzzy Hash: 5da1560dbc6aace6508f3a809d0dedfd0f3b18e2f386c84e51c54bee50ff8ebc
Instruction Fuzzy Hash: 3A917978A04249EFCB14EF94D991EBDB7B1FF88304F108059F806AB292DB71AE45CB51

Function 00A22716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A2B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00A221D0,?,?,00000034,00000800,?,00000034), ref: 00A2B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00A22760

Part of subcall function 00A2B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00A221FF,?,?,00000800,?,00001073,00000000,?,?), ref: 00A2B3F8

Part of subcall function 00A2B32A: GetWindowThreadProcessId.USER32(?,?), ref: 00A2B355
Part of subcall function 00A2B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00A22194,00000034,?,?,00001004,00000000,00000000), ref: 00A2B365
Part of subcall function 00A2B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00A22194,00000034,?,?,00001004,00000000,00000000), ref: 00A2B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00A227CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00A2281A

Strings

@, xrefs: 00A22832

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 3175977b152cb6916c7100cbb96e96f548ab25d267981b7cd7df4398702eb9f2
Instruction ID: fca6b1cab0ead106faf776737b6e8589da3af18031f222cb52900dbdc571d68e
Opcode Fuzzy Hash: 3175977b152cb6916c7100cbb96e96f548ab25d267981b7cd7df4398702eb9f2
Instruction Fuzzy Hash: 41410C72900228BFDB10DFA8D985BDEBBB8EB05700F104065EA55B7181DA706E45CB61

Function 009F172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe,00000104), ref: 009F1769
_free.LIBCMT ref: 009F1834
_free.LIBCMT ref: 009F183E

Strings

C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe, xrefs: 009F1760, 009F1767, 009F1796, 009F17CE

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\RFQ_AS0101402025.22025_PDF.exe
API String ID: 2506810119-990705588
Opcode ID: 480109f44b7379202d203005191964d99df904a216ebcfe8ea9c163e1343a2c5
Instruction ID: 0e1f582d38a20a6ab0787fcc0de05c56eb1d25f500c55a5a1d00dcf065eae327
Opcode Fuzzy Hash: 480109f44b7379202d203005191964d99df904a216ebcfe8ea9c163e1343a2c5
Instruction Fuzzy Hash: 76318E71A0021CEFDB21EB999981EAEBBFCEB85350F204167FA0497211DB708E41CBD0

Function 00A2C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00A2C306
DeleteMenu.USER32(?,00000007,00000000), ref: 00A2C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00A91990,015AC1B8), ref: 00A2C395

Strings

0, xrefs: 00A2C2DF

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 1cb050de16b7b0b523680f93e5e2128cc0276491ec6ce34c6357ffc34f55a177
Instruction ID: dc0fe2836032d1a2e4ae5c0a088677c5f4207c8d8511f08af6a01aee1b8d8312
Opcode Fuzzy Hash: 1cb050de16b7b0b523680f93e5e2128cc0276491ec6ce34c6357ffc34f55a177
Instruction Fuzzy Hash: 59419F712043519FD720DF29E884B5EBBE8AF85320F148A2DF9A59B2D1D770E904CB62

Function 00A54416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00A5CC08,00000000,?,?,?,?), ref: 00A544AA
GetWindowLongW.USER32 ref: 00A544C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00A544D7

Strings

SysTreeView32, xrefs: 00A5447C

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 7ed6edb7fd848e59af766d9156ad6c6c7272d63c3994e352b8e7e2be933d5183
Instruction ID: afc0a6f45c03992b88f11e742896d36f62e879f6055727f2dd284c2aee548638
Opcode Fuzzy Hash: 7ed6edb7fd848e59af766d9156ad6c6c7272d63c3994e352b8e7e2be933d5183
Instruction Fuzzy Hash: C8318931240605AFDB209F78DC45BEA7BA9FB48339F208715F979A21E0D770AC959B50

Function 00A4304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00A4335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00A43077,?,?), ref: 00A43378

inet_addr.WSOCK32(?), ref: 00A4307A
_wcslen.LIBCMT ref: 00A4309B
htons.WSOCK32(00000000), ref: 00A43106

Strings

255.255.255.255, xrefs: 00A43095, 00A4309A

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: d18004c70f5b8da6f1e840abceeb22cce954dec559b677805f08821874b5cd87
Instruction ID: eeb2a2c18ecbbb49d858941990843bd7a0af4c5f347cf913a72c158685388348
Opcode Fuzzy Hash: d18004c70f5b8da6f1e840abceeb22cce954dec559b677805f08821874b5cd87
Instruction Fuzzy Hash: 8E31C13A600201DFDF10CF68C585EAA77F0EF94318F248299E9159B392DB72EE41C761

Function 00A54653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00A54705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00A54713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00A5471A

Strings

msctls_updown32, xrefs: 00A54684

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: b14c5a94726d8383e8f6d36cfc7c2d540afd39818bfbbf60fe6416a0cfbf454a
Instruction ID: 2300a7a3147f9c736ba6924a1dc503722a4a431f37ec885c762b147895e5412a
Opcode Fuzzy Hash: b14c5a94726d8383e8f6d36cfc7c2d540afd39818bfbbf60fe6416a0cfbf454a
Instruction Fuzzy Hash: 0E215EB5600209AFEB11DF64DCC1EA737ADFB8E3A9B040459FA009B251DB30EC56CB60

Function 00A295AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A2961D

Strings

#requireadmin, xrefs: 00A295D9
#notrayicon, xrefs: 00A295B7
#OnAutoItStartRegister, xrefs: 00A295F3

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: 680fe64a6eda2fae8cee11901105f5900b688296d883577787fd356138c2ee98
Instruction ID: ed643237be7f61e51794f524c9b032acd1badc0d89641f8d6aa541c44d3ae06c
Opcode Fuzzy Hash: 680fe64a6eda2fae8cee11901105f5900b688296d883577787fd356138c2ee98
Instruction Fuzzy Hash: 0D215B32204130AAD331BB2DEC12FB7B3E8AF95B00F10443AF94997141EB619D45C2E6

Function 00A537B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00A53840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00A53850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00A53876

Strings

Listbox, xrefs: 00A5380F

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: ef904f3056c329fae8e80d51847ad37f6f307ef4a401c3d18483335bf827df0f
Instruction ID: 110f55c756dca100c9047d3728e6972b235e36c5ad1619946b43405c0469dfc1
Opcode Fuzzy Hash: ef904f3056c329fae8e80d51847ad37f6f307ef4a401c3d18483335bf827df0f
Instruction Fuzzy Hash: 2921AF72600218BBEF11CFA5CC81FAB376AFFC97A1F108114F9109B190CA71DC568BA0

Function 00A349F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00A34A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00A34A5C
SetErrorMode.KERNEL32(00000000,?,?,00A5CC08), ref: 00A34AD0

Strings

%lu, xrefs: 00A34A6F

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: c3bc25d2d3473183998de80534b19a5ffff43c93d3b1d728b4a1769971584248
Instruction ID: a7644bbdda5331169dc8139c09caef42639b8ab59d98ab5292f1d47107ca718d
Opcode Fuzzy Hash: c3bc25d2d3473183998de80534b19a5ffff43c93d3b1d728b4a1769971584248
Instruction Fuzzy Hash: 69314F75A00209AFDB10DF54C985EAA7BF8FF48318F1480A9F909DB252D771ED46CB61

Function 00A541EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00A5424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00A54264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00A54271

Strings

msctls_trackbar32, xrefs: 00A54226

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: e0811af686bd19f396f18ce705686df39802acb31f13788500fa5ac8b7ef608d
Instruction ID: f9955291a6881d82ce47819f55d9c62f2fb518ff4019c3f32b1f56b8afd9b5ca
Opcode Fuzzy Hash: e0811af686bd19f396f18ce705686df39802acb31f13788500fa5ac8b7ef608d
Instruction Fuzzy Hash: FB11E371240208BEEF209F69CC46FEB3BACFF89B69F114514FA55E2090D671D8529B20

Function 00A22F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009C6B57: _wcslen.LIBCMT ref: 009C6B6A

Part of subcall function 00A22DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00A22DC5
Part of subcall function 00A22DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00A22DD6
Part of subcall function 00A22DA7: GetCurrentThreadId.KERNEL32 ref: 00A22DDD
Part of subcall function 00A22DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00A22DE4

GetFocus.USER32 ref: 00A22F78

Part of subcall function 00A22DEE: GetParent.USER32(00000000), ref: 00A22DF9

GetClassNameW.USER32(?,?,00000100), ref: 00A22FC3
EnumChildWindows.USER32(?,00A2303B), ref: 00A22FEB

Strings

%s%d, xrefs: 00A22FFF

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 0f309c96e997ab2c9a9870b5aa565b5d859294584d3ece8a62dfc0dac4810285
Instruction ID: c8ace0de0752b722e8e7599ec272b01cc9e130058a32125895468c459a276668
Opcode Fuzzy Hash: 0f309c96e997ab2c9a9870b5aa565b5d859294584d3ece8a62dfc0dac4810285
Instruction Fuzzy Hash: 7111B4716002157BDF14BF78AC95FED37AAAF85314F048079FD099B252DE349A498B70

Function 00A55882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00A558C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00A558EE
DrawMenuBar.USER32(?), ref: 00A558FD

Strings

0, xrefs: 00A5588F

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 17a472936cbcb6f15abdd857c7d78024abcc4b87aa3a942bcd10391830c249fc
Instruction ID: 6231c9b1a113d3c9d0cfb8f2ebf064cfa68dec906b32a4b8e419845e23b2ae09
Opcode Fuzzy Hash: 17a472936cbcb6f15abdd857c7d78024abcc4b87aa3a942bcd10391830c249fc
Instruction Fuzzy Hash: AE018431900218EFDB119FA1DC45BAEBBB5FF45362F10C099E849D6261DB348A84DF71

Function 00A1D3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 00A1D3BF
FreeLibrary.KERNEL32 ref: 00A1D3E5

Strings

GetSystemWow64DirectoryW, xrefs: 00A1D3B9
X64, xrefs: 00A1D2A8

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: 6a396d6a5b26453a36f50472caf2aae31605f5f931c5dbaf3d81aa473da1a0e4
Instruction ID: c2a471305657d6a5b16def19cbcb9296a9004daf02dc00dc6693cbc1e39e80be
Opcode Fuzzy Hash: 6a396d6a5b26453a36f50472caf2aae31605f5f931c5dbaf3d81aa473da1a0e4
Instruction Fuzzy Hash: 07F05571802B319FC73553208C949EE3334BF02B02B588616E812FE208EB34CCC48292

Function 00A2007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91fb29d325a360bc5aa34c1d7f37a0fb3fe1abb1df235c57b60aa5bc5d6d446e
Instruction ID: 2a83828d7f7f1e41f4575aa486016dba4e205d5c855ed5360ece5abef6bcad3b
Opcode Fuzzy Hash: 91fb29d325a360bc5aa34c1d7f37a0fb3fe1abb1df235c57b60aa5bc5d6d446e
Instruction Fuzzy Hash: 11C15A75A0021AEFDB04CFA8D894EAEB7B5FF48304F1185A8E505EB252D731ED41CB90

Function 00A4342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00A43459
CoUninitialize.OLE32 ref: 00A43463
VariantInit.OLEAUT32(?), ref: 00A4346E
VariantClear.OLEAUT32(?), ref: 00A4371B

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: 6729a13852c2e3208659b061317b0938150a45abfd9a3c842d796148f93c42f4
Instruction ID: 351c875c3a89c5538d431846ebbd33ab36e2c9ca6a8ef2487dbc8b7245236a09
Opcode Fuzzy Hash: 6729a13852c2e3208659b061317b0938150a45abfd9a3c842d796148f93c42f4
Instruction Fuzzy Hash: 69A1E67A6043119FCB10DF68C595A2AB7E5EF88714F05885DF98A9B362DB30EE01CB52

Function 00A20436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00A5FC08,?), ref: 00A205F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00A5FC08,?), ref: 00A20608
CLSIDFromProgID.OLE32(?,?,00000000,00A5CC40,000000FF,?,00000000,00000800,00000000,?,00A5FC08,?), ref: 00A2062D
_memcmp.LIBVCRUNTIME ref: 00A2064E

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 40935c7a163bebadf1463dc337f098655c5f28c956744c3f9b664f40042c3026
Instruction ID: acda06f566bba021b1d43284564a0c12f3cb4fbe37de4f0380a0ecee3941c41a
Opcode Fuzzy Hash: 40935c7a163bebadf1463dc337f098655c5f28c956744c3f9b664f40042c3026
Instruction Fuzzy Hash: 77810E71A00119EFCB04DF98C984EEEB7B9FF89315F104568F516AB251DB71AE06CB60

Function 00A01391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00A014C0

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 4169ea5f61ee793a315df2d1666a8d4b0ee64639f047a9765e7d4583fbd29a37
Instruction ID: e95ea97cac3f7aa3e329cf9dcb4436d1baece2e7985a65b99b0897b4b23d8731
Opcode Fuzzy Hash: 4169ea5f61ee793a315df2d1666a8d4b0ee64639f047a9765e7d4583fbd29a37
Instruction Fuzzy Hash: B3412B7160051CABDB216BB9AC457FE3AA4EF81370F144226F529D72E1E7768C415362

Function 00A56278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(015AE3F8,?), ref: 00A562E2
ScreenToClient.USER32(?,?), ref: 00A56315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00A56382

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: a2d7cc5f96c3a5667b33470adec5fca774bcef985c8f32b8947edbc56c8b0fb1
Instruction ID: faf668d16d3db13ef0bfbed2051ed44ee64c16ead8917f2bae9ae251693b6354
Opcode Fuzzy Hash: a2d7cc5f96c3a5667b33470adec5fca774bcef985c8f32b8947edbc56c8b0fb1
Instruction Fuzzy Hash: E2512B74A00209EFDF10DF68D981AAE7BB5FF45361F508269F8159B2A0D730EE85CB50

Function 00A41AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00A41AFD
WSAGetLastError.WSOCK32 ref: 00A41B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00A41B8A
WSAGetLastError.WSOCK32 ref: 00A41B94

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 65f45b242ab6d4242a521d9ba686797377a3be9041da7b69a6a9b6afcbdf1e3a
Instruction ID: b08b398fc47170b2270adaf252ffec7ef6c43da24b3c1deb22984c99ede0122e
Opcode Fuzzy Hash: 65f45b242ab6d4242a521d9ba686797377a3be9041da7b69a6a9b6afcbdf1e3a
Instruction Fuzzy Hash: 40417078640200AFE720AF24C886F2977E5EB84718F54C45CF95A9F7D2E672DD828B91

Function 009FB41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f503e9d4cbb5af5edf23345c92d4f855beb28f23045bba68981fee54dcf6b5
Instruction ID: faf49edd565fb5766fdae4c8e0ed742535881f194fa00918592c706d6bec2862
Opcode Fuzzy Hash: e5f503e9d4cbb5af5edf23345c92d4f855beb28f23045bba68981fee54dcf6b5
Instruction Fuzzy Hash: 76410875A00708AFD724AF38CD41BBABBA9EB84710F10452AF655DB691D775A9018B80

Function 00A356D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00A35783
GetLastError.KERNEL32(?,00000000), ref: 00A357A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00A357CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00A357FA

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: e6cb710953c3e394868556dd3b6de9f75f4903a9c9cf31f04afc638ce7cdd1da
Instruction ID: 01441727b5dffd3aa8eb0732067e4bf55d13a62db23f395e46e59b7f1f2fdd5b
Opcode Fuzzy Hash: e6cb710953c3e394868556dd3b6de9f75f4903a9c9cf31f04afc638ce7cdd1da
Instruction Fuzzy Hash: E441FA35A00610DFCB11EF55C545B5DBBE1AF89720F198888F84A5B362CB34FD41DB91

Function 009FD8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,009E6D71,00000000,00000000,009E82D9,?,009E82D9,?,00000001,009E6D71,8BE85006,00000001,009E82D9,009E82D9), ref: 009FD910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 009FD999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 009FD9AB
__freea.LIBCMT ref: 009FD9B4

Part of subcall function 009F3820: RtlAllocateHeap.NTDLL(00000000,?,00A91444,?,009DFDF5,?,?,009CA976,00000010,00A91440,009C13FC,?,009C13C6,?,009C1129), ref: 009F3852

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 357912f26d35624ca4e02ab032d40becf854b0c9d80fe08b29e3f4aeeb4f120f
Instruction ID: dbe8175b166120de6f993d9c4fd952745b4226f69c4c8f3211c3b8e9d3ffaaae
Opcode Fuzzy Hash: 357912f26d35624ca4e02ab032d40becf854b0c9d80fe08b29e3f4aeeb4f120f
Instruction Fuzzy Hash: B231E172A0220AABDF25DFA5DC45EBE7BAAEB40710F054168FD04D7150EB75CE90CBA0

Function 00A552C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00A55352
GetWindowLongW.USER32(?,000000F0), ref: 00A55375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00A55382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00A553A8

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 3e3d8a5d38547c5cab148cad6336b9cfc5e419f8129731c88b5319ddaa5acf96
Instruction ID: 45ec7bd349ac0a22a69865bed9b7fe94c4215d0bbb535225f5f23a09f4120beb
Opcode Fuzzy Hash: 3e3d8a5d38547c5cab148cad6336b9cfc5e419f8129731c88b5319ddaa5acf96
Instruction Fuzzy Hash: 2131C134E55A08EFEB249B74CC35BE83761BB053B2F584012FE199A1E1C7B499889B41

Function 00A2AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A4C0D0,?,00008000), ref: 00A2ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 00A2AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 00A2AC74
SendInput.USER32(00000001,?,0000001C,75A4C0D0,?,00008000), ref: 00A2ACC6

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: efb86569349b3a2c141a9b7d634add910a0941f32edc134248d646cdb0c28061
Instruction ID: 34847ba1880eed40669a61601a58a2f5e250783b4dc5f6ca771124da4fb15e06
Opcode Fuzzy Hash: efb86569349b3a2c141a9b7d634add910a0941f32edc134248d646cdb0c28061
Instruction Fuzzy Hash: 84312830A00328AFFF34CBACEC047FE7BB5ABA5320F04423AE485521D1C37489858752

Function 00A57674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00A5769A
GetWindowRect.USER32(?,?), ref: 00A57710
PtInRect.USER32(?,?,00A58B89), ref: 00A57720
MessageBeep.USER32(00000000), ref: 00A5778C

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 616fa75ff5c8cb208fc5a363e40995a8520a23e38edd226872ef30ea09a6c07c
Instruction ID: efae6b171dc930fb1a2f46c189f66b6992975a61cf6ab148bdc047b725678e98
Opcode Fuzzy Hash: 616fa75ff5c8cb208fc5a363e40995a8520a23e38edd226872ef30ea09a6c07c
Instruction Fuzzy Hash: 22418D34A09215EFCB02CF98F894EAD77F5FB49316F1540A9E815AB261D730A94ACF90

Function 00A516DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00A516EB

Part of subcall function 00A23A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00A23A57
Part of subcall function 00A23A3D: GetCurrentThreadId.KERNEL32 ref: 00A23A5E
Part of subcall function 00A23A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00A225B3), ref: 00A23A65

GetCaretPos.USER32(?), ref: 00A516FF
ClientToScreen.USER32(00000000,?), ref: 00A5174C
GetForegroundWindow.USER32 ref: 00A51752

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 61bb3f80a4a858823ea1793e1a952c5a72bb28acfbf072f67738f7d6bb25e3e5
Instruction ID: a94ff88760457feda7240ba7e420b1ab6f6131c908fad5b1c3fd20b72ce052f4
Opcode Fuzzy Hash: 61bb3f80a4a858823ea1793e1a952c5a72bb28acfbf072f67738f7d6bb25e3e5
Instruction Fuzzy Hash: 83311075D00249AFC700DFA9C981EAEBBF9FF88304B5480A9E415E7251D6359E45CFA1

Function 00A2D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00A2D501
Process32FirstW.KERNEL32(00000000,?), ref: 00A2D50F
Process32NextW.KERNEL32(00000000,?), ref: 00A2D52F
CloseHandle.KERNEL32(00000000), ref: 00A2D5DC

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: e6e3401338b7c0cc3c628909e90bf34c19556e26f4f82c0f61acb70726794a1b
Instruction ID: 56528ebedd2d4a22d77aacb92059b198267474063702cf83c45c0d292a782dc8
Opcode Fuzzy Hash: e6e3401338b7c0cc3c628909e90bf34c19556e26f4f82c0f61acb70726794a1b
Instruction Fuzzy Hash: BE314B715083009FD301EF64D885FAABBE8EFD9354F14092DF586861A2EB719949CBA3

Function 00A58FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009D9BB2

GetCursorPos.USER32(?), ref: 00A59001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00A17711,?,?,?,?,?), ref: 00A59016
GetCursorPos.USER32(?), ref: 00A5905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00A17711,?,?,?), ref: 00A59094

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 95b52762464dbf8b79d83b20abddc7504df1a545d6b8a4af648795590af1e608
Instruction ID: eea132024bd23a67266ad61ed92cab0698fcf3004c893cdeae047ef9143c9b12
Opcode Fuzzy Hash: 95b52762464dbf8b79d83b20abddc7504df1a545d6b8a4af648795590af1e608
Instruction Fuzzy Hash: 4821BF31600118FFCB25CF94CC58EEB3BB9FB89362F004455F9054B2A1C7319951EB61

Function 00A2D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00A5CB68), ref: 00A2D2FB
GetLastError.KERNEL32 ref: 00A2D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 00A2D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00A5CB68), ref: 00A2D376

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 810af2aea0101a005fd83faf4f94b797e1c069ee202d6fe5227585dbf5a4f5c4
Instruction ID: 6a0513c618c4bc49b8dcb81dbc1570f6756f3a8f61754e1e24b916fd03dad38b
Opcode Fuzzy Hash: 810af2aea0101a005fd83faf4f94b797e1c069ee202d6fe5227585dbf5a4f5c4
Instruction Fuzzy Hash: 272180709083119FC300EF68D9859AE77E4FF95324F104A2DF499DB2A2E7309946CB93

Function 00A21571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A21014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00A2102A
Part of subcall function 00A21014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00A21036
Part of subcall function 00A21014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A21045
Part of subcall function 00A21014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00A2104C
Part of subcall function 00A21014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A21062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00A215BE
_memcmp.LIBVCRUNTIME ref: 00A215E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A21617
HeapFree.KERNEL32(00000000), ref: 00A2161E

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 7d54c7e6ca1bf75e3949e56e9cb7fc092ba76fae2b726191c4ce5c81d59e1e52
Instruction ID: 235e40c54be4bbcb513a2abce75bda11699f0cdb9813db51d889f829a6ce064a
Opcode Fuzzy Hash: 7d54c7e6ca1bf75e3949e56e9cb7fc092ba76fae2b726191c4ce5c81d59e1e52
Instruction Fuzzy Hash: 3B216A71E00219EFDF10DFA9D945BEEB7B8FF94355F1844A9E441AB241E730AA05CBA0

Function 00A52782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00A5280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00A52824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00A52832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00A52840

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 771321ae989b447c1f09e3fb3f4ef92cae4fa5d9dc587eac94867f4d8a74c34b
Instruction ID: 90935a09ae63e810f7e0e1fd1917fd3269cc0c1b9a1ec4fb7f00e7656074d7f7
Opcode Fuzzy Hash: 771321ae989b447c1f09e3fb3f4ef92cae4fa5d9dc587eac94867f4d8a74c34b
Instruction Fuzzy Hash: 7621C131604211AFD714DB64C845FAA7BA5FF86325F148158F8268B6E2C771FC86C7D0

Function 00A278F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A28D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00A2790A,?,000000FF,?,00A28754,00000000,?,0000001C,?,?), ref: 00A28D8C
Part of subcall function 00A28D7D: lstrcpyW.KERNEL32(00000000,?,?,00A2790A,?,000000FF,?,00A28754,00000000,?,0000001C,?,?,00000000), ref: 00A28DB2
Part of subcall function 00A28D7D: lstrcmpiW.KERNEL32(00000000,?,00A2790A,?,000000FF,?,00A28754,00000000,?,0000001C,?,?), ref: 00A28DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00A28754,00000000,?,0000001C,?,?,00000000), ref: 00A27923
lstrcpyW.KERNEL32(00000000,?,?,00A28754,00000000,?,0000001C,?,?,00000000), ref: 00A27949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00A28754,00000000,?,0000001C,?,?,00000000), ref: 00A27984

Strings

cdecl, xrefs: 00A2797B

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 1201f03ca0e1b8da8cdee9bd99c12d7f2324a497bd03a461291be998bf560df0
Instruction ID: 6e67bb6a744927d28480a6bdb65a6ad5fa6a9819275e0376f5d3336a16c7d2b2
Opcode Fuzzy Hash: 1201f03ca0e1b8da8cdee9bd99c12d7f2324a497bd03a461291be998bf560df0
Instruction Fuzzy Hash: C811E63A200312AFDB159F38E845E7E77A9FF85350B50803AF946CB3A4EB319951C7A1

Function 00A57CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00A57D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00A57D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00A57D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00A3B7AD,00000000), ref: 00A57D6B

Part of subcall function 009D9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009D9BB2

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 454c4e17abbea663f6774d2b4ed9236a12901262674dc85ecd2ede7d2e08400a
Instruction ID: c17e2fd2a3d2c2bc6fd1e307a9bd4ff44b75f9933a1c65ae3ce52353dafdbf5e
Opcode Fuzzy Hash: 454c4e17abbea663f6774d2b4ed9236a12901262674dc85ecd2ede7d2e08400a
Instruction Fuzzy Hash: 1411CD32204615AFCB10DFA8EC44AAA3BA5BF45372B118325FC39E72F0E7319955CB40

Function 00A55660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 00A556BB
_wcslen.LIBCMT ref: 00A556CD
_wcslen.LIBCMT ref: 00A556D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00A55816

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: eb1d90080cbaf7368073c67c26df857b64f32252e68eae97676be6e613d719fc
Instruction ID: c7efe0ccc56c20c57a6595a8288a6265b8b6b4c0405ee27dde6196425fdf2261
Opcode Fuzzy Hash: eb1d90080cbaf7368073c67c26df857b64f32252e68eae97676be6e613d719fc
Instruction Fuzzy Hash: 1511B471E0060496DF20DFB1CC95AEE77BCFF51762B108026FD15D6081E7748A88CBA0

Function 00A21A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00A21A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00A21A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00A21A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00A21A8A

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: cc379e2066379b05ab59e8aa2ac3e0a598a6ed20410a073db9a4d25c78abe05d
Instruction ID: ca9b0c819589f2d3312fad1ff4da2430939407d5221c9923e897da6c04598b7c
Opcode Fuzzy Hash: cc379e2066379b05ab59e8aa2ac3e0a598a6ed20410a073db9a4d25c78abe05d
Instruction Fuzzy Hash: D8113C3AD01229FFEB10DBA8CD85FADBB78FB18750F2000A1E600B7290D6716E51DB94

Function 00A2E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00A2E1FD
MessageBoxW.USER32(?,?,?,?), ref: 00A2E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00A2E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00A2E24D

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 4441058a4dae8967f619445262597c2bbef4b09cff413e61cf589a36fd4dfb1c
Instruction ID: 39e5cff70f4d215def3624040955599f5aea32b567684ccc1cc9b07ac3ef5afc
Opcode Fuzzy Hash: 4441058a4dae8967f619445262597c2bbef4b09cff413e61cf589a36fd4dfb1c
Instruction Fuzzy Hash: B111E572A04365FFCB01DBECAC05A9B7BACAB45321F104226F925E7290D670894187A0

Function 009ED1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,009ECFF9,00000000,00000004,00000000), ref: 009ED218
GetLastError.KERNEL32 ref: 009ED224
__dosmaperr.LIBCMT ref: 009ED22B
ResumeThread.KERNEL32(00000000), ref: 009ED249

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 7f4645d2260e825826635f5fac30ca9cfc4b76df7dcc1d5b0124c0d56dbe9ad3
Instruction ID: 7779051a2dc4eed75465a7dade77b9c6ca935fd54bb3fd9472a0833bafd548a8
Opcode Fuzzy Hash: 7f4645d2260e825826635f5fac30ca9cfc4b76df7dcc1d5b0124c0d56dbe9ad3
Instruction Fuzzy Hash: 4701D636806248BFC7125BA7DC05BAE7A6DEFC1731F104219FA35962D0DB718D01C7A0

Function 009C600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 009C604C
GetStockObject.GDI32(00000011), ref: 009C6060
SendMessageW.USER32(00000000,00000030,00000000), ref: 009C606A

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 56b7c417928b91f6fef2ea5ac346e2ca6c125ff3bdea2eb3d0aee2c30ec19e12
Instruction ID: 71fd74ba6fcf375e87dff4f5e8019cb7c77923cef1c8fa4f4e491809f13a7ac2
Opcode Fuzzy Hash: 56b7c417928b91f6fef2ea5ac346e2ca6c125ff3bdea2eb3d0aee2c30ec19e12
Instruction Fuzzy Hash: D5115E72501609BFEF128F959C54FEA7B6DFF0C3A5F050215FA1462110D7369C619B91

Function 009E3B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 009E3B56

Part of subcall function 009E3AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 009E3AD2
Part of subcall function 009E3AA3: ___AdjustPointer.LIBCMT ref: 009E3AED

_UnwindNestedFrames.LIBCMT ref: 009E3B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 009E3B7C
CallCatchBlock.LIBVCRUNTIME ref: 009E3BA4

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 7fcff65aed567fea1e9b5d2ef7236205692c6bcecb67fd6d9c96e879b31113e7
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: BA01E932100189BBDF126E96CC46EEB7B6EEF98754F048054FE58A6121D732ED61DBA0

Function 009F3073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,009C13C6,00000000,00000000,?,009F301A,009C13C6,00000000,00000000,00000000,?,009F328B,00000006,FlsSetValue), ref: 009F30A5
GetLastError.KERNEL32(?,009F301A,009C13C6,00000000,00000000,00000000,?,009F328B,00000006,FlsSetValue,00A62290,FlsSetValue,00000000,00000364,?,009F2E46), ref: 009F30B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,009F301A,009C13C6,00000000,00000000,00000000,?,009F328B,00000006,FlsSetValue,00A62290,FlsSetValue,00000000), ref: 009F30BF

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: def06930bae7c9bc035dadeac535e5b8581610d486d9ed16488bbf98aa0125df
Instruction ID: 6741bf9b2f76b311de09ce1dc1edfa253a8c96ae5dea70b50ca2e3fdc5bb85ba
Opcode Fuzzy Hash: def06930bae7c9bc035dadeac535e5b8581610d486d9ed16488bbf98aa0125df
Instruction Fuzzy Hash: E101D83230132AAFC7218BB99C44D7B7B9CAF05BB1B188621FA05D7240CF29D942C7D0

Function 00A27464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 00A2747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00A27497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00A274AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00A274CA

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 0bb02f8018af937454bab496cc20fe8e2303b127a92607345e33036bc488c95a
Instruction ID: 33e0688b32da5d8e3073ff50f1e0d2e8860b477e33b26092a152a3ac3a889448
Opcode Fuzzy Hash: 0bb02f8018af937454bab496cc20fe8e2303b127a92607345e33036bc488c95a
Instruction Fuzzy Hash: 0611A1B52053209FE720DF58EC08F9A7BFCFB00B10F508569E616D6151D770EA04DB51

Function 00A2B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00A2ACD3,?,00008000), ref: 00A2B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00A2ACD3,?,00008000), ref: 00A2B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00A2ACD3,?,00008000), ref: 00A2B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00A2ACD3,?,00008000), ref: 00A2B126

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: cbe4695100f90a721e806e71f1b197a43d03281d4b3e5a264f8491769f5d1d69
Instruction ID: 96b5ff0bc261e185d36605a8ea8056466a0dde03870baf9cf1df8f1f67977091
Opcode Fuzzy Hash: cbe4695100f90a721e806e71f1b197a43d03281d4b3e5a264f8491769f5d1d69
Instruction Fuzzy Hash: 88116131C11A3DDBCF00EFE8E9686EEBB78FF49711F1042A5D941B2145CB3055518B61

Function 00A22DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00A22DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00A22DD6
GetCurrentThreadId.KERNEL32 ref: 00A22DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00A22DE4

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: d99e7b4b3a7d4e7e193922e3fca184f4f7342a363bfdfcb7a9a6e6e1c70aba9c
Instruction ID: 7f27a3bbb1a0d8a053f925f5935f1e4a0a002ab57013acd4c39165847751b4f9
Opcode Fuzzy Hash: d99e7b4b3a7d4e7e193922e3fca184f4f7342a363bfdfcb7a9a6e6e1c70aba9c
Instruction Fuzzy Hash: 1CE06D721013347BD7205BB6AC0DFEB7E6CFB42BB2F001125F105D10809AA4CA42C6B0

Function 00A58863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 009D9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 009D9693
Part of subcall function 009D9639: SelectObject.GDI32(?,00000000), ref: 009D96A2
Part of subcall function 009D9639: BeginPath.GDI32(?), ref: 009D96B9
Part of subcall function 009D9639: SelectObject.GDI32(?,00000000), ref: 009D96E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00A58887
LineTo.GDI32(?,?,?), ref: 00A58894
EndPath.GDI32(?), ref: 00A588A4
StrokePath.GDI32(?), ref: 00A588B2

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 0c8d8ee6aa5b68e0c131a45f104404c5e26cd964817dda284cf01bc3f52d5e3b
Instruction ID: 90cf7f0431769ab17402854d9e1b1d6b4c1058c45676ace9914cca42e30a1d2a
Opcode Fuzzy Hash: 0c8d8ee6aa5b68e0c131a45f104404c5e26cd964817dda284cf01bc3f52d5e3b
Instruction Fuzzy Hash: 28F03A36141359BADB12AFD4AC09FCA3B59BF06362F448101FA21650E2CB795512CBA5

Function 009D98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 009D98CC
SetTextColor.GDI32(?,?), ref: 009D98D6
SetBkMode.GDI32(?,00000001), ref: 009D98E9
GetStockObject.GDI32(00000005), ref: 009D98F1

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: f434315db7bd961d119271a77df9d8de57594d3e172d80cdf7d08a082c4ff273
Instruction ID: 4c816f8f01f5e707a39922e1ca7152ea4ac340d0c48528d81efb35ce7b9fbf5e
Opcode Fuzzy Hash: f434315db7bd961d119271a77df9d8de57594d3e172d80cdf7d08a082c4ff273
Instruction Fuzzy Hash: 57E06D31284780AEDB219BB8BC09BEC3F21BB12336F04831AF6FA590E5C77146819B10

Function 00A2162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00A21634
OpenThreadToken.ADVAPI32(00000000,?,?,?,00A211D9), ref: 00A2163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00A211D9), ref: 00A21648
OpenProcessToken.ADVAPI32(00000000,?,?,?,00A211D9), ref: 00A2164F

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 8bf9fc18626c2bbbb469ae7ef74d87280994652b83d119181dc5ce8af4a5fc26
Instruction ID: a76a1ff5f3d4df33130a93c056000f54d1734d6dd05f4ce71daf67d5e3a7c700
Opcode Fuzzy Hash: 8bf9fc18626c2bbbb469ae7ef74d87280994652b83d119181dc5ce8af4a5fc26
Instruction Fuzzy Hash: 66E04F71602321AFD7205BE4AD0DB8A3B68BF54BA6F144818F245C9084D6244542C750

Function 00A1D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00A1D858
GetDC.USER32(00000000), ref: 00A1D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00A1D882
ReleaseDC.USER32(?), ref: 00A1D8A3

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: ddf7934fb3b4020db0549a93fa5b9d6d26f730ddef91f22cc808f9fe0a11a112
Instruction ID: 4be4d21fbc0f6dbd04f380a4dc43be617a09555b2bcd3e7efb75a27bb64860b1
Opcode Fuzzy Hash: ddf7934fb3b4020db0549a93fa5b9d6d26f730ddef91f22cc808f9fe0a11a112
Instruction Fuzzy Hash: FBE075B5800305DFCB419FE0D908A6DBBB5FB48722B149459E84AE7654C7385A42AF51

Function 00A1D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00A1D86C
GetDC.USER32(00000000), ref: 00A1D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00A1D882
ReleaseDC.USER32(?), ref: 00A1D8A3

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 639cffdfa0aaf890a08edde8c8646a85fc4a66e5ab42717b974f5e292efce43a
Instruction ID: dcd6af519eb08746324e0b7d1f4a7ca906c0b16251b2bb4430e4b906990f6394
Opcode Fuzzy Hash: 639cffdfa0aaf890a08edde8c8646a85fc4a66e5ab42717b974f5e292efce43a
Instruction Fuzzy Hash: E2E092B5C00304EFCF51EFE0E808A6DBBB5FB48722B149449E94AE7654CB385A02EF50

Function 00A34D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 009C7620: _wcslen.LIBCMT ref: 009C7625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00A34ED4

Strings

*, xrefs: 00A34E10
LPT, xrefs: 00A34DFB

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: daa8cc6d802a61119881a96522dacb02db13fe3fd1ea8aa942ce72d9416865e9
Instruction ID: 86f51391733095f67223552f7479db240d5d4ad67b1636f40c5d87a7679ff26f
Opcode Fuzzy Hash: daa8cc6d802a61119881a96522dacb02db13fe3fd1ea8aa942ce72d9416865e9
Instruction Fuzzy Hash: 21915C75A002449FCB14DF58C484EAABBF1BF49704F188099F80A9F3A2D735EE85CB91

Function 009EE27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 009EE30D

Strings

pow, xrefs: 009EE2E5, 009EE302

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 1c3f8216804f73f06b3116d5ca996e017889b7e8e6edb72e9bbcae8d09131a0b
Instruction ID: ed0c46b9fbf186df881965e9d0943752370137aa3330c368a9fc86ce2014b4ec
Opcode Fuzzy Hash: 1c3f8216804f73f06b3116d5ca996e017889b7e8e6edb72e9bbcae8d09131a0b
Instruction Fuzzy Hash: 2F51AF61A0C60A96CB13BB95CD01379BBACEB40740F304D59E1E5833F9EF348C929B46

Function 009DE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 009DE1B1

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 4c559a331082d8462c2536b2a94bf46cdda70858bb15d66047de518cc8031e0c
Instruction ID: ea3c39bb60b016057d04d1f10528a3f4906bb1db1d142d59c3322704c9ea7b8d
Opcode Fuzzy Hash: 4c559a331082d8462c2536b2a94bf46cdda70858bb15d66047de518cc8031e0c
Instruction Fuzzy Hash: 7B514735940346DFEB15EF68C481AFA7BA8EF55310F24805AECA19F2D0D7349D82CB90

Function 009DF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 009DF2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 009DF2BB

Strings

@, xrefs: 009DF2AF

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: bac4a7fa71e966a6602821ca76fbb1835fde8bf81a4fb67fb048d39460869185
Instruction ID: 1d7311080420bc086890f101576d701f761cbda6c09f5d2dbd4f9585cbfc2269
Opcode Fuzzy Hash: bac4a7fa71e966a6602821ca76fbb1835fde8bf81a4fb67fb048d39460869185
Instruction Fuzzy Hash: 255114718087449BD320EF54DC86BABBBF8FBC4300F81885DF199411A5EB71956ACB67

Function 00A45745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 00A457E0
_wcslen.LIBCMT ref: 00A457EC

Strings

CALLARGARRAY, xrefs: 00A457E6, 00A457EB

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 17f95c8d20853e167f59b3f03e09c407be86059fb56cda7bd4e5ab8acee2587f
Instruction ID: 8fc7f7d4ed14c42ecda458320e2b2b44f0cb452f5c8448eeaae19606a60f3cc9
Opcode Fuzzy Hash: 17f95c8d20853e167f59b3f03e09c407be86059fb56cda7bd4e5ab8acee2587f
Instruction Fuzzy Hash: 0D419275E002099FCB14EFB9C885ABEBBF5FF99324F104069E505A7252EB309D81DB90

Function 00A3D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A3D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00A3D13A

Strings

|, xrefs: 00A3D10B

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: fcaf7a9d028674ff602d144c3d1ecf0a520a3910be1a1aed9544762b29b2d443
Instruction ID: 61c0a1de2d1b51bb44ecc876923b75b418ee522b01e49e9fa327a03b949d1924
Opcode Fuzzy Hash: fcaf7a9d028674ff602d144c3d1ecf0a520a3910be1a1aed9544762b29b2d443
Instruction Fuzzy Hash: C031F571D00209ABCF15EFA5DC85FEEBFB9FF45340F00011AF815A6166E631AA56CB61

Function 00A5356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00A53621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00A5365C

Strings

static, xrefs: 00A535BC

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 056c14e23beafd33fa66e4da3f593c9a35b3d4a2a6fdfdd176c0773fea3d87c0
Instruction ID: dd06020509e00acd2057dc61719bc3aa9d2cf086394f3c34abd483df9d3d1151
Opcode Fuzzy Hash: 056c14e23beafd33fa66e4da3f593c9a35b3d4a2a6fdfdd176c0773fea3d87c0
Instruction Fuzzy Hash: 65318B72100604AEDB10DF68DC80FBB73A9FF88761F10961DFCA597290DA30AD86DB60

Function 00A54537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00A5461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00A54634

Strings

', xrefs: 00A5458E

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: af35196d4b32341ab2cf54dba1c1887a84f4ae57f9854aecdd47c337538bff11
Instruction ID: 0fe4024e672451c5a890b9be6c8804c625a9ebc95896eef125c28fd956e7a760
Opcode Fuzzy Hash: af35196d4b32341ab2cf54dba1c1887a84f4ae57f9854aecdd47c337538bff11
Instruction Fuzzy Hash: 7E3118B4A0130AAFDB14CFA9C990BDA7BB5FF49305F14406AED05AB351E770A985CF90

Function 00A531EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00A5327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00A53287

Strings

Combobox, xrefs: 00A53249

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 1e054631ab96b5c0eda77d5b4badd8c0f4a0904443cdacccd5f6ddca9b532d00
Instruction ID: e58708349fd3e7b4057e40bd8e79446cfe100a55909d230c709ba62b27e4950f
Opcode Fuzzy Hash: 1e054631ab96b5c0eda77d5b4badd8c0f4a0904443cdacccd5f6ddca9b532d00
Instruction Fuzzy Hash: 46119D723006087FEF219F94DC80EFF3B6AFBA83A5F104229F919A7290D6759D558760

Function 00A53710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 009C600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 009C604C
Part of subcall function 009C600E: GetStockObject.GDI32(00000011), ref: 009C6060
Part of subcall function 009C600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 009C606A

GetWindowRect.USER32(00000000,?), ref: 00A5377A
GetSysColor.USER32(00000012), ref: 00A53794

Strings

static, xrefs: 00A53757

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 128df34688ca146bd967afe703820b8e549f1f75ea2a936b70668a168fb790da
Instruction ID: 49d5ccef6947c9352fe2f7f14505064c62c8bf5808a089a28bc38190803cdba2
Opcode Fuzzy Hash: 128df34688ca146bd967afe703820b8e549f1f75ea2a936b70668a168fb790da
Instruction Fuzzy Hash: 951126B2A1020AAFDF00DFA8CC46EEA7BB8FB48355F004915FD56E2250E735E955DB60

Function 00A3CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00A3CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00A3CDA6

Strings

<local>, xrefs: 00A3CD66

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 27e6e21814333f8754a21e4ae27cc93441bbefa5d28c3163b9ca191748c5c120
Instruction ID: cd85e3331dc0a5f86715f5985081d9e04a49c26a83cfab249a25daa632b81675
Opcode Fuzzy Hash: 27e6e21814333f8754a21e4ae27cc93441bbefa5d28c3163b9ca191748c5c120
Instruction Fuzzy Hash: D311C2B5205631BED7384B668C49EE7BEACEF127F4F00422AB109A3080D7749941D7F0

Function 00A53429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00A534AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00A534BA

Strings

edit, xrefs: 00A5348F

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 57f83cf12ff57cc984d31da7167704bd75913ca7e27bbb3e6db2375e7050e6f3
Instruction ID: c9b90657e301b163d6147612fc2112e3a7c8cfd2247eeef15d798b15db31a213
Opcode Fuzzy Hash: 57f83cf12ff57cc984d31da7167704bd75913ca7e27bbb3e6db2375e7050e6f3
Instruction Fuzzy Hash: EE118B72100208AFEF118FA49C40AAA376AFB843B6F504724FD61931D4C735DC9A9750

Function 00A26C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 009C9CB3: _wcslen.LIBCMT ref: 009C9CBD

CharUpperBuffW.USER32(?,?,?), ref: 00A26CB6
_wcslen.LIBCMT ref: 00A26CC2

Strings

STOP, xrefs: 00A26CBC, 00A26CC1

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 36afaed53f08e7a4d1822658c644b8ac7b23833d9b9319183bf9020e6a29343e
Instruction ID: d70c76a0aae0d6ca94551687efa28009d1f47a07c7d9d89f4629b2d6cb3d3c1b
Opcode Fuzzy Hash: 36afaed53f08e7a4d1822658c644b8ac7b23833d9b9319183bf9020e6a29343e
Instruction Fuzzy Hash: 1501D232A0193A8BCB21AFFDEC80ABF77B5FBA57147500539E86297195EB31D900C650

Function 00A21CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009C9CB3: _wcslen.LIBCMT ref: 009C9CBD

Part of subcall function 00A23CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00A23CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00A21D4C

Strings

ListBox, xrefs: 00A21D16
ComboBox, xrefs: 00A21CEB

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 243dca033413980b35cd65e4d78cc1a34812a69bedc4a492926ad21bb942aebd
Instruction ID: 7ba8cc3cf23519f96ba421eaaa84ddc2ce6812869970d37e1af3c25e26276e03
Opcode Fuzzy Hash: 243dca033413980b35cd65e4d78cc1a34812a69bedc4a492926ad21bb942aebd
Instruction Fuzzy Hash: BF012871A00224ABCF08EFA8ED15EFE73A8FB62350B400929F872572C1EA3459088761

Function 00A21BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009C9CB3: _wcslen.LIBCMT ref: 009C9CBD

Part of subcall function 00A23CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00A23CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00A21C46

Strings

ListBox, xrefs: 00A21C10
ComboBox, xrefs: 00A21BE5

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 66245b3c354adc14ece26e748b07d1c75752dc01b4327c4c39fb37903ede5f95
Instruction ID: 1d06d3ded91c26974c075481abd95cc6c905dbbe97bbacd51629852fcc431166
Opcode Fuzzy Hash: 66245b3c354adc14ece26e748b07d1c75752dc01b4327c4c39fb37903ede5f95
Instruction Fuzzy Hash: 71018475A811187BCB08EBA4DA55FFF77A89B62340F140029A816772C1EA249E1886B2

Function 00A21C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009C9CB3: _wcslen.LIBCMT ref: 009C9CBD

Part of subcall function 00A23CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00A23CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00A21CC8

Strings

ListBox, xrefs: 00A21C94
ComboBox, xrefs: 00A21C69

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: a02febf8858f3f01bf65dcfa576a60ad275531eef861a02eb74b01467e0bda65
Instruction ID: 92747c737c8893acd6f09a140d8b01a326b9e119c485a61e4961a1c44d586880
Opcode Fuzzy Hash: a02febf8858f3f01bf65dcfa576a60ad275531eef861a02eb74b01467e0bda65
Instruction Fuzzy Hash: 8B01DB75E8012467CF04FBA8DB15FFE77A8AB21340F140439B80673281EA249F18C672

Function 00A4747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A47493
_wcslen.LIBCMT ref: 00A474B9

Strings

3, 3, 16, 1, xrefs: 00A47483

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 7714bbd2e46d7a0f6c98c8d350a262fd84d77e299e8f94b10067f4d0e8ce3ae7
Instruction ID: 4d7e9763ef290122826587824e7a51617618e2bd12e80f50a0095166ecd7399b
Opcode Fuzzy Hash: 7714bbd2e46d7a0f6c98c8d350a262fd84d77e299e8f94b10067f4d0e8ce3ae7
Instruction Fuzzy Hash: BDE02B0A2042A0209232237A9CC1A7F5789DFC9B91710182BF981D6267EB94CD9193F1

Function 00A20B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00A20B23

Strings

Error allocating memory., xrefs: 00A20B1C
AutoIt, xrefs: 00A20B17

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 708a493244a6fd97ce4019e7e47ce612c0f2f682c3cae6d76a1475dffe685c72
Instruction ID: 50c0d40225461533142dfa413d258859245f923c31fe07d594a0223415a95436
Opcode Fuzzy Hash: 708a493244a6fd97ce4019e7e47ce612c0f2f682c3cae6d76a1475dffe685c72
Instruction Fuzzy Hash: A0E0D8312843183ED21037957C03F897F84EF09F61F10482BFB88955C38AE1685046A9

Function 009E0D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 009DF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,009E0D71,?,?,?,009C100A), ref: 009DF7CE

IsDebuggerPresent.KERNEL32(?,?,?,009C100A), ref: 009E0D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,009C100A), ref: 009E0D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 009E0D7F

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 5b75aafe0e6aa728bc31748685febcb981067f1da01e762ba1becb88212d0939
Instruction ID: da159851db3c8b367d956c45d1b3a104a67ab89e9b91c9277624ab30d23e6cff
Opcode Fuzzy Hash: 5b75aafe0e6aa728bc31748685febcb981067f1da01e762ba1becb88212d0939
Instruction Fuzzy Hash: FEE06D702003418FD371EFB9E80578A7BE4BB40745F00892DE882C7695DBF0E889CBA1

Function 00A33017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00A3302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00A33044

Strings

aut, xrefs: 00A33038

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: b10c57a4abadc6547898064ea9ed7dc6b6ee8a0a1f671dc8489c3917b8e764e7
Instruction ID: 08a610a79147774b4aa50418f13c790ba52eb6e060caf3cf16cba49aa534020c
Opcode Fuzzy Hash: b10c57a4abadc6547898064ea9ed7dc6b6ee8a0a1f671dc8489c3917b8e764e7
Instruction Fuzzy Hash: E3D05E725003287BDA20F7E4AC4EFCB7A6CEB04761F0006A1B655E2095EAB09985CBD0

Function 00A1D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00A1D220

Strings

%.3d, xrefs: 00A1D22B
X64, xrefs: 00A1D2A8

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 6d7addf51120e9b79eb79124a2af4703b31f33bb097497a187d48aa0a2fc4c34
Instruction ID: d5b19dab9205145a19cf498dd37776c0f830b82df140e1c0b224945ffe48b304
Opcode Fuzzy Hash: 6d7addf51120e9b79eb79124a2af4703b31f33bb097497a187d48aa0a2fc4c34
Instruction Fuzzy Hash: DFD012B1849218F9CF50A6D0DC459FDB37CFB59301F608453F816A1040D638D5886761

Function 00A52322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00A5232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00A5233F

Part of subcall function 00A2E97B: Sleep.KERNEL32 ref: 00A2E9F3

Strings

Shell_TrayWnd, xrefs: 00A52325

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 2ffa984c5d750d6af02ebd1e0951de130f21050ae729f9af6e7b6099805c7186
Instruction ID: 2d63dc13b102921bb690f79d62a7dca35cf135305862f91f940075ea895b0193
Opcode Fuzzy Hash: 2ffa984c5d750d6af02ebd1e0951de130f21050ae729f9af6e7b6099805c7186
Instruction Fuzzy Hash: 40D012763D4310BBE664F7B0ED1FFC6BA14BB00B21F0049167745AA1D4D9F4A842CB54

Function 00A52356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00A5236C
PostMessageW.USER32(00000000), ref: 00A52373

Part of subcall function 00A2E97B: Sleep.KERNEL32 ref: 00A2E9F3

Strings

Shell_TrayWnd, xrefs: 00A52365

Memory Dump Source

Source File: 00000000.00000002.1270280485.00000000009C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009C0000, based on PE: true

Associated: 00000000.00000002.1270257651.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270354088.0000000000A82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270418170.0000000000A8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1270441932.0000000000A94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9c0000_RFQ_AS0101402025.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: c2fa820f661dc520790992be051a232a75c2a2d56232fdc7f44a5379de92883a
Instruction ID: f06c07b333be2a754f73efbf7f6783ff241464a44f5906d838307a4f12b73e85
Opcode Fuzzy Hash: c2fa820f661dc520790992be051a232a75c2a2d56232fdc7f44a5379de92883a
Instruction Fuzzy Hash: 9ED0C9723C13107AE664F7B0AD1FFC6A614AB04B21F4049167645AA1D4D9A4A8428A54

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RFQ_AS0101402025.22025_PDF.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: MassLogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\vitraillist

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
RFQ_AS0101402025.22025_PDF.exe

Function 009C42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Function 009C42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Function 00A02BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Function 009C2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Function 00A0065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Function 009C344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 009C2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Function 009C3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Function 015E89F0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 009C2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 015E87A0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 153
fileCOMMON

Function 009C3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Function 015E7690 Relevance: 6.7, APIs: 4, Instructions: 720
processthreadCOMMON

Function 009C3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94
windowCOMMON

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre