Edit tour

Windows Analysis Report
rOrderRequest09-24.exe

Overview

General Information

Sample name:	rOrderRequest09-24.exe
Analysis ID:	1518168
MD5:	3e322cacdbc509091f2950c4e04ff85f
SHA1:	d4eab59133e0f767f7c954ee11599d7c8fdffafc
SHA256:	9e783a78671bd03144b0def1540d93a92dbb8fcdd5a75bfa26a1d11e6c613bff
Tags:	AgentTeslaexeuser-Porcupine
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Contains functionality to log keystrokes (.Net Source)

Found API chain indicative of sandbox detection

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

rOrderRequest09-24.exe (PID: 7780 cmdline: "C:\Users\user\Desktop\rOrderRequest09-24.exe" MD5: 3E322CACDBC509091F2950C4E04FF85F)

RegSvcs.exe (PID: 7960 cmdline: "C:\Users\user\Desktop\rOrderRequest09-24.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Host": "mail.agaliofu.top", "Username": "egooyibo@agaliofu.top", "Password": "QPS.6YYl.Yi=                          "}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2511992775.0000000002983000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.2511992775.0000000002957000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.2509888429.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.1279971744.0000000003D60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000005.00000002.2511992775.0000000002901000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2511992775.0000000002901000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 7960	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7960	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
5.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.rOrderRequest09-24.exe.3d60000.1.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.rOrderRequest09-24.exe.3d60000.1.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 194.36.191.196, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 7960, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49704

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: rOrderRequest09-24.exe

Avira: detected

Found malware configuration

Source: 5.2.RegSvcs.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Host": "mail.agaliofu.top", "Username": "egooyibo@agaliofu.top", "Password": "QPS.6YYl.Yi= "}

Multi AV Scanner detection for submitted file

Source: rOrderRequest09-24.exe

ReversingLabs: Detection: 78%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: rOrderRequest09-24.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Yandex Browser
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Yandex\YandexBrowser\User Data
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Iridium Browser
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Iridium\User Data
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Chromium
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Chromium\User Data
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: 7Star
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: 7Star\7Star\User Data
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Torch Browser
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Torch\User Data
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Cool Novo
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: MapleStudio\ChromePlus\User Data
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Kometa
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Kometa\User Data
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Amigo
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Amigo\User Data
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Brave
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: BraveSoftware\Brave-Browser\User Data
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: CentBrowser
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: CentBrowser\User Data
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Chedot
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Chedot\User Data
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Orbitum
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Orbitum\User Data
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Sputnik
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Sputnik\Sputnik\User Data
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Comodo Dragon
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Comodo\Dragon\User Data
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Vivaldi
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Vivaldi\User Data
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Citrio
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: CatalinaGroup\Citrio\User Data
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: 360 Browser
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: 360Chrome\Chrome\User Data
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Uran
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: uCozMedia\Uran\User Data
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Liebao Browser
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: liebao\User Data
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Elements Browser
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Elements Browser\User Data
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Epic Privacy
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Epic Privacy Browser\User Data
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Coccoc
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: CocCoc\Browser\User Data
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Sleipnir 6
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: QIP Surf
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: QIP Surf\User Data
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Coowon
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Coowon\Coowon\User Data
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Chrome
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Google\Chrome\User Data
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Edge Chromium
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Microsoft\Edge\User Data
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Firefox
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: \Mozilla\Firefox\
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: SeaMonkey
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: \Mozilla\SeaMonkey\
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Thunderbird
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: \Thunderbird\
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: BlackHawk
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: \NETGATE Technologies\BlackHawk\
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: CyberFox
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: \8pecxstudios\Cyberfox\
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: K-Meleon
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: \K-Meleon\
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: IceCat
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: \Mozilla\icecat\
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: PaleMoon
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: \Moonchild Productions\Pale Moon\
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: IceDragon
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: \Comodo\IceDragon\
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: WaterFox
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: \Waterfox\
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Postbox
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: \Postbox\
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Flock
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: \Flock\Browser\
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: true
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: APPDATA
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: 00061561
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Berkelet DB
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: 00000002
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: 1.85 (Hash, version 2, native byte-order)
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Unknow database format
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: SQLite format 3
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: table
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: UNIQUE
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: SEQUENCE {
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: {0:X2}
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: {0:X2}
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: {0:X2}
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Windows Credential
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: credential
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: policy
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: blob
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: chrome
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: {{{0}}}
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: chrome
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: {{{0}}}
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: sha512
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: sha512
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: ObjectLength
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: ChainingModeGCM
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: AuthTagLength
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: ChainingMode
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: KeyDataBlob
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Microsoft Primitive Provider
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: :Zone.Identifier
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: SystemDrive
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: {0:X2}
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: SELECT * FROM Win32_Processor
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Name
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: .tmp
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: None
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: win32_processor
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: processorID
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: 39b6a7c8-57aa-4217-8010-6d31cf8ae5fd
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Win32_NetworkAdapterConfiguration
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: IPEnabled
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: MacAddress
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: 2b659ec0-5f97-4701-9f8d-29845a00e324
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Win32_BaseBoard
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: SerialNumber
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: dab83869-5263-4922-818e-93628a526011
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: yyyy_MM_dd_HH_mm_ss
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: .html
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: text/html
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: yyyy_MM_dd_HH_mm_ss
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: .html
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: {0}:
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: StorageSize: {0} (0x{0:X})
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Version: 0x{0:X}
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: FormatID: {0}
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Size of the SerializedPropertyStorage is less than 28 ({0})
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Size of the SerializedPropertyStore is less than {0} ({1})
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Version is not equal to {0} ({1})
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: {D5CDD505-2E9C-101B-9397-08002B2CF9AE}
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Type: {0}
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Value: {0}
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: ValueSize: {0} (0x{0:X})
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: NameSize: {0} (0x{0:X})
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Name: {0}
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Size of the StringName is less than 9 ({0})
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Size of the StringName is not equal to {0} ({1})
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Size of the NameSize is not equal to {0} ({1})
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: ValueSize: {0} (0x{0:X})
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: ID: 0x{0:X}
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Size of the StringName is less than 9 ({0})
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Size of the StringName is not equal to {0} ({1})
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Size of the SerializedPropertyStore is less than 8 ({0})
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Size of the SerializedPropertyStore is less than {0} ({1})
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: StoreSize: {0} (0x{0X})
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: \Device\LanmanRedirector\
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: \Device\LanmanRedirector\
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: Failed to retrieve system handle information.
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: ()^G.
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: YsSY
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: XRxX
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: XXxX
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: ccccCicb
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: ?=__
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: XRxX
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: SYX\|qYYYIyYYYYyY
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: X\xX
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: X^xX
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: XPxX
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: *SY[pqXY
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: BBMbB
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: '''''?'''"
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack	String decryptor: T:T5

Source: rOrderRequest09-24.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: wntdll.pdbUGP source: rOrderRequest09-24.exe, 00000000.00000003.1267487489.0000000004590000.00000004.00001000.00020000.00000000.sdmp, rOrderRequest09-24.exe, 00000000.00000003.1267135903.00000000043F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: rOrderRequest09-24.exe, 00000000.00000003.1267487489.0000000004590000.00000004.00001000.00020000.00000000.sdmp, rOrderRequest09-24.exe, 00000000.00000003.1267135903.00000000043F0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BCC2A2 FindFirstFileExW,	0_2_00BCC2A2
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00C068EE FindFirstFileW,FindClose,	0_2_00C068EE
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00C0698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00C0698F
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BFD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00BFD076
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BFD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00BFD3A9
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00C09642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00C09642
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00C0979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00C0979D
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BFDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00BFDBBE
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00C09B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00C09B2B
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00C05C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00C05C97

Source: global traffic

TCP traffic: 192.168.2.10:49704 -> 194.36.191.196:587

Source: Joe Sandbox View	IP Address: 194.36.191.196 194.36.191.196
Source: Joe Sandbox View	IP Address: 194.36.191.196 194.36.191.196

Source: Joe Sandbox View

ASN Name: HSAE HSAE

Source: global traffic

TCP traffic: 192.168.2.10:49704 -> 194.36.191.196:587

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00C0CE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

0_2_00C0CE44

Source: global traffic

DNS traffic detected: DNS query: mail.agaliofu.top

Source: RegSvcs.exe, 00000005.00000002.2511992775.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://agaliofu.top
Source: RegSvcs.exe, 00000005.00000002.2511992775.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.agaliofu.top
Source: RegSvcs.exe, 00000005.00000002.2511992775.0000000002961000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2510548933.0000000000B86000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2514118435.0000000005B80000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2514118435.0000000005BCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r10.i.lencr.org/0
Source: RegSvcs.exe, 00000005.00000002.2511992775.0000000002961000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2510548933.0000000000B86000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2514118435.0000000005B80000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2514118435.0000000005BCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r10.o.lencr.org0#
Source: RegSvcs.exe, 00000005.00000002.2511992775.0000000002961000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2510548933.0000000000B86000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2514118435.0000000005B80000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2514118435.0000000005BCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: RegSvcs.exe, 00000005.00000002.2511992775.0000000002961000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2510548933.0000000000B86000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2514118435.0000000005B80000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2514118435.0000000005BCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.rOrderRequest09-24.exe.3d60000.1.raw.unpack, SoC.cs

.Net Code: _0PCB6lvQ5rw

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00C0EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00C0EAFF

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00C0ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00C0ED6A

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

0_2_00C0EAFF

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00BFAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_00BFAA57

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00C29576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00C29576

System Summary

Binary is likely a compiled AutoIt script file

Source: rOrderRequest09-24.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: rOrderRequest09-24.exe, 00000000.00000000.1258221066.0000000000C52000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_70c505a8-9
Source: rOrderRequest09-24.exe, 00000000.00000000.1258221066.0000000000C52000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_85d05581-8
Source: rOrderRequest09-24.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_690dfdc4-2
Source: rOrderRequest09-24.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_33d6ab72-2

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: rOrderRequest09-24.exe

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00BFD5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00BFD5EB

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00BF1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00BF1201

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00BFE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00BFE8F6

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00C02046	0_2_00C02046
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00B98060	0_2_00B98060
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BF8298	0_2_00BF8298
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BCE4FF	0_2_00BCE4FF
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BC676B	0_2_00BC676B
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00C24873	0_2_00C24873
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BBCAA0	0_2_00BBCAA0
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00B9CAF0	0_2_00B9CAF0
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BACC39	0_2_00BACC39
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BC6DD9	0_2_00BC6DD9
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00B991C0	0_2_00B991C0
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BAB119	0_2_00BAB119
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BB1394	0_2_00BB1394
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BB1706	0_2_00BB1706
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BB781B	0_2_00BB781B
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BB19B0	0_2_00BB19B0
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00B97920	0_2_00B97920
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BA997D	0_2_00BA997D
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BB7A4A	0_2_00BB7A4A
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BB7CA7	0_2_00BB7CA7
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BB1C77	0_2_00BB1C77
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BC9EEE	0_2_00BC9EEE
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00C1BE44	0_2_00C1BE44
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BB1F32	0_2_00BB1F32
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_03F75670	0_2_03F75670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_00D34250	5_2_00D34250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_00D3A430	5_2_00D3A430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_00D3F9C8	5_2_00D3F9C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_00D3AC48	5_2_00D3AC48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_00D34E68	5_2_00D34E68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_00D34598	5_2_00D34598
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_05C95790	5_2_05C95790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_05C98160	5_2_05C98160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_05C96810	5_2_05C96810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_05C92370	5_2_05C92370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_05C9BB08	5_2_05C9BB08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_05C95EE8	5_2_05C95EE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_05C9F130	5_2_05C9F130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_05C90040	5_2_05C90040

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: String function: 00B99CB3 appears 31 times
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: String function: 00BAF9F2 appears 40 times
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: String function: 00BB0A30 appears 46 times

Source: rOrderRequest09-24.exe, 00000000.00000003.1272451924.0000000004563000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs rOrderRequest09-24.exe
Source: rOrderRequest09-24.exe, 00000000.00000003.1266493605.00000000046BD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs rOrderRequest09-24.exe
Source: rOrderRequest09-24.exe, 00000000.00000002.1279971744.0000000003D60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename667ba23f-a209-46d6-8a32-7e551fe203f6.exe4 vs rOrderRequest09-24.exe

Source: rOrderRequest09-24.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.rOrderRequest09-24.exe.3d60000.1.raw.unpack, 3SHNS.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.raw.unpack, Nsobj.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.raw.unpack, kPjPB5Pg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.raw.unpack, L0cY6BffcK.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.raw.unpack, U25VpnZdCi.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.raw.unpack, 8Po0IVbA.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.raw.unpack, En337tp.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.raw.unpack, En337tp.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.raw.unpack, F1ul27ct.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.raw.unpack, F1ul27ct.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.raw.unpack, F1ul27ct.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rOrderRequest09-24.exe.3d60000.1.raw.unpack, F1ul27ct.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@1/1

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00C037B5 GetLastError,FormatMessageW,

0_2_00C037B5

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BF10BF AdjustTokenPrivileges,CloseHandle,		0_2_00BF10BF
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BF16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00BF16C3

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00C051CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00C051CD

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00C1A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00C1A67C

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00C0648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_00C0648E

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00B942A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00B942A2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

File created: C:\Users\user\AppData\Local\Temp\wherefore

Jump to behavior

Source: rOrderRequest09-24.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: rOrderRequest09-24.exe

ReversingLabs: Detection: 78%

Source: unknown	Process created: C:\Users\user\Desktop\rOrderRequest09-24.exe "C:\Users\user\Desktop\rOrderRequest09-24.exe"
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\rOrderRequest09-24.exe"
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\rOrderRequest09-24.exe"	Jump to behavior

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: rOrderRequest09-24.exe

Static file information: File size 1597952 > 1048576

Source: rOrderRequest09-24.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: rOrderRequest09-24.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: rOrderRequest09-24.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: rOrderRequest09-24.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: rOrderRequest09-24.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: rOrderRequest09-24.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: rOrderRequest09-24.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: rOrderRequest09-24.exe, 00000000.00000003.1267487489.0000000004590000.00000004.00001000.00020000.00000000.sdmp, rOrderRequest09-24.exe, 00000000.00000003.1267135903.00000000043F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: rOrderRequest09-24.exe, 00000000.00000003.1267487489.0000000004590000.00000004.00001000.00020000.00000000.sdmp, rOrderRequest09-24.exe, 00000000.00000003.1267135903.00000000043F0000.00000004.00001000.00020000.00000000.sdmp

Source: rOrderRequest09-24.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: rOrderRequest09-24.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: rOrderRequest09-24.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: rOrderRequest09-24.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: rOrderRequest09-24.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00B942DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00B942DE

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00BB0A76 push ecx; ret

0_2_00BB0A89

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BAF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00BAF98E
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00C21C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00C21C41

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-98809

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

API/Special instruction interceptor: Address: 3F75294

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7564			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1795			Jump to behavior

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

API coverage: 3.5 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BCC2A2 FindFirstFileExW,	0_2_00BCC2A2
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00C068EE FindFirstFileW,FindClose,	0_2_00C068EE
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00C0698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00C0698F
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BFD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00BFD076
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BFD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00BFD3A9
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00C09642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00C09642
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00C0979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00C0979D
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BFDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00BFDBBE
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00C09B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00C09B2B
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00C05C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00C05C97

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00B942DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00B942DE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96593	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95060	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: RegSvcs.exe, 00000005.00000002.2514118435.0000000005B80000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlleExtKKG

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00C0EAA2 BlockInput,

0_2_00C0EAA2

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00BC2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00BC2622

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00B942DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00B942DE

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BB4CE8 mov eax, dword ptr fs:[00000030h]	0_2_00BB4CE8
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_03F75560 mov eax, dword ptr fs:[00000030h]	0_2_03F75560
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_03F75500 mov eax, dword ptr fs:[00000030h]	0_2_03F75500
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_03F73EC0 mov eax, dword ptr fs:[00000030h]	0_2_03F73EC0

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00BF0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00BF0B62

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BC2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00BC2622
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BB083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00BB083F
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BB09D5 SetUnhandledExceptionFilter,	0_2_00BB09D5
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00BB0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00BB0C21

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 73C008

Jump to behavior

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

0_2_00BF1201

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00BD2BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00BD2BA5

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00BFB226 SendInput,keybd_event,

0_2_00BFB226

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00C122DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_00C122DA

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\rOrderRequest09-24.exe"

Jump to behavior

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

0_2_00BF0B62

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00BF1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00BF1663

Source: rOrderRequest09-24.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: rOrderRequest09-24.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00BB0698 cpuid

0_2_00BB0698

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00C08195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00C08195

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00BED27A GetUserNameW,

0_2_00BED27A

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00BCB952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

0_2_00BCB952

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe

Code function: 0_2_00B942DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00B942DE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 00000005.00000002.2511992775.0000000002983000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2511992775.0000000002957000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2511992775.0000000002901000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7960, type: MEMORYSTR
Source: Yara match	File source: 5.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rOrderRequest09-24.exe.3d60000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2509888429.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1279971744.0000000003D60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: rOrderRequest09-24.exe	Binary or memory string: WIN_81
Source: rOrderRequest09-24.exe	Binary or memory string: WIN_XP
Source: rOrderRequest09-24.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: rOrderRequest09-24.exe	Binary or memory string: WIN_XPe
Source: rOrderRequest09-24.exe	Binary or memory string: WIN_VISTA
Source: rOrderRequest09-24.exe	Binary or memory string: WIN_7
Source: rOrderRequest09-24.exe	Binary or memory string: WIN_8

Source: Yara match	File source: 00000005.00000002.2511992775.0000000002901000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7960, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 00000005.00000002.2511992775.0000000002983000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2511992775.0000000002957000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2511992775.0000000002901000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7960, type: MEMORYSTR
Source: Yara match	File source: 5.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rOrderRequest09-24.exe.3d60000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rOrderRequest09-24.exe.3d60000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2509888429.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1279971744.0000000003D60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00C11204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00C11204
Source: C:\Users\user\Desktop\rOrderRequest09-24.exe	Code function: 0_2_00C11806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00C11806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	121 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	138 System Information Discovery	Distributed Component Object Model	121 Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	331 Security Software Discovery	SSH	3 Clipboard Data	11 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	221 Virtualization/Sandbox Evasion	Cached Domain Credentials	221 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
rOrderRequest09-24.exe	79%	ReversingLabs	Win32.Spyware.Negasteal
rOrderRequest09-24.exe	100%	Avira	DR/AutoIt.Gen8
rOrderRequest09-24.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://r10.o.lencr.org0#	0%	Avira URL Cloud	safe
http://r10.i.lencr.org/0	0%	Avira URL Cloud	safe
http://agaliofu.top	0%	Avira URL Cloud	safe
http://mail.agaliofu.top	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
agaliofu.top	194.36.191.196	true	true		unknown
mail.agaliofu.top	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://r10.o.lencr.org0#	RegSvcs.exe, 00000005.00000002.2511992775.0000000002961000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2510548933.0000000000B86000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2514118435.0000000005B80000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2514118435.0000000005BCF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mail.agaliofu.top	RegSvcs.exe, 00000005.00000002.2511992775.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	RegSvcs.exe, 00000005.00000002.2511992775.0000000002961000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2510548933.0000000000B86000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2514118435.0000000005B80000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2514118435.0000000005BCF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	RegSvcs.exe, 00000005.00000002.2511992775.0000000002961000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2510548933.0000000000B86000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2514118435.0000000005B80000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2514118435.0000000005BCF000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://agaliofu.top	RegSvcs.exe, 00000005.00000002.2511992775.0000000002961000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://r10.i.lencr.org/0	RegSvcs.exe, 00000005.00000002.2511992775.0000000002961000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2510548933.0000000000B86000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2514118435.0000000005B80000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2514118435.0000000005BCF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
194.36.191.196	agaliofu.top	Netherlands		60117	HSAE	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1518168
Start date and time:	2024-09-25 13:45:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	rOrderRequest09-24.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 43 Number of non-executed functions: 301
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: rOrderRequest09-24.exe

Simulations

Behavior and APIs

Time	Type	Description
07:46:06	API Interceptor	46x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
194.36.191.196	http://theclearinghouseus.org	Get hash	malicious	Unknown	Browse	theclearinghouseus.org/www.theclearinghouse.org/connected-banking.html
	gqtya.ps1	Get hash	malicious	Unknown	Browse	udr-offdips.com/buy/
	http://store.avast.com/store?SiteID=avast&Action=DisplayRedirectCustomPage&Locale=en_US&v=1&t=event&tid=UA-58120669-65&cid=725399894.1568213989&ec=Emailing_Digital%20River&aip=1&cm10=1&ds=Avast&ul=en_US&cs=Digital%20River&cm=email&cd2=Paid&cd3=725399894.1568213989&cd4=Business&cd5=BMG-00-001-36-AR&cd7=13306019910&cd6=22895593139&cd8=0&cd9=4871168000&cd10=USD&cd11=44&cd12=1659005853297&ea=Click&el=http://0gjysc.wildlifewalkabout.com/am9lbC5uYXNzaWZAYXJuLmFl	Get hash	malicious	Unknown	Browse	0gjysc.wildlifewalkabout.com/am9lbC5uYXNzaWZAYXJuLmFl
	#U6025-146102220896 BSIU2505935-Remitance Advise.xlsx	Get hash	malicious	FormBook	Browse	www.firstflightmdelivery.services/inug/?LJBd06wP=my5vzthd/gf6h+YfXGHF51EmCUBukXLQvdzfbkPp7mscRjHMsb7qcEfg2/kZIm7kG7WZ0g==&-ZcxnF=8p74g4BxA
	jun.exe	Get hash	malicious	AZORult	Browse	squerad.com/cgi-sys/suspendedpage.cgi
	Player offer.exe	Get hash	malicious	AZORult	Browse	squerad.com/frank/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HSAE	Ordine Request 09-24.exe	Get hash	malicious	AgentTesla	Browse	194.36.191.196
	gtss.exe	Get hash	malicious	Unknown	Browse	194.36.188.9
	gtss.exe	Get hash	malicious	Unknown	Browse	194.36.188.9
	gtsx.exe	Get hash	malicious	Unknown	Browse	194.36.188.9
	Document (6) lnk.lnk	Get hash	malicious	Unknown	Browse	185.198.59.26
	Document (5) lnk.lnk	Get hash	malicious	Unknown	Browse	185.244.151.84
	Ordem de Compra.exe	Get hash	malicious	AgentTesla	Browse	194.36.191.196
	http://cryptorabotakzz.com/	Get hash	malicious	Unknown	Browse	185.244.151.84
	zte.arm7.elf	Get hash	malicious	Unknown	Browse	185.106.123.68
	New Order List 2024.exe	Get hash	malicious	AgentTesla	Browse	194.36.191.196

Process:	C:\Users\user\Desktop\rOrderRequest09-24.exe
File Type:	data
Category:	dropped
Size (bytes):	244224
Entropy (8bit):	6.99267268605852
Encrypted:	false
SSDEEP:	3072:YwVKA8n67ZGCmn1/oiHszSoRWu1SPVooQ9d1LhgfVZdUKCYB5+7rt7jCOs0qwKvW:pNY/oLzJ9i6oUdrguFa9wKvLYf8e
MD5:	A55426467B44A6A470694D0FDC95EAC0
SHA1:	5551150B089B3226B5EBEAC084EE91435D982535
SHA-256:	4B3E578D45C6C0E4275D9E1E50CC334622B1C2D26185D07FD59941B86EB61ED1
SHA-512:	F883890B3301D3CB2ADE943B365F40C9BCF3B91E2EF7AAFD991A9544F8AAAE474740A1AAF59E0D8D332B2DD2832C1637060D957B4DC1074E894B5B3278A9C4F2
Malicious:	false
Reputation:	low
Preview:	...479N6=DTO.YQ.W7JL2GP.E449N69DTO0RYQ3W7JL2GPQE449N69DTO0R.Q3W9U.<G.X...8....<&Cr)#\0E+!.$1?+[@.,S.6!!.;7qw.dj!]#5.H9>.N69DTO0..Q3.6IL{.5E449N69D.O2SRP.W7.O2GXQE449N8.GTO.RYQ.T7JLrGPqE44;N6=DTO0RYQ7W7JL2GPQe049L69DTO0PY..W7ZL2WPQE4$9N&9DTO0RIQ3W7JL2GPQE..:Ne9DTO.QY.6W7JL2GPQE449N69DTO0R]Q?W7JL2GPQE449N69DTO0RYQ3W7JL2GPQE449N69DTO0RYQ3W7JL2GpQE<49N69DTO0RYY.W7.L2GPQE449N6.017DRYQ'.4JL.GPQ.749L69DTO0RYQ3W7JL.GP1kFGK-69D.J0RY.0W7LL2G.RE449N69DTO0RY.3Wwd>W+?2E489N69DPO0PYQ3.4JL2GPQE449N69.TOrRYQ3W7JL2GPQE449..:DTO0R.Q3W5JI2.SE$.9N59DTN0R_Q3W7JL2GPQE449N69DTO0RYQ3W7JL2GPQE449N69DTO0RYQ3J.....o.I.3,1.b.(.Q.. .3.}H.D.O ..}.I....vFQ..L.H`...=....1.G5+X.....tRL!_-gC.AW.Y..l.dpG.\|.J\.*..J..X?`.f...w....=3....@..UV)z.@"54..V,-@..S.549N6.......Z/\|.a1HNeWLb....pF7f...)7JLVGPQ7449/69D.O0R6Q3WYJL29PQEJ49Np9DT.0RYf3W7oL2G=QE4.9N6GDTO./V^...#?..PQE44.....9.......zC...'...R....5..^[.@..u.._.._u.!k/Rl~.^P5S2HK6D\lK.....;@PJ2U]R?j9...q.c.....5....#.OW7JL2G.QE.49N..D.O0R.Q.W..L2G.E.4.N...T

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.375245100296791
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	rOrderRequest09-24.exe
File size:	1'597'952 bytes
MD5:	3e322cacdbc509091f2950c4e04ff85f
SHA1:	d4eab59133e0f767f7c954ee11599d7c8fdffafc
SHA256:	9e783a78671bd03144b0def1540d93a92dbb8fcdd5a75bfa26a1d11e6c613bff
SHA512:	45fa5310f55df604989b511bdc094dda73dcbb3fea40a07253bb692ab33d0275912dcd4fcdbbeb52c33a8bf5b3aa3d2e832c03386b25600e99adcaf005a03497
SSDEEP:	24576:EqDEvCTbMWu7rQYlBQcBiT6rprG8aYB/yrO95Haw09t4EtDDkINjtRoSrKm0:ETvC/MTQYxsWR7aYB/t7HartldvoSr
TLSH:	A675D0C273819062FE9B91720B76FA1356BD6E2D0D23A51F03953D79BE701B1123E6A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	8319596d4d756986

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66E765B7 [Sun Sep 15 22:54:47 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F0045255363h
jmp 00007F0045254C6Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F0045254E4Dh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F0045254E1Ah
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F0045257A0Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F0045257A58h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F0045257A41h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0xaf708	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x184000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0xaf708	0xaf800	596c5718c0a928c41bfe2f7dcf9acca2	False	0.9132667824074074	data	7.884038986257902	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x184000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd4458	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd4580	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd46a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd47d0	0x114b8	Device independent bitmap graphic, 114 x 300 x 32, image size 68400, resolution 3779 x 3779 px/m	English	Great Britain	0.2350790513833992
RT_MENU	0xe5c88	0x50	data	English	Great Britain	0.9
RT_STRING	0xe5cd8	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xe626c	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xe68f8	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xe6d88	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xe7384	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xe79e0	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xe7e48	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xe7fa0	0x9b24c	data			1.0003163023157735
RT_GROUP_ICON	0x1831ec	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x183200	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x183214	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x183228	0x14	data	English	Great Britain	1.25
RT_VERSION	0x18323c	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x183318	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 13:46:07.106641054 CEST	49704	587	192.168.2.10	194.36.191.196
Sep 25, 2024 13:46:07.111506939 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:07.111582994 CEST	49704	587	192.168.2.10	194.36.191.196
Sep 25, 2024 13:46:08.067800045 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:08.068566084 CEST	49704	587	192.168.2.10	194.36.191.196
Sep 25, 2024 13:46:08.074398994 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:08.241220951 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:08.241379976 CEST	49704	587	192.168.2.10	194.36.191.196
Sep 25, 2024 13:46:08.246345997 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:08.415250063 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:08.419378996 CEST	49704	587	192.168.2.10	194.36.191.196
Sep 25, 2024 13:46:08.424189091 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:08.610415936 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:08.610450983 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:08.610464096 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:08.610512018 CEST	49704	587	192.168.2.10	194.36.191.196
Sep 25, 2024 13:46:08.700731993 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:08.737416983 CEST	49704	587	192.168.2.10	194.36.191.196
Sep 25, 2024 13:46:08.742748976 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:08.916834116 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:08.928785086 CEST	49704	587	192.168.2.10	194.36.191.196
Sep 25, 2024 13:46:08.934369087 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:09.102611065 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:09.104090929 CEST	49704	587	192.168.2.10	194.36.191.196
Sep 25, 2024 13:46:09.108927965 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:09.277283907 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:09.281438112 CEST	49704	587	192.168.2.10	194.36.191.196
Sep 25, 2024 13:46:09.286262035 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:09.555978060 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:09.556471109 CEST	49704	587	192.168.2.10	194.36.191.196
Sep 25, 2024 13:46:09.561307907 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:09.732765913 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:09.733329058 CEST	49704	587	192.168.2.10	194.36.191.196
Sep 25, 2024 13:46:09.738239050 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:10.438358068 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:10.438736916 CEST	49704	587	192.168.2.10	194.36.191.196
Sep 25, 2024 13:46:10.443653107 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:10.611498117 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:10.612221003 CEST	49704	587	192.168.2.10	194.36.191.196
Sep 25, 2024 13:46:10.612288952 CEST	49704	587	192.168.2.10	194.36.191.196
Sep 25, 2024 13:46:10.612319946 CEST	49704	587	192.168.2.10	194.36.191.196
Sep 25, 2024 13:46:10.612334013 CEST	49704	587	192.168.2.10	194.36.191.196
Sep 25, 2024 13:46:10.617079020 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:10.617100954 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:10.617198944 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:10.617212057 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:11.640358925 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:46:11.690135956 CEST	49704	587	192.168.2.10	194.36.191.196
Sep 25, 2024 13:47:46.644049883 CEST	49704	587	192.168.2.10	194.36.191.196
Sep 25, 2024 13:47:46.649032116 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:47:46.817135096 CEST	587	49704	194.36.191.196	192.168.2.10
Sep 25, 2024 13:47:46.820833921 CEST	49704	587	192.168.2.10	194.36.191.196

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 13:46:06.624634981 CEST	64421	53	192.168.2.10	1.1.1.1
Sep 25, 2024 13:46:07.097547054 CEST	53	64421	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 25, 2024 13:46:06.624634981 CEST	192.168.2.10	1.1.1.1	0x8fd6	Standard query (0)	mail.agaliofu.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 25, 2024 13:46:07.097547054 CEST	1.1.1.1	192.168.2.10	0x8fd6	No error (0)	mail.agaliofu.top	agaliofu.top		CNAME (Canonical name)	IN (0x0001)	false
Sep 25, 2024 13:46:07.097547054 CEST	1.1.1.1	192.168.2.10	0x8fd6	No error (0)	agaliofu.top		194.36.191.196	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Sep 25, 2024 13:46:08.067800045 CEST	587	49704	194.36.191.196	192.168.2.10	220-hosting1.nl.hostsailor.com ESMTP Exim 4.96.2 #2 Wed, 25 Sep 2024 13:46:07 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Sep 25, 2024 13:46:08.068566084 CEST	49704	587	192.168.2.10	194.36.191.196	EHLO 142233
Sep 25, 2024 13:46:08.241220951 CEST	587	49704	194.36.191.196	192.168.2.10	250-hosting1.nl.hostsailor.com Hello 142233 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Sep 25, 2024 13:46:08.241379976 CEST	49704	587	192.168.2.10	194.36.191.196	STARTTLS
Sep 25, 2024 13:46:08.415250063 CEST	587	49704	194.36.191.196	192.168.2.10	220 TLS go ahead

Target ID:	0
Start time:	07:46:03
Start date:	25/09/2024
Path:	C:\Users\user\Desktop\rOrderRequest09-24.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rOrderRequest09-24.exe"
Imagebase:	0xb90000
File size:	1'597'952 bytes
MD5 hash:	3E322CACDBC509091F2950C4E04FF85F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.1279971744.0000000003D60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:46:04
Start date:	25/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rOrderRequest09-24.exe"
Imagebase:	0x580000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.2511992775.0000000002983000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.2511992775.0000000002957000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000005.00000002.2509888429.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2511992775.0000000002901000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.2511992775.0000000002901000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.8%
Dynamic/Decrypted Code Coverage:	1.1%
Signature Coverage:	3.1%
Total number of Nodes:	1668
Total number of Limit Nodes:	52

Executed Functions

Function 00B942DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00B9430D

Part of subcall function 00B96B57: _wcslen.LIBCMT ref: 00B96B6A

GetCurrentProcess.KERNEL32(?,00C2CB64,00000000,?,?), ref: 00B94422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00B94429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00B94454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00B94466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00B94474
FreeLibrary.KERNEL32(00000000,?,?), ref: 00B9447B
GetSystemInfo.KERNEL32(?,?,?), ref: 00B944A0

Strings

kernel32.dll, xrefs: 00B9444F
|O, xrefs: 00BD36F8
GetNativeSystemInfo, xrefs: 00B94460

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: fb5027e683237ba800bb11721149c52f8e352b7b3a230445a264cba41e52364f
Instruction ID: def125470eb996afcd5bde5407d06639d30d2e87b2a4be8223ad0d79be36d8e5
Opcode Fuzzy Hash: fb5027e683237ba800bb11721149c52f8e352b7b3a230445a264cba41e52364f
Instruction Fuzzy Hash: D4A1626595A2C0DFCB31CB6A788179D7FE4AB36702B1C54F9D84393B32D6A04A05CB62

Function 00B942A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00B950AA,?,?,00000000,00000000), ref: 00B942B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00B950AA,?,?,00000000,00000000), ref: 00B942C9
LoadResource.KERNEL32(?,00000000,?,?,00B950AA,?,?,00000000,00000000,?,?,?,?,?,?,00B94F20), ref: 00BD35BE
SizeofResource.KERNEL32(?,00000000,?,?,00B950AA,?,?,00000000,00000000,?,?,?,?,?,?,00B94F20), ref: 00BD35D3
LockResource.KERNEL32(00B950AA,?,?,00B950AA,?,?,00000000,00000000,?,?,?,?,?,?,00B94F20,?), ref: 00BD35E6

Strings

SCRIPT, xrefs: 00B942BF

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: b8a86ca5f4c35ccf98bba34343f9e7d480f657a5bc51e501732515085bc6c4d5
Instruction ID: 71e23e9f732c553f93c75848d62088e0066d89c141aa5ee89c016c36400e776f
Opcode Fuzzy Hash: b8a86ca5f4c35ccf98bba34343f9e7d480f657a5bc51e501732515085bc6c4d5
Instruction Fuzzy Hash: B5117C70210700BFEB258B65EC88F2B7BB9EFC5B51F2081A9B41296690EB71D8058630

Function 00BD2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00B92B6B

Part of subcall function 00B93A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00C61418,?,00B92E7F,?,?,?,00000000), ref: 00B93A78

Part of subcall function 00B99CB3: _wcslen.LIBCMT ref: 00B99CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00C52224), ref: 00BD2C10
ShellExecuteW.SHELL32(00000000,?,?,00C52224), ref: 00BD2C17

Strings

runas, xrefs: 00BD2C0B

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 6c9464ac65bdb36828a5e31839594017c240f8fc7178c13a65a1ce71c5cad165
Instruction ID: c3bfbc0599ac0280daad49c8ea2e004aa356dbfe58455959d7fec00cd208c434
Opcode Fuzzy Hash: 6c9464ac65bdb36828a5e31839594017c240f8fc7178c13a65a1ce71c5cad165
Instruction Fuzzy Hash: BC11B1316083416ACF24FF64D892ABEB7E49FA1752F4844BDF582530A2DF618A4A8712

Function 00B9D730 Relevance: 21.6, APIs: 14, Instructions: 616windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00B9D807
timeGetTime.WINMM ref: 00B9DA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B9DB28
TranslateMessage.USER32(?), ref: 00B9DB7B
DispatchMessageW.USER32(?), ref: 00B9DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B9DB9F
Sleep.KERNEL32(0000000A), ref: 00B9DBB1

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: af989b264df7ffc2e7365a2196272fada2fa1ae2da5757c2d4b5dced05c41837
Instruction ID: 3988191c9ff279a6650c28c11b67fd8fbf9e97e3a298535a26d305b015a68137
Opcode Fuzzy Hash: af989b264df7ffc2e7365a2196272fada2fa1ae2da5757c2d4b5dced05c41837
Instruction Fuzzy Hash: 0442D030608681EFDB34DF26C884BAAB7E5FF45314F188ABDE55687291D770E844CB92

Function 00B92CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00B92D07
RegisterClassExW.USER32(00000030), ref: 00B92D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00B92D42
InitCommonControlsEx.COMCTL32(?), ref: 00B92D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00B92D6F
LoadIconW.USER32(000000A9), ref: 00B92D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00B92D94

Strings

+, xrefs: 00B92CF0
0, xrefs: 00B92CE9
AutoIt v3 GUI, xrefs: 00B92D23
TaskbarCreated, xrefs: 00B92D37

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 7ebe64bc972b9345dd7f5c54e15703ade486a8a2935a6f90b16f4bee6af099fe
Instruction ID: de0d987367c6ce6140541692d61a3bb43ab611b700fe77d0cf96303304772037
Opcode Fuzzy Hash: 7ebe64bc972b9345dd7f5c54e15703ade486a8a2935a6f90b16f4bee6af099fe
Instruction Fuzzy Hash: 7C21C3B5911218AFDB20DFA5E889BDDBBB4FB08702F08411AF911A66A0D7B14545CF91

Function 00BD065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BD039A: CreateFileW.KERNELBASE(00000000,00000000,?,00BD0704,?,?,00000000,?,00BD0704,00000000,0000000C), ref: 00BD03B7

GetLastError.KERNEL32 ref: 00BD076F
__dosmaperr.LIBCMT ref: 00BD0776
GetFileType.KERNELBASE(00000000), ref: 00BD0782
GetLastError.KERNEL32 ref: 00BD078C
__dosmaperr.LIBCMT ref: 00BD0795
CloseHandle.KERNEL32(00000000), ref: 00BD07B5
CloseHandle.KERNEL32(?), ref: 00BD08FF
GetLastError.KERNEL32 ref: 00BD0931
__dosmaperr.LIBCMT ref: 00BD0938

Strings

H, xrefs: 00BD08BD

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 3d09287cb6feef3936fae8bb94e97aec91b3d924b4cbb3fc6e4f184bf9d864b8
Instruction ID: 078def0a972927879128a5505c80cee9fc88cf00354ce546b577b25122cb332a
Opcode Fuzzy Hash: 3d09287cb6feef3936fae8bb94e97aec91b3d924b4cbb3fc6e4f184bf9d864b8
Instruction Fuzzy Hash: 25A106329141059FDF29EF68D891BAEBBE0EB46320F14019AF815AF391E7719C13CB91

Function 00B9344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B93A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00C61418,?,00B92E7F,?,?,?,00000000), ref: 00B93A78

Part of subcall function 00B93357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00B93379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00B9356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00BD318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00BD31CE
RegCloseKey.ADVAPI32(?), ref: 00BD3210
_wcslen.LIBCMT ref: 00BD3277
_wcslen.LIBCMT ref: 00BD3286

Strings

Include, xrefs: 00BD3184, 00BD31C5
\, xrefs: 00BD328C
Software\AutoIt v3\AutoIt, xrefs: 00B93560
\Include\, xrefs: 00B93527

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 272ee6d7d1f0492ac39eadbb0c19be73e6bfa48fdd6fbd8158b2b2b73b85e3f3
Instruction ID: 1313adcd1ff82e98a7adb2029601b4244aaa76065b6cf90c4a3cb3a04a80ee8e
Opcode Fuzzy Hash: 272ee6d7d1f0492ac39eadbb0c19be73e6bfa48fdd6fbd8158b2b2b73b85e3f3
Instruction Fuzzy Hash: 57715D715047019EC724EF66DC81AAFBBE8FF95740B40087EF545932B1EBB09A49CB52

Function 00B92B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00B92B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00B92B9D
LoadIconW.USER32(00000063), ref: 00B92BB3
LoadIconW.USER32(000000A4), ref: 00B92BC5
LoadIconW.USER32(000000A2), ref: 00B92BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00B92BEF
RegisterClassExW.USER32(?), ref: 00B92C40

Part of subcall function 00B92CD4: GetSysColorBrush.USER32(0000000F), ref: 00B92D07
Part of subcall function 00B92CD4: RegisterClassExW.USER32(00000030), ref: 00B92D31
Part of subcall function 00B92CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00B92D42
Part of subcall function 00B92CD4: InitCommonControlsEx.COMCTL32(?), ref: 00B92D5F
Part of subcall function 00B92CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00B92D6F
Part of subcall function 00B92CD4: LoadIconW.USER32(000000A9), ref: 00B92D85
Part of subcall function 00B92CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00B92D94

Strings

0, xrefs: 00B92C0F
AutoIt v3, xrefs: 00B92C2F
#, xrefs: 00B92C16

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 81cad0378b4b496da31352ba1c8271f67349279067c8a795d12309c6c750bb3f
Instruction ID: 8b826056f9cdc966add8587dfb5ea2e70e2b1dfd6ec44025f32f60fef1b83a5b
Opcode Fuzzy Hash: 81cad0378b4b496da31352ba1c8271f67349279067c8a795d12309c6c750bb3f
Instruction Fuzzy Hash: B2210971E10314ABDB209FA6EC95BAD7FB4FB48B51F08006AEA01A67B0D7F14541DF90

Function 00B93170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00B9316A,?,?), ref: 00B931D8
KillTimer.USER32(?,00000001,?,?,?,?,?,00B9316A,?,?), ref: 00B93204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00B93227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00B9316A,?,?), ref: 00B93232
CreatePopupMenu.USER32 ref: 00B93246
PostQuitMessage.USER32(00000000), ref: 00B93267

Strings

TaskbarCreated, xrefs: 00B9322D

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 4a7df6ab1fd6591ab26d39007163628c81e3469c9a6f2420ee04389fd8e0c780
Instruction ID: fa3c2193aa01566f8248e2d5c46eed42937acb0fbc25a9b902ee43aa649ec4fd
Opcode Fuzzy Hash: 4a7df6ab1fd6591ab26d39007163628c81e3469c9a6f2420ee04389fd8e0c780
Instruction Fuzzy Hash: B6414431214204ABDF342B789D8DB7D3ADAEB05B41F0C41B6F912D62B1DBB18A41E7A1

Function 03F74650 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 03F74721
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 03F74947

Memory Dump Source

Source File: 00000000.00000002.1281015705.0000000003F72000.00000040.00000020.00020000.00000000.sdmp, Offset: 03F72000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f72000_rOrderRequest09-24.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
Instruction ID: 146f6570f7b805f6007bd503f62a078848697584c3945796a103d50f3fbe511b
Opcode Fuzzy Hash: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
Instruction Fuzzy Hash: B3A12574E00209EBDB14CFA5C994BEEBBB5FF48305F24819AE115BB280D7759A81CB94

Function 00B92C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00B92C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00B92CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00B91CAD,?), ref: 00B92CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00B91CAD,?), ref: 00B92CCF

Strings

AutoIt v3, xrefs: 00B92C89, 00B92C8E, 00B92C8F
edit, xrefs: 00B92CAC

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: c94a84a39daa5b4d2ae992adf8ee228ee4bd3630da02826f7b9b775fde629f2b
Instruction ID: a614b59b80c66477c85ff385bd38c4ac132c2df10aea1caa8bfde86f4cd2a4bf
Opcode Fuzzy Hash: c94a84a39daa5b4d2ae992adf8ee228ee4bd3630da02826f7b9b775fde629f2b
Instruction Fuzzy Hash: 5CF0DA755502907AEB711B17AC48F7F2EBDD7CAF51B08006AFD01A26B0C6B15851EAB1

Function 03F74400 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 151
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03F742F0: Sleep.KERNELBASE(000001F4), ref: 03F74301

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 03F7453D

Strings

PQE449N69DTO0RYQ3W7JL2G, xrefs: 03F745A0, 03F745A3

Memory Dump Source

Source File: 00000000.00000002.1281015705.0000000003F72000.00000040.00000020.00020000.00000000.sdmp, Offset: 03F72000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f72000_rOrderRequest09-24.jbxd

Similarity

API ID: CreateFileSleep
String ID: PQE449N69DTO0RYQ3W7JL2G
API String ID: 2694422964-2385341446
Opcode ID: 9de6e907028d0c8ab02b49cb35b767eed0351f5cef6874e893842adbbd5ad8d5
Instruction ID: 8317f4cf7c260d1b29a3f07a63eec08d528cc4cb079cd9c2211144e6c4c02b51
Opcode Fuzzy Hash: 9de6e907028d0c8ab02b49cb35b767eed0351f5cef6874e893842adbbd5ad8d5
Instruction Fuzzy Hash: B351A630D04298EBEF11DBE4C844BEEBB79AF14304F044199E2487B2C1DBB91B45CB66

Function 00B93B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00B93B0F,SwapMouseButtons,00000004,?), ref: 00B93B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00B93B0F,SwapMouseButtons,00000004,?), ref: 00B93B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00B93B0F,SwapMouseButtons,00000004,?), ref: 00B93B83

Strings

Control Panel\Mouse, xrefs: 00B93B3E

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 8d8053a21714bad78be2ba1bb849f0323125015a1e226bc260b3c026601fd1d9
Instruction ID: 1e41cbde5e926b938d9a843260759a0ba463db13e66b0f8965a59dbd66c01ae6
Opcode Fuzzy Hash: 8d8053a21714bad78be2ba1bb849f0323125015a1e226bc260b3c026601fd1d9
Instruction Fuzzy Hash: 92112AB5520208FFDF208FA5DC84EAEB7F8EF04B44B1044A9A805D7210D2719E4197A0

Function 03F732F0 Relevance: 6.7, APIs: 4, Instructions: 720
processthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 03F73B1D
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 03F73B41
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 03F73B63

Memory Dump Source

Source File: 00000000.00000002.1281015705.0000000003F72000.00000040.00000020.00020000.00000000.sdmp, Offset: 03F72000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f72000_rOrderRequest09-24.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: e8e7a77c1c38f92167ec50984bffac71589908538948dc0fdf133907e09ee162
Instruction ID: 6de231902423bc5ce4da41eda30c3c4acf91cb3563adb0ee686aadb6c4f65ce0
Opcode Fuzzy Hash: e8e7a77c1c38f92167ec50984bffac71589908538948dc0fdf133907e09ee162
Instruction Fuzzy Hash: 6262FA34A14258DBEB24CFA4C850BDEB376EF58300F1091AAD10DEB394E7799E85CB59

Function 00B9DFD0 Relevance: 6.7, APIs: 2, Strings: 1, Instructions: 1414COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00BE32B7

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: 54d7d143582f6bf7f8937b6a3672329190ba7d81334cfa6b935e3f9513676e33
Instruction ID: 4b0613c33a705d385eda9fa321c19485c89d9b9cb7a6219c4ecaff1d665e0977
Opcode Fuzzy Hash: 54d7d143582f6bf7f8937b6a3672329190ba7d81334cfa6b935e3f9513676e33
Instruction Fuzzy Hash: 8AC26870A04215CFCF24CF98C885AADB7F1FB19700F2485A9E966AB3A1D375ED41CB91

Function 00B93923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00BD33A2

Part of subcall function 00B96B57: _wcslen.LIBCMT ref: 00B96B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00B93A04

Strings

Line: , xrefs: 00BD33EB

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 043d7c49bfefd5e8011913cccc066ce998dd39eec93123f2cea1eb12d5b7a6df
Instruction ID: a71346f76c7f81c1207ed4f4a792a8ea25d4377ed288db4457993795de508bd2
Opcode Fuzzy Hash: 043d7c49bfefd5e8011913cccc066ce998dd39eec93123f2cea1eb12d5b7a6df
Instruction Fuzzy Hash: 3C31B671408304AFCB25EB14DC45BEFB7D8AB44B50F0845BEF99A931A1EBB09649C7C6

Function 00BAFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00BB0668

Part of subcall function 00BB32A4: RaiseException.KERNEL32(?,?,?,00BB068A,?,00C61444,?,?,?,?,?,?,00BB068A,00B91129,00C58738,00B91129), ref: 00BB3304

__CxxThrowException@8.LIBVCRUNTIME ref: 00BB0685

Strings

Unknown exception, xrefs: 00BB0692

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 7587af0c8a6fee29ad1a36c3469e106d9b4ae5117bc6018f988da212bbe62cb5
Instruction ID: 58be5308451fe24ece9b95d0733573b5f8a4997e663c088240a1de4d4ec77182
Opcode Fuzzy Hash: 7587af0c8a6fee29ad1a36c3469e106d9b4ae5117bc6018f988da212bbe62cb5
Instruction Fuzzy Hash: CCF0C23490020DB78F14BAA4D886CFF77EC9E00750B6041F1B924969A2EFF1EA69C690

Function 00C17F59 Relevance: 4.9, APIs: 3, Instructions: 430COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,00000067,000000FF,?,?,?), ref: 00C182F5
TerminateProcess.KERNEL32(00000000), ref: 00C182FC
FreeLibrary.KERNEL32(?,?,?,?), ref: 00C184DD

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Process$CurrentFreeLibraryTerminate
String ID:
API String ID: 146820519-0
Opcode ID: ef0cf6f2fe540f486b23938fbab380fc0475ed1aea7177cb98131a1303dd9a21
Instruction ID: 6e225fe8e14a39c52b0bec4d5b82ae1ef18e72f745ba27fb90a4a6cce7d89fac
Opcode Fuzzy Hash: ef0cf6f2fe540f486b23938fbab380fc0475ed1aea7177cb98131a1303dd9a21
Instruction Fuzzy Hash: 28126B719083419FC714DF28C484B6ABBE5FF89314F14895DE8998B292DB31ED89CF92

Function 00B910F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00B91BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00B91BF4
Part of subcall function 00B91BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00B91BFC
Part of subcall function 00B91BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00B91C07
Part of subcall function 00B91BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00B91C12
Part of subcall function 00B91BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00B91C1A
Part of subcall function 00B91BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00B91C22

Part of subcall function 00B91B4A: RegisterWindowMessageW.USER32(00000004,?,00B912C4), ref: 00B91BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00B9136A
OleInitialize.OLE32 ref: 00B91388
CloseHandle.KERNEL32(00000000,00000000), ref: 00BD24AB

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 7907ffc82bbf370e0b2ba1f434828309b6d298100953cd491e5e723d348fbf93
Instruction ID: 0850baa7d9b1f14abb92f30b4c66e9adefc8559e21b8dc60d0f821286d504639
Opcode Fuzzy Hash: 7907ffc82bbf370e0b2ba1f434828309b6d298100953cd491e5e723d348fbf93
Instruction Fuzzy Hash: BD71CDB49152418ECBA4EF7BA88576DBAE0FB8834631D856ADC0BC72A1EBB04441DF45

Function 00BC86AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00000000,?,?,00BC85CC,?,00C58CC8,0000000C), ref: 00BC8704
GetLastError.KERNEL32(?,00BC85CC,?,00C58CC8,0000000C), ref: 00BC870E
__dosmaperr.LIBCMT ref: 00BC8739

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: 9ef077339b5e90f15c19f9aaaacda62c7edd029f89e3290073d3f4d429242fde
Instruction ID: 23534c35393a77f8f0b11c2064b7c7f65937671dc90ce414315742b91966a29d
Opcode Fuzzy Hash: 9ef077339b5e90f15c19f9aaaacda62c7edd029f89e3290073d3f4d429242fde
Instruction Fuzzy Hash: F1012B3260566027D63463346885F7F67C98BC1778F3902EEF8599B1D2DEA0ACC28194

Function 00BA1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00BA17F6

Strings

CALL, xrefs: 00BA17C6

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 4fd17362e4157826a32493d233e4cc9d5a3bfa569f3c40b57b619843339cff67
Instruction ID: 21f4aee7281d2f8b278a0d5b3a63ba43b572e124189e58b590545487c6d2795d
Opcode Fuzzy Hash: 4fd17362e4157826a32493d233e4cc9d5a3bfa569f3c40b57b619843339cff67
Instruction Fuzzy Hash: 11229A706082419FC754DF29C490B2ABBF1FF9A354F2489ADF4968B3A1D731E845CB92

Function 00B92DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00BD2C8C

Part of subcall function 00B93AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00B93A97,?,?,00B92E7F,?,?,?,00000000), ref: 00B93AC2

Part of subcall function 00B92DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00B92DC4

Strings

X, xrefs: 00BD2C5A

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: 848e2ffbe592dd2f699b98c2cba03a3d1a0da8bf7c4c7590fc722925c0adc621
Instruction ID: adc5c50fd6277e240a702d8966cffbd0c55eb111692679d291ff8ee2498ab011
Opcode Fuzzy Hash: 848e2ffbe592dd2f699b98c2cba03a3d1a0da8bf7c4c7590fc722925c0adc621
Instruction Fuzzy Hash: 0321C671A10258AFDF01DF94C845BEE7BF8DF48305F4040AAE405A7341EBB459898B61

Function 00B93837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00B93908

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: a28647276030f54b6d48fd9510b6c1a6fdacfe12b7b619c9ac05da62cf9085d0
Instruction ID: 2b9aeb459d0586cc3b0822f6e843de3ed3dd9dc98aae073a74382ba356e71815
Opcode Fuzzy Hash: a28647276030f54b6d48fd9510b6c1a6fdacfe12b7b619c9ac05da62cf9085d0
Instruction Fuzzy Hash: BC3193705043019FD720DF25D8847ABBBE4FB49719F04097EFA9A87350E7B1AA44CB92

Function 00B95745 Relevance: 3.1, APIs: 2, Instructions: 56fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,00B9949C,?,00008000), ref: 00B95773
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,?,?,00B9949C,?,00008000), ref: 00BD4052

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: abdc433749dfea3a235fd7b37a2faf39be0ffc7663ca2b696e0176f73573c70b
Instruction ID: c7a1b0f39a471e9906a1812aca248a833611614cb4d3c420cb31f54ec65d95c1
Opcode Fuzzy Hash: abdc433749dfea3a235fd7b37a2faf39be0ffc7663ca2b696e0176f73573c70b
Instruction Fuzzy Hash: 52019230185225B6E7310A6ADC4FF9B7F98EF027B0F108351BA9C5A1E0CBB45955CB90

Function 00B9B710 Relevance: 2.1, APIs: 1, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00B9BB4E

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 324c80f8466f32561c1fd41742463624c6674c964c712b9380fcbeafb3e06723
Instruction ID: 2886a5b8a5aa5e2536dda316a43ed533a2a2553bd77541658a4f924716c84937
Opcode Fuzzy Hash: 324c80f8466f32561c1fd41742463624c6674c964c712b9380fcbeafb3e06723
Instruction Fuzzy Hash: A3328B70A002499FDF24DF55D994FBEB7F9EB48300F1480A9E915AB261C7B8ED81CB91

Function 03F732ED Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 03F73B1D
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 03F73B41
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 03F73B63

Memory Dump Source

Source File: 00000000.00000002.1281015705.0000000003F72000.00000040.00000020.00020000.00000000.sdmp, Offset: 03F72000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f72000_rOrderRequest09-24.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
Instruction ID: ddc9f54cf002f9150ec9462c560cb8ad3bd7d753ef39c2fa70e7d1d01dcd3071
Opcode Fuzzy Hash: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
Instruction Fuzzy Hash: FC12CE24E24658C6EB24DF64D8507DEB232EF68300F1090E9910DEB7A5E77A4F85CF5A

Function 00BAFC70 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00BAFD1F

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: c24662316a1f3a6fa519a3a04dbb651c27312c6d28feb6ce9a078079572351ed
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: F831E374A0810A9BC719DF99D4C09A9F7E2FB4A350B2486F5E849CB655E731EDC1CBC0

Function 00B94ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B94E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00B94EDD,?,00C61418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00B94E9C
Part of subcall function 00B94E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00B94EAE
Part of subcall function 00B94E90: FreeLibrary.KERNEL32(00000000,?,?,00B94EDD,?,00C61418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00B94EC0

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00C61418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00B94EFD

Part of subcall function 00B94E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00BD3CDE,?,00C61418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00B94E62
Part of subcall function 00B94E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00B94E74
Part of subcall function 00B94E59: FreeLibrary.KERNEL32(00000000,?,?,00BD3CDE,?,00C61418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00B94E87

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 0ecaccadb8eea59935b1c9bbc2abbc3e7ce235138380f492f1feb03fbff5c2ab
Instruction ID: fb4845687d058b1dd3b884449c880c6074a8ab81f95c74cab4355526d36e1040
Opcode Fuzzy Hash: 0ecaccadb8eea59935b1c9bbc2abbc3e7ce235138380f492f1feb03fbff5c2ab
Instruction Fuzzy Hash: 7711C132610206ABCF24AB60DC42FED77E5AF50B50F20847AF546A61D2EF709A069750

Function 00BC8402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00BC8440

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 62ac1ce606520b9897f63cbc471caf214bf617fafac37270619ae1915fe49a30
Instruction ID: bc0c369fdc204c6dd403e65672ce667878983841455971192500af5440a475e1
Opcode Fuzzy Hash: 62ac1ce606520b9897f63cbc471caf214bf617fafac37270619ae1915fe49a30
Instruction Fuzzy Hash: 6111187590410AAFCB19DF58E941E9E7BF5EF48314F1540A9F808AB312DA31DA11CBA5

Function 00BC5000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BC4C7D: RtlAllocateHeap.NTDLL(00000008,00B91129,00000000,?,00BC2E29,00000001,00000364,?,?,?,00BBF2DE,00BC3863,00C61444,?,00BAFDF5,?), ref: 00BC4CBE

_free.LIBCMT ref: 00BC506C

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: dab04ea5372d2f12ebb7db0cb6ae94bb4d2be8ee5356cf5944f5452b75a0996a
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: 450126722047046BE3318F659881F5AFBE8FB89370F65056DE58483280EB70A945C6B4

Function 00BBE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: a87889b1333a172c64af22d7d0d1ba42006bb2a93e46d06675a82d8705fcbe1f
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: DBF0F432510A149BC6313A699C05FFA37D89F52335F1007E9F872922E2DBF4D80186A6

Function 00B99CB3 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B99CBD

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: 925dd5c5bacb953470c4b1c403d787b0688307d40fd5fb7636ab76acd22fdb11
Instruction ID: 108faa39b7c41e2a0c58ad80db50c9f5025941193bb25f04d2ca4f6181baceeb
Opcode Fuzzy Hash: 925dd5c5bacb953470c4b1c403d787b0688307d40fd5fb7636ab76acd22fdb11
Instruction Fuzzy Hash: 47F0A4B26016016ED7259F68D806AA7BBD4EB44760F10857AF619CB1D1DB71E51086A0

Function 00BC4C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00B91129,00000000,?,00BC2E29,00000001,00000364,?,?,?,00BBF2DE,00BC3863,00C61444,?,00BAFDF5,?), ref: 00BC4CBE

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ef3db1b15c26809cad68453e8e0bbb267f3e3a9518362d13153f57dc604cbb82
Instruction ID: 91022c3c18cd6ed0b068c9786137b8fcc6ae1d00a06eb22056497249138d70d5
Opcode Fuzzy Hash: ef3db1b15c26809cad68453e8e0bbb267f3e3a9518362d13153f57dc604cbb82
Instruction Fuzzy Hash: 4DF0E93160222467DB215F629C15FAF37C8FF417B1B1841A9FC19E72B1CBB0DA1586E0

Function 00BC3820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00C61444,?,00BAFDF5,?,?,00B9A976,00000010,00C61440,00B913FC,?,00B913C6,?,00B91129), ref: 00BC3852

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ea6e38b10ace09e686b49e083c85ba3a8a6c75c65241c6bd0ca6b87dd3bd7ace
Instruction ID: 0801c4620658e70fa69fc391e2fecd242290bbae66a705c4816939eb485fad12
Opcode Fuzzy Hash: ea6e38b10ace09e686b49e083c85ba3a8a6c75c65241c6bd0ca6b87dd3bd7ace
Instruction Fuzzy Hash: 0BE0E53110422497E6312A679C01FEE36D8EB42FB0F8980A8BC0592591DB50DD0187E0

Function 00B94F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00C61418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00B94F6D

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 24bf1deeda424aabdcc762b49696f3396460359a725580871e817f47272b42fe
Instruction ID: 0ad88da37b84220441ff94c2f4d3a5530f016fff13b59b159dddac0a17a94f78
Opcode Fuzzy Hash: 24bf1deeda424aabdcc762b49696f3396460359a725580871e817f47272b42fe
Instruction Fuzzy Hash: 8EF01571105752CFDB349F64D494E66BBE4EF143293208ABEE1EE82A21C7319845DB10

Function 00BFCCFF Relevance: 1.5, APIs: 1, Instructions: 26fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,00000000,00000000,?,?,?,?,00BDEE51,00C53630,00000002), ref: 00BFCD26

Part of subcall function 00BFCC37: SetFilePointerEx.KERNEL32(?,00000000,00000000,?,00000001,00000000,?,00000000,?,?,?,00BFCD19,?,?,?), ref: 00BFCC59
Part of subcall function 00BFCC37: SetFilePointerEx.KERNEL32(?,?,00000000,00000000,00000001,?,00BFCD19,?,?,?,?,00BDEE51,00C53630,00000002), ref: 00BFCC6E
Part of subcall function 00BFCC37: SetFilePointerEx.KERNEL32(?,00000000,00000000,?,00000001,?,00BFCD19,?,?,?,?,00BDEE51,00C53630,00000002), ref: 00BFCC7A

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: File$Pointer$Write
String ID:
API String ID: 3847668363-0
Opcode ID: a55a81fd1b61daa2079b7a34eed8b6af399163d1242559627010b31f7e1c9e59
Instruction ID: e47aad4acd8337ee5a835ec5edf4d65677a3ef5c6afc5987f34e97315d633346
Opcode Fuzzy Hash: a55a81fd1b61daa2079b7a34eed8b6af399163d1242559627010b31f7e1c9e59
Instruction Fuzzy Hash: 71E0657A400708EFD7219F46DD418AEBBF8FF84354710852FE955C2510D371AA54DB60

Function 00B92DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00B92DC4

Part of subcall function 00B96B57: _wcslen.LIBCMT ref: 00B96B6A

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 4c76df083db46c182ab53da00ec2638f768d51913c7cedc94e1f27ca96e0dd46
Instruction ID: fc9f65002b34a34781e59c670f4d4dfff30e63bab5653533b8384737bfde4e36
Opcode Fuzzy Hash: 4c76df083db46c182ab53da00ec2638f768d51913c7cedc94e1f27ca96e0dd46
Instruction Fuzzy Hash: E0E0CD726001245BCB209398DC06FDE77DDDFC8790F0400B1FD09D7248ED60AD848550

Function 00B92B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00B93837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00B93908

Part of subcall function 00B9D730: GetInputState.USER32 ref: 00B9D807

SetCurrentDirectoryW.KERNEL32(?), ref: 00B92B6B

Part of subcall function 00B930F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00B9314E

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: c362cecfd3c10c988e354a44610f0626d6dc3f9f203541e5fe0be96a20bc898f
Instruction ID: 73a5d43df5041f8c1eabeb11ab2058c8e351a21c65530cbfe2649be16e14a5d6
Opcode Fuzzy Hash: c362cecfd3c10c988e354a44610f0626d6dc3f9f203541e5fe0be96a20bc898f
Instruction Fuzzy Hash: 39E07D2130024407CE18BB769892BBDB3C9CFD1752F4408BEF24283163CF2449454312

Function 00BD039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00BD0704,?,?,00000000,?,00BD0704,00000000,0000000C), ref: 00BD03B7

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1761f685fff58728a9f71e3047d0e3c96c00819b2660352f3974b9501eb4ff11
Instruction ID: 71dcacaca1f501af6b107802e3a97b2b874febf55c957a874647f5a2a7e16507
Opcode Fuzzy Hash: 1761f685fff58728a9f71e3047d0e3c96c00819b2660352f3974b9501eb4ff11
Instruction Fuzzy Hash: A2D06C3205010DBBDF128F84DD46EDE3BAAFB48714F014000BE1856020C732E832AB90

Function 00B91CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00B91CBC

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 4b5445fb94680359c477b1cf2ad422650efd1b807f6bd2ca1015c2131d6323f9
Instruction ID: 39cccf6fe48e124b151c69863f8da36f6db28876fdb06f4fe925850ea07dc9d4
Opcode Fuzzy Hash: 4b5445fb94680359c477b1cf2ad422650efd1b807f6bd2ca1015c2131d6323f9
Instruction Fuzzy Hash: C3C09B352803049FF2344B81BC4AF1C7754A758B01F084011F60A555F3C3E15410F650

Function 00C0744A Relevance: 1.5, APIs: 1, Instructions: 220COMMON

Download Yara Rule

APIs

Part of subcall function 00B95745: CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,00B9949C,?,00008000), ref: 00B95773

GetLastError.KERNEL32(00000002,00000000), ref: 00C076DE

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: 76ac2ec84d0532c329413d26c4a288048846f36cb1209a8b5aac6f5755f93085
Instruction ID: 0cb596db5a8519339379270d7d04e0c0030b560035514a378a3ca035c4a5dcde
Opcode Fuzzy Hash: 76ac2ec84d0532c329413d26c4a288048846f36cb1209a8b5aac6f5755f93085
Instruction Fuzzy Hash: 9B8160306087019FCB19EF28C491BADB7E1BF49354F0446ADF8965B2D2DB30AE45CB92

Function 00B96246 Relevance: 1.3, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00000000,00BD24E0), ref: 00B96266

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 13e7426131457755feb2119e9547551bf2d0912654561b45158e8962bcfd2554
Instruction ID: 33b86f3350b805f39ef37179440ec23e6a5c148fb4a663c27716f39ebd47fb68
Opcode Fuzzy Hash: 13e7426131457755feb2119e9547551bf2d0912654561b45158e8962bcfd2554
Instruction Fuzzy Hash: BDE09275400B01CEC7318F1AE804456FBE5FEE13613204A6ED0E592660D3B058868B50

Function 03F742F0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 03F74301

Memory Dump Source

Source File: 00000000.00000002.1281015705.0000000003F72000.00000040.00000020.00020000.00000000.sdmp, Offset: 03F72000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3f72000_rOrderRequest09-24.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 6602565e698a366f30167ec5a91f9104502153a18ef916c8aacda5f71807a46b
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 51E0E67494010DDFDB00EFF8D54969E7FB4EF04301F1001A1FD05D2281D7309D509A62

Non-executed Functions

Function 00C29576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00BA9BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00C2961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00C2965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00C2969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00C296C9
SendMessageW.USER32 ref: 00C296F2
GetKeyState.USER32(00000011), ref: 00C2978B
GetKeyState.USER32(00000009), ref: 00C29798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00C297AE
GetKeyState.USER32(00000010), ref: 00C297B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00C297E9
SendMessageW.USER32 ref: 00C29810
SendMessageW.USER32(?,00001030,?,00C27E95), ref: 00C29918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00C2992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00C29941
SetCapture.USER32(?), ref: 00C2994A
ClientToScreen.USER32(?,?), ref: 00C299AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00C299BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00C299D6
ReleaseCapture.USER32 ref: 00C299E1
GetCursorPos.USER32(?), ref: 00C29A19
ScreenToClient.USER32(?,?), ref: 00C29A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00C29A80
SendMessageW.USER32 ref: 00C29AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00C29AEB
SendMessageW.USER32 ref: 00C29B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00C29B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00C29B4A
GetCursorPos.USER32(?), ref: 00C29B68
ScreenToClient.USER32(?,?), ref: 00C29B75
GetParent.USER32(?), ref: 00C29B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00C29BFA
SendMessageW.USER32 ref: 00C29C2B
ClientToScreen.USER32(?,?), ref: 00C29C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00C29CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00C29CDE
SendMessageW.USER32 ref: 00C29D01
ClientToScreen.USER32(?,?), ref: 00C29D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00C29D82

Part of subcall function 00BA9944: GetWindowLongW.USER32(?,000000EB), ref: 00BA9952

GetWindowLongW.USER32(?,000000F0), ref: 00C29E05

Strings

@GUI_DRAGID, xrefs: 00C2997D
F, xrefs: 00C29D07

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: 55cd42335d51417b0fb251fd50a5b7729e77e493140037e0c88ea5397cae09e5
Instruction ID: a2bbf98fff7eeb40372baa5b466e2272591a5351f2be18a2cbc1c070c338d6cd
Opcode Fuzzy Hash: 55cd42335d51417b0fb251fd50a5b7729e77e493140037e0c88ea5397cae09e5
Instruction Fuzzy Hash: 5042AC34204610AFDB20CF28DC84BAABBF5FF49720F140619FAA987AA1D771E951DF51

Function 00C24873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 00C248F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00C24908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00C24927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 00C2494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 00C2495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 00C2497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 00C249AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 00C249D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00C24A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00C24A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00C24A7E
IsMenu.USER32(?), ref: 00C24A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00C24AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00C24B20
GetWindowLongW.USER32(?,000000F0), ref: 00C24B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00C24BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00C24C82
wsprintfW.USER32 ref: 00C24CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00C24CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00C24CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00C24D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00C24D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00C24D5A

Strings

%d/%02d/%02d, xrefs: 00C24CA8

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: 04010bfacf6668db0b65b231279e6bf4db0b8bde97f4de6af67aeacb1da6ed4b
Instruction ID: cda022ac2d2a6a9affcf9be5b9e965ab091809d1b6430da6f0a0c908adc2b657
Opcode Fuzzy Hash: 04010bfacf6668db0b65b231279e6bf4db0b8bde97f4de6af67aeacb1da6ed4b
Instruction Fuzzy Hash: D5121431500224ABEB288F69EC49FBE7BF8EF85710F104169F525DB6E1DB749A41CB50

Function 00BAF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 00BAF998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00BEF474
IsIconic.USER32(00000000), ref: 00BEF47D
ShowWindow.USER32(00000000,00000009), ref: 00BEF48A
SetForegroundWindow.USER32(00000000), ref: 00BEF494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00BEF4AA
GetCurrentThreadId.KERNEL32 ref: 00BEF4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00BEF4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 00BEF4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 00BEF4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 00BEF4DE
SetForegroundWindow.USER32(00000000), ref: 00BEF4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 00BEF4F6
keybd_event.USER32(00000012,00000000), ref: 00BEF501
MapVirtualKeyW.USER32(00000012,00000000), ref: 00BEF50B
keybd_event.USER32(00000012,00000000), ref: 00BEF510
MapVirtualKeyW.USER32(00000012,00000000), ref: 00BEF519
keybd_event.USER32(00000012,00000000), ref: 00BEF51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 00BEF528
keybd_event.USER32(00000012,00000000), ref: 00BEF52D
SetForegroundWindow.USER32(00000000), ref: 00BEF530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 00BEF557

Strings

Shell_TrayWnd, xrefs: 00BEF46F

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 0499ff6d06abc8d376f71f78588f8be236805485201b9fa3e91fee39e66badbb
Instruction ID: 8c690935c20cfa6acfd83b6563c20d2fbef968d726c27f4fda4da45fdcaeeb25
Opcode Fuzzy Hash: 0499ff6d06abc8d376f71f78588f8be236805485201b9fa3e91fee39e66badbb
Instruction Fuzzy Hash: F7316A71A50219BFEB316BB65C8AFBF7EBCEB44B50F100065F601E61D1C7B19D11AAA0

Function 00BF1201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00BF16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00BF170D
Part of subcall function 00BF16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00BF173A
Part of subcall function 00BF16C3: GetLastError.KERNEL32 ref: 00BF174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00BF1286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00BF12A8
CloseHandle.KERNEL32(?), ref: 00BF12B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00BF12D1
GetProcessWindowStation.USER32 ref: 00BF12EA
SetProcessWindowStation.USER32(00000000), ref: 00BF12F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00BF1310

Part of subcall function 00BF10BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00BF11FC), ref: 00BF10D4
Part of subcall function 00BF10BF: CloseHandle.KERNEL32(?,?,00BF11FC), ref: 00BF10E9

Strings

, xrefs: 00BF125A
winsta0, xrefs: 00BF12CC
default, xrefs: 00BF130B

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: 5b491194285fbe6ba144071cc86eac6060cc03c8f046966e3a64b32d6b3aa9ae
Instruction ID: c4c7374b7b379d340d96e76c6ee99448ab014b7ac2b97663e1cec6ce25f617ee
Opcode Fuzzy Hash: 5b491194285fbe6ba144071cc86eac6060cc03c8f046966e3a64b32d6b3aa9ae
Instruction Fuzzy Hash: 26817D71900209EBDF249FA8DC49BFE7BB9EF44700F1449A9FA11B62A0C7708949CF60

Function 00BF0B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00BF1114
Part of subcall function 00BF10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00BF0B9B,?,?,?), ref: 00BF1120
Part of subcall function 00BF10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00BF0B9B,?,?,?), ref: 00BF112F
Part of subcall function 00BF10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00BF0B9B,?,?,?), ref: 00BF1136
Part of subcall function 00BF10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00BF114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00BF0BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00BF0C00
GetLengthSid.ADVAPI32(?), ref: 00BF0C17
GetAce.ADVAPI32(?,00000000,?), ref: 00BF0C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00BF0C6D
GetLengthSid.ADVAPI32(?), ref: 00BF0C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00BF0C8C
HeapAlloc.KERNEL32(00000000), ref: 00BF0C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00BF0CB4
CopySid.ADVAPI32(00000000), ref: 00BF0CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00BF0CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00BF0D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00BF0D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00BF0D45
HeapFree.KERNEL32(00000000), ref: 00BF0D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00BF0D55
HeapFree.KERNEL32(00000000), ref: 00BF0D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00BF0D65
HeapFree.KERNEL32(00000000), ref: 00BF0D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00BF0D78
HeapFree.KERNEL32(00000000), ref: 00BF0D7F

Part of subcall function 00BF1193: GetProcessHeap.KERNEL32(00000008,00BF0BB1,?,00000000,?,00BF0BB1,?), ref: 00BF11A1
Part of subcall function 00BF1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00BF0BB1,?), ref: 00BF11A8
Part of subcall function 00BF1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00BF0BB1,?), ref: 00BF11B7

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 553a0ca27b2e07b0628d2bf9828b8954ed579bf5a8a015708dad84dc67c5ae92
Instruction ID: bfc62ab72f4ff5e3e55da8e52fe0ab1b86263e564432429d56f319613d40a377
Opcode Fuzzy Hash: 553a0ca27b2e07b0628d2bf9828b8954ed579bf5a8a015708dad84dc67c5ae92
Instruction Fuzzy Hash: 86715D7591020AABDF10AFA4DC85FBEBBB9FF04300F1445A5EA14A71A1D771A919CB60

Function 00C0EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00C2CC08), ref: 00C0EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 00C0EB37
GetClipboardData.USER32(0000000D), ref: 00C0EB43
CloseClipboard.USER32 ref: 00C0EB4F
GlobalLock.KERNEL32(00000000), ref: 00C0EB87
CloseClipboard.USER32 ref: 00C0EB91
GlobalUnlock.KERNEL32(00000000), ref: 00C0EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 00C0EBC9
GetClipboardData.USER32(00000001), ref: 00C0EBD1
GlobalLock.KERNEL32(00000000), ref: 00C0EBE2
GlobalUnlock.KERNEL32(00000000), ref: 00C0EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 00C0EC38
GetClipboardData.USER32(0000000F), ref: 00C0EC44
GlobalLock.KERNEL32(00000000), ref: 00C0EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00C0EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00C0EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00C0ECD2
GlobalUnlock.KERNEL32(00000000), ref: 00C0ECF3
CountClipboardFormats.USER32 ref: 00C0ED14
CloseClipboard.USER32 ref: 00C0ED59

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: b88166a18b9f20032bc2c9c03a5c2125456a551ed23bb9efaddc5b8cde343fde
Instruction ID: 616634b8e39a6394be185011b64bcc8d7f73dadae5f42e6d98817cdb417da30a
Opcode Fuzzy Hash: b88166a18b9f20032bc2c9c03a5c2125456a551ed23bb9efaddc5b8cde343fde
Instruction Fuzzy Hash: 5D619A35244201AFD710EF24D895F2E77E4EF84704F18496DF866972E2CB31EA06CBA2

Function 00C0698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00C069BE
FindClose.KERNEL32(00000000), ref: 00C06A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00C06A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00C06A75

Part of subcall function 00B99CB3: _wcslen.LIBCMT ref: 00B99CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00C06AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00C06ADF

Strings

%02d, xrefs: 00C06C00, 00C06C0A, 00C06C5A, 00C06CAA, 00C06CFA, 00C06D4A
%4d%02d%02d%02d%02d%02d, xrefs: 00C06B6A
%4d, xrefs: 00C06BB1
%03d, xrefs: 00C06DA2
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00C06B32

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 3ea93161418c79ea8917f9a64acba4b43c455f2d173ab2a557271663843806bb
Instruction ID: aa469b0f23107704166c84acc99deafd07fc15ffe899295820d48822632bc878
Opcode Fuzzy Hash: 3ea93161418c79ea8917f9a64acba4b43c455f2d173ab2a557271663843806bb
Instruction Fuzzy Hash: 02D14D72508300AFC710EBA4C891EAFB7ECAF98704F44496DF599D7191EB74DA48CB62

Function 00C09642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,774C8FB0,?,00000000), ref: 00C09663
GetFileAttributesW.KERNEL32(?), ref: 00C096A1
SetFileAttributesW.KERNEL32(?,?), ref: 00C096BB
FindNextFileW.KERNEL32(00000000,?), ref: 00C096D3
FindClose.KERNEL32(00000000), ref: 00C096DE
FindFirstFileW.KERNEL32(*.*,?), ref: 00C096FA
SetCurrentDirectoryW.KERNEL32(?), ref: 00C0974A
SetCurrentDirectoryW.KERNEL32(00C56B7C), ref: 00C09768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00C09772
FindClose.KERNEL32(00000000), ref: 00C0977F
FindClose.KERNEL32(00000000), ref: 00C0978F

Strings

*.*, xrefs: 00C096F5

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 085885c7b5be60134cc2a4b38363bc454bf1090c29ea254493498e9cfad9459f
Instruction ID: 984962cab3eb47a0a5215923598dda45e56cd0e1b7fb8a1cdd0a7de30c1dfdc3
Opcode Fuzzy Hash: 085885c7b5be60134cc2a4b38363bc454bf1090c29ea254493498e9cfad9459f
Instruction Fuzzy Hash: 5A31C232541619AFDB24EFB8DC49BEE77ACDF09321F1041A5F825E20E1DB70DA85CA54

Function 00C0979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,774C8FB0,?,00000000), ref: 00C097BE
FindNextFileW.KERNEL32(00000000,?), ref: 00C09819
FindClose.KERNEL32(00000000), ref: 00C09824
FindFirstFileW.KERNEL32(*.*,?), ref: 00C09840
SetCurrentDirectoryW.KERNEL32(?), ref: 00C09890
SetCurrentDirectoryW.KERNEL32(00C56B7C), ref: 00C098AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00C098B8
FindClose.KERNEL32(00000000), ref: 00C098C5
FindClose.KERNEL32(00000000), ref: 00C098D5

Part of subcall function 00BFDAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00BFDB00

Strings

*.*, xrefs: 00C0983B

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 5b11f8512b74769858e120c0cb2a82583f6a24f550b49e995e714fe1e3909008
Instruction ID: adcb3069a1bac4c792576ec0e442d5d9c07c01e71770f74cb09e3dbf24f52575
Opcode Fuzzy Hash: 5b11f8512b74769858e120c0cb2a82583f6a24f550b49e995e714fe1e3909008
Instruction Fuzzy Hash: 5831B6315016196FDF20EFB4EC48BDE77ACDF06320F148265E924A31E1DB70DA85CA64

Function 00C08195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00C08257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00C08267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00C08273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00C08310
SetCurrentDirectoryW.KERNEL32(?), ref: 00C08324
SetCurrentDirectoryW.KERNEL32(?), ref: 00C08356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00C0838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00C08395

Strings

*.*, xrefs: 00C0839B

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 6ac2dc67fdcfee550c0258ecf0f2ac697c788f081b52d3d408ce149e76653d55
Instruction ID: d2dc37525aac33600aef0e7dec72a65abffd4877ff66058d2ed7279101e34e36
Opcode Fuzzy Hash: 6ac2dc67fdcfee550c0258ecf0f2ac697c788f081b52d3d408ce149e76653d55
Instruction Fuzzy Hash: 8F6171725143059FCB10EF64D840AAEB3E8FF89314F04896DF999D7261DB31E949CB92

Function 00BFD076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B93AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00B93A97,?,?,00B92E7F,?,?,?,00000000), ref: 00B93AC2

Part of subcall function 00BFE199: GetFileAttributesW.KERNEL32(?,00BFCF95), ref: 00BFE19A

FindFirstFileW.KERNEL32(?,?), ref: 00BFD122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00BFD1DD
MoveFileW.KERNEL32(?,?), ref: 00BFD1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 00BFD20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 00BFD237

Part of subcall function 00BFD29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00BFD21C,?,?), ref: 00BFD2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 00BFD253
FindClose.KERNEL32(00000000), ref: 00BFD264

Strings

\*.*, xrefs: 00BFD0CD, 00BFD0D6, 00BFD0EB

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 65f913c7a8d6c10fb61254a2fb4033a62fdac3ff2857c893d9e3e1268dca6596
Instruction ID: 0dd3b760b042304863bc6479fc00704c42beda7df89e1e16d4e11c2a8eae386a
Opcode Fuzzy Hash: 65f913c7a8d6c10fb61254a2fb4033a62fdac3ff2857c893d9e3e1268dca6596
Instruction Fuzzy Hash: 28615C3180510DAACF15EBA4CA92AFDB7F6AF15300F2441A9E50177191EF31AF0DCBA1

Function 00C0ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00C0ED91
EmptyClipboard.USER32 ref: 00C0ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 00C0EDAC
CloseClipboard.USER32 ref: 00C0EEA3

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 1369c36ab8759347f52a32e3fde8c67278dfeab7cced4a3ec219c354b9c6d990
Instruction ID: 389100605fe16bd63828b0a50f27628adf4fe1e4bde464122bc107ed74676775
Opcode Fuzzy Hash: 1369c36ab8759347f52a32e3fde8c67278dfeab7cced4a3ec219c354b9c6d990
Instruction Fuzzy Hash: C9418D35204611AFE720DF15D888F19BBE5EF44318F19C499E42A8BBA2C775FD42CB90

Function 00BFE8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00BF170D
Part of subcall function 00BF16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00BF173A
Part of subcall function 00BF16C3: GetLastError.KERNEL32 ref: 00BF174A

ExitWindowsEx.USER32(?,00000000), ref: 00BFE932

Strings

@, xrefs: 00BFE925
, xrefs: 00BFE920
, xrefs: 00BFE95C
SeShutdownPrivilege, xrefs: 00BFE902

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 26aa7bd486f67cafb3f13754e6270283560227ef08c437eb703972b80ac1dcd8
Instruction ID: 0682efd52124ac2243a577cabc538cc58f93c09a2b2c8773374aa272b23f3589
Opcode Fuzzy Hash: 26aa7bd486f67cafb3f13754e6270283560227ef08c437eb703972b80ac1dcd8
Instruction Fuzzy Hash: 5D01F732620218ABEB2426749CC9FBE72DCDB04741F148961FA22E30E1DAF09C4881A0

Function 00C11204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00C11276
WSAGetLastError.WSOCK32 ref: 00C11283
bind.WSOCK32(00000000,?,00000010), ref: 00C112BA
WSAGetLastError.WSOCK32 ref: 00C112C5
closesocket.WSOCK32(00000000), ref: 00C112F4
listen.WSOCK32(00000000,00000005), ref: 00C11303
WSAGetLastError.WSOCK32 ref: 00C1130D
closesocket.WSOCK32(00000000), ref: 00C1133C

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 756d67ced2f02f8380e9ccaa8ecbafa499cb84e2fc43e8629899dedbeb5c11fd
Instruction ID: 94550823ef9e0fe1470f45745aab05e7d5718c9a48141186671a1ecc97f1bd77
Opcode Fuzzy Hash: 756d67ced2f02f8380e9ccaa8ecbafa499cb84e2fc43e8629899dedbeb5c11fd
Instruction Fuzzy Hash: 394190316001409FD720DF24C488B69BBE5AF46318F188198E9669F2E6C775ED82DBE1

Function 00BCB952 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00BCB9D4
_free.LIBCMT ref: 00BCB9F8
_free.LIBCMT ref: 00BCBB7F
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00C33700), ref: 00BCBB91
WideCharToMultiByte.KERNEL32(00000000,00000000,00C6121C,000000FF,00000000,0000003F,00000000,?,?), ref: 00BCBC09
WideCharToMultiByte.KERNEL32(00000000,00000000,00C61270,000000FF,?,0000003F,00000000,?), ref: 00BCBC36
_free.LIBCMT ref: 00BCBD4B

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: b5244a4993b38cd1b8baa654c476fda7baf6ab1e5ea8fa1aa7f4d2c0387967f0
Instruction ID: 35442755fae052814dc4883cabbda6580aef36b5ee2707e86eace6f2b2b81f7d
Opcode Fuzzy Hash: b5244a4993b38cd1b8baa654c476fda7baf6ab1e5ea8fa1aa7f4d2c0387967f0
Instruction Fuzzy Hash: 3AC10571A04245AFDB249F798C92FAEBBE8EF41310F1841EEE895D7251EB709E41CB50

Function 00BFD3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B93AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00B93A97,?,?,00B92E7F,?,?,?,00000000), ref: 00B93AC2

Part of subcall function 00BFE199: GetFileAttributesW.KERNEL32(?,00BFCF95), ref: 00BFE19A

FindFirstFileW.KERNEL32(?,?), ref: 00BFD420
DeleteFileW.KERNEL32(?,?,?,?), ref: 00BFD470
FindNextFileW.KERNEL32(00000000,00000010), ref: 00BFD481
FindClose.KERNEL32(00000000), ref: 00BFD498
FindClose.KERNEL32(00000000), ref: 00BFD4A1

Strings

\*.*, xrefs: 00BFD3F2

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 5aac6344f5a1322a0bd6cce028d31aa265b21a9905b451c2b32d46143df60fbc
Instruction ID: 472e5f9151e16ca48e7bf89ab1c41c55529dc77e816cf90cd11135c42fe967b1
Opcode Fuzzy Hash: 5aac6344f5a1322a0bd6cce028d31aa265b21a9905b451c2b32d46143df60fbc
Instruction Fuzzy Hash: 1A3180310183459BC710EF64C8919BFB7E8BEA1304F444AADF5D593291EB30AA0DD763

Function 00BCE4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00BCE645

Strings

1#IND, xrefs: 00BCF83D
1#QNAN, xrefs: 00BCF84B
1#INF, xrefs: 00BCF852
1#SNAN, xrefs: 00BCF844

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 09bac1721545be20f678d88f238bc3a63530826aba28d211f724444c57eb4cf4
Instruction ID: d0681db5146ac8547dc74d142b287242a99ac5bd744c935cf9ac8011dadd55bb
Opcode Fuzzy Hash: 09bac1721545be20f678d88f238bc3a63530826aba28d211f724444c57eb4cf4
Instruction Fuzzy Hash: 46C20972E046298FDB25CE289D80BEAB7F6EB48305F1541EED45DE7241E774AE818F40

Function 00C0648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00C064DC
CoInitialize.OLE32(00000000), ref: 00C06639
CoCreateInstance.OLE32(00C2FCF8,00000000,00000001,00C2FB68,?), ref: 00C06650
CoUninitialize.OLE32 ref: 00C068D4

Strings

.lnk, xrefs: 00C064BA, 00C06524, 00C065E0

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: cee1fce8b120956ab1b2a667c056b14a761b46576126371a02cea5a613e0cfb9
Instruction ID: 939cbf5ff1ed2d2d929fb76e1769ca090b7e821db151f246c1164040b53c69ae
Opcode Fuzzy Hash: cee1fce8b120956ab1b2a667c056b14a761b46576126371a02cea5a613e0cfb9
Instruction Fuzzy Hash: D8D13971508201AFC714EF24C881A6BB7E9FF98704F40496DF5958B291EB71EA49CBA2

Function 00C122DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 00C122E8

Part of subcall function 00C0E4EC: GetWindowRect.USER32(?,?), ref: 00C0E504

GetDesktopWindow.USER32 ref: 00C12312
GetWindowRect.USER32(00000000), ref: 00C12319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00C12355
GetCursorPos.USER32(?), ref: 00C12381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00C123DF

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 4eda3506575c14743b41502db8af8817aebeaa438a4ca84c88a4bb70a493f9ee
Instruction ID: b1958dee85f158e9e031cdecb8373adace1fa740a3a72825a60e4147359c8412
Opcode Fuzzy Hash: 4eda3506575c14743b41502db8af8817aebeaa438a4ca84c88a4bb70a493f9ee
Instruction Fuzzy Hash: 0631ED72104305ABC720DF54C848BAFBBADFF89310F400919F9A4A71A1DB34EA59CB92

Function 00C09B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00B99CB3: _wcslen.LIBCMT ref: 00B99CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00C09B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00C09C8B

Part of subcall function 00C03874: GetInputState.USER32 ref: 00C038CB
Part of subcall function 00C03874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00C03966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00C09BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00C09C75

Strings

*.*, xrefs: 00C09B5D

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: db57c1bb1dcebac0c612e9b4ff8f5074d6e3d21594f4cb8e4d6f55d77e082146
Instruction ID: 2ccd8bed7a434947e6ee738f5b973806d49e0fd7d13cce048dd28048b707427f
Opcode Fuzzy Hash: db57c1bb1dcebac0c612e9b4ff8f5074d6e3d21594f4cb8e4d6f55d77e082146
Instruction Fuzzy Hash: A3413C7194420A9BDF14DF64C885BEEBBF8EF05310F2441A6E815A2192EB309F85CB61

Function 00BA997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00BA9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00BA9BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00BA9A4E
GetSysColor.USER32(0000000F), ref: 00BA9B23
SetBkColor.GDI32(?,00000000), ref: 00BA9B36

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 850321ab2ec84d457c8cc1846b5d936dfe3e12f05b1423b0664428a3894ff857
Instruction ID: 8d7ea7782ee1acc94b64eaf2d89e27bc8d79b2b56ae76dbd8c99f47ecb5cc291
Opcode Fuzzy Hash: 850321ab2ec84d457c8cc1846b5d936dfe3e12f05b1423b0664428a3894ff857
Instruction Fuzzy Hash: 70A1E47024C494BEE728AA2EDCC8F7F26DDDB87340B19029AF502C6995CF259D01F271

Function 00C11806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00C1304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00C1307A
Part of subcall function 00C1304E: _wcslen.LIBCMT ref: 00C1309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00C1185D
WSAGetLastError.WSOCK32 ref: 00C11884
bind.WSOCK32(00000000,?,00000010), ref: 00C118DB
WSAGetLastError.WSOCK32 ref: 00C118E6
closesocket.WSOCK32(00000000), ref: 00C11915

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: c2fa7fba53cb9c83b742d6251d70ee2cb9e7c22894bdccf232a7674035fe756f
Instruction ID: 1a6e4374add60b445a7c3f235fbf9c83743aae0ef25029ad26c01453d344fee7
Opcode Fuzzy Hash: c2fa7fba53cb9c83b742d6251d70ee2cb9e7c22894bdccf232a7674035fe756f
Instruction Fuzzy Hash: EC51B471A002109FEB10AF24C886F6A7BE5AB49718F49C09CF9195F3D3DB75AD418BA1

Function 00C21C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00C21CC0
IsWindowEnabled.USER32 ref: 00C21CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00C21CDB
IsIconic.USER32 ref: 00C21CE9
IsZoomed.USER32 ref: 00C21CF7

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 867f0d00b1257449207b5e79e6a5d62de4b6eb35f1cf2e0be17bdbd98752981e
Instruction ID: db03a7f0187c00de79ce3da2ca9db5b5ce9fb186a56c5c7ca00b640f5cc13796
Opcode Fuzzy Hash: 867f0d00b1257449207b5e79e6a5d62de4b6eb35f1cf2e0be17bdbd98752981e
Instruction Fuzzy Hash: 6F21F7357406209FD7218F1AE884B2A7BE5EFA5314F1D8068EC4ACBB51CB71ED42CB90

Function 00B98060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00BD5DF0
VUUU, xrefs: 00B9843C
VUUU, xrefs: 00B983E8
VUUU, xrefs: 00B983FA
ERCP, xrefs: 00B9813C

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 0556d5be1289007cd565ab86b9896d0029c8f9b8a4b5470dbeafebae54a62cce
Instruction ID: f76965d78aae000ca86b286e3ce5ecbc3d92afbf1b58063518be361d8559884b
Opcode Fuzzy Hash: 0556d5be1289007cd565ab86b9896d0029c8f9b8a4b5470dbeafebae54a62cce
Instruction Fuzzy Hash: A9A23B71A0061ACBDF24CF58C9807AEB7F1FB55314F2485EAE815AB385EB749D81CB90

Function 00C1A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00C1A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 00C1A6BA

Part of subcall function 00B99CB3: _wcslen.LIBCMT ref: 00B99CBD

Process32NextW.KERNEL32(00000000,?), ref: 00C1A79C
CloseHandle.KERNEL32(00000000), ref: 00C1A7AB

Part of subcall function 00BACE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00BD3303,?), ref: 00BACE8A

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 0b572c8aa38b81c44d9b3e297813ad028efedf16bda1181a322a0274cc7e7710
Instruction ID: 20405d28a31d66108c37863a229b97daa17139858819451cf199b9ce6cf1aceb
Opcode Fuzzy Hash: 0b572c8aa38b81c44d9b3e297813ad028efedf16bda1181a322a0274cc7e7710
Instruction Fuzzy Hash: 35514B71508300AFD710EF24C886A6FBBE8FF89754F40896DF599972A1EB30D945CB92

Function 00BFAA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00BFAAAC
SetKeyboardState.USER32(00000080), ref: 00BFAAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00BFAB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00BFAB88

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 58592e2c9631815c78f24f3167ce3918f96bf0d1c8e75f11d716267727139ec1
Instruction ID: 30e252b5a52bd6c9d37eae69bb8d51357e4561e8d43d38601f9a3887e031ea03
Opcode Fuzzy Hash: 58592e2c9631815c78f24f3167ce3918f96bf0d1c8e75f11d716267727139ec1
Instruction Fuzzy Hash: 733105B0A4020CAEFB399A64CC45BFE7BE6EB44310F04429AF289575D2D374899DC762

Function 00C0CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 00C0CE89
GetLastError.KERNEL32(?,00000000), ref: 00C0CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 00C0CEFE

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 15a29352d2cb4393209bdfb8b7a24776b968da38a15221162662194ec61bcd31
Instruction ID: 69d273c985ebfb2db36d71b6d7944dd98d7ae2fbfc5c51f374b9f72c4284f0e8
Opcode Fuzzy Hash: 15a29352d2cb4393209bdfb8b7a24776b968da38a15221162662194ec61bcd31
Instruction Fuzzy Hash: 0021BD715007059BD730CFA5C988BAB77F8EB10314F20462EE666D2191E770EE05CB50

Function 00BFDBBE Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00BD5222), ref: 00BFDBCE
GetFileAttributesW.KERNEL32(?), ref: 00BFDBDD
FindFirstFileW.KERNEL32(?,?), ref: 00BFDBEE
FindClose.KERNEL32(00000000), ref: 00BFDBFA

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 91c95a6b4c2005706cffd3b9f45e33622d6db361f4d45d9b3019226dc8167706
Instruction ID: fc5e3ae5c88f487ff78b974416dd709ac18f21b46fd1c5ad3d1c539357a508b4
Opcode Fuzzy Hash: 91c95a6b4c2005706cffd3b9f45e33622d6db361f4d45d9b3019226dc8167706
Instruction Fuzzy Hash: A2F0A0308209189783306B7CAC4EABE37ADDE11334B104B42F976C24F0EFB0595A86D5

Function 00BF8298 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00BF82AA

Strings

(, xrefs: 00BF82F0
|, xrefs: 00BF82DA

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: f31d258a773b8662acb6428b07e72a8458fc52b5767a73804052775a5fca1164
Instruction ID: 0304d9c5034344d930b40c86e9bd67401e7c29dab2c4c215e0d9f09bf8fd3c9e
Opcode Fuzzy Hash: f31d258a773b8662acb6428b07e72a8458fc52b5767a73804052775a5fca1164
Instruction Fuzzy Hash: 10323675A007099FCB28CF59C481A6AB7F0FF48710B15C5AEE59ADB3A1EB70E941CB44

Function 00C05C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00C05CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00C05D17
FindClose.KERNEL32(?), ref: 00C05D5F

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 7120c2914fddb5f83b632f6cbdba8dbf7096fcefc2d5dd9db80229af4ac93590
Instruction ID: c15ba97f742ca3fe27c38b3184f71e559a1a46e7a9bda540aab58a2e9ae91530
Opcode Fuzzy Hash: 7120c2914fddb5f83b632f6cbdba8dbf7096fcefc2d5dd9db80229af4ac93590
Instruction Fuzzy Hash: F0518975604B019FC714CF28C494A9AB7E4FF49314F1485AEE9AA8B3A1DB30ED45CF91

Function 00BC2622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00BC271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00BC2724
UnhandledExceptionFilter.KERNEL32(?), ref: 00BC2731

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: fdd938c08d22305a27b932931cc200c90f2931d55f57f8f0f0b38a4e960ea717
Instruction ID: e7cf3ce804244338dd2c7378dfaa591348bbc004c3444dd97ddc5c2b3cb52c8d
Opcode Fuzzy Hash: fdd938c08d22305a27b932931cc200c90f2931d55f57f8f0f0b38a4e960ea717
Instruction Fuzzy Hash: 9631B274911218ABCB21DF68DC89BDDBBF8EF08310F5045EAE81CA6261E7709F818F45

Function 00C051CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00C051DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00C05238
SetErrorMode.KERNEL32(00000000), ref: 00C052A1

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: d86fef0035d06e3aa37db5a50e199f88e67055f7195d5134ec19dd3aeb348719
Instruction ID: 9132f01c26f04f889c060dd07fc51d7431f5472d7cc22ee79a21517589f1ffbf
Opcode Fuzzy Hash: d86fef0035d06e3aa37db5a50e199f88e67055f7195d5134ec19dd3aeb348719
Instruction Fuzzy Hash: BF313A75A105189FDB00DF54D885BAEBBF4FF49314F058099E809AB3A2DB31E95ACB90

Function 00BF16C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00BAFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00BB0668
Part of subcall function 00BAFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00BB0685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00BF170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00BF173A
GetLastError.KERNEL32 ref: 00BF174A

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 074a06e071b6d2d40c289ef35970a44f561f11f2f70669d46020275a8ab29f25
Instruction ID: fd5d93f9c5e711cc09af37c2675e522bbdbd165cb0f3b866a0dc53bb988e486d
Opcode Fuzzy Hash: 074a06e071b6d2d40c289ef35970a44f561f11f2f70669d46020275a8ab29f25
Instruction Fuzzy Hash: DC11C4B1414309EFD718AF54DCC6EBEB7F9EB04714B20896EE05653641EB70BC458B60

Function 00BFD5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00BFD608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00BFD645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00BFD650

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: f4b47fb2f39f833cfd7a2009c551897f7a278c083d28ad58c74b89b95111ba5b
Instruction ID: 95dee7e52b35c394db31deeab239d0f6232ab6cb25e558ffbb2fff264384a4fe
Opcode Fuzzy Hash: f4b47fb2f39f833cfd7a2009c551897f7a278c083d28ad58c74b89b95111ba5b
Instruction Fuzzy Hash: D0115E75E05228BFDB208F95DC85FAFBBBCEB45B60F108155F904E7290D6704A058BA1

Function 00BF1663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00BF168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00BF16A1
FreeSid.ADVAPI32(?), ref: 00BF16B1

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 0e69ceb98245340f636bbda64501a1dfcb1e3a01dfce46d1f55b64db0451d980
Instruction ID: c0995e17277933bbea463571b9d17abef09f841353ee2cf484f46245e21ad9fb
Opcode Fuzzy Hash: 0e69ceb98245340f636bbda64501a1dfcb1e3a01dfce46d1f55b64db0451d980
Instruction Fuzzy Hash: 9FF0F47195030DFBDB00DFE4DC89EAEBBBCFB08644F5049A5E501E2181E774AA448A54

Function 00BB4CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00BC28E9,?,00BB4CBE,00BC28E9,00C588B8,0000000C,00BB4E15,00BC28E9,00000002,00000000,?,00BC28E9), ref: 00BB4D09
TerminateProcess.KERNEL32(00000000,?,00BB4CBE,00BC28E9,00C588B8,0000000C,00BB4E15,00BC28E9,00000002,00000000,?,00BC28E9), ref: 00BB4D10
ExitProcess.KERNEL32 ref: 00BB4D22

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 6446e5cb698f4d31924b4cf8ff230098db2f93053efd596c6df8b3b038c993ca
Instruction ID: 5d77379148b2232e906b300f4230ba2e377ca8973beb09758b930981454a9933
Opcode Fuzzy Hash: 6446e5cb698f4d31924b4cf8ff230098db2f93053efd596c6df8b3b038c993ca
Instruction Fuzzy Hash: B9E0B631010548ABCF21AF54DD4ABAC3BA9FB42795B108468FC058A533CB75DD52DB84

Function 00BCC2A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 00BCC36C

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 14dd026676d315870975be2c55a960e11758815583eec42563f6e622e0f91fd5
Instruction ID: b56bb89510dd8afeb658e5fbc0a5f0c0e463a9b7c9f0d943da824acfd0c36a50
Opcode Fuzzy Hash: 14dd026676d315870975be2c55a960e11758815583eec42563f6e622e0f91fd5
Instruction Fuzzy Hash: 794126765002196FCB249FB9DC88FAB7BF8EB94314F1042ADF919DB180E6709D818B54

Function 00BED27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00BED28C

Strings

X64, xrefs: 00BED2A8

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 1fb18ba4f47693f40f1645b449344921b858fcb322cbc242dd1b8a277160601c
Instruction ID: f8e9805fb3c3e03ec4c78ecbd1aac51e37331ea012818bbbc09e7706c9ff3331
Opcode Fuzzy Hash: 1fb18ba4f47693f40f1645b449344921b858fcb322cbc242dd1b8a277160601c
Instruction Fuzzy Hash: 4DD0CAB481512DEACBA0CBA0ECC8EDEB7BCBB04305F100292F206A2000DB7096498F20

Function 00BBCAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: d727b36425ecbe8f4abc5820c824c25e4f7df048efddeabbaebf7387e7c8384c
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: B9020C71E001199FDF14CFA9C8806EEFBF1EF58314F2581AAD819EB384D771A9458B94

Function 00C068EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00C06918
FindClose.KERNEL32(00000000), ref: 00C06961

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 86ad5b7fa49f3436b8cdffc021969782d3fe918dafac40e9b09abbd50133baeb
Instruction ID: 8c11ae4de6527596ba1bb1a023ed843ed1d34c899746a4d45a700e4904ad61f0
Opcode Fuzzy Hash: 86ad5b7fa49f3436b8cdffc021969782d3fe918dafac40e9b09abbd50133baeb
Instruction Fuzzy Hash: EA118E316142019FC710DF29D484B1ABBE5EF85328F15C6A9E4698F6A2CB30EC05CB91

Function 00C037B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00C14891,?,?,00000035,?), ref: 00C037E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00C14891,?,?,00000035,?), ref: 00C037F4

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 6bbd03ed5dae8253e6cd0aa793c2bde4e929642c29ef10dc0c0f1358522b5f1e
Instruction ID: 00c3342553f07cecfebead8fb74bfdae5063483245a93447a6e394bcb576b0c6
Opcode Fuzzy Hash: 6bbd03ed5dae8253e6cd0aa793c2bde4e929642c29ef10dc0c0f1358522b5f1e
Instruction Fuzzy Hash: 2BF0E5B06042286AEB2057BA8C8DFEF7AAEEFC8761F000275F509D22D1D9609944C6B0

Function 00BFB226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00BFB25D
keybd_event.USER32(?,7707C0D0,?,00000000), ref: 00BFB270

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 173d0fabb46660974fa45c9739727f78934a54c1f16e467f955b4afaa5b1f03a
Instruction ID: 8020bd9e7d73eef41df7f99ab80cfac5c501663c679ab47013233c8c2e3b8bc5
Opcode Fuzzy Hash: 173d0fabb46660974fa45c9739727f78934a54c1f16e467f955b4afaa5b1f03a
Instruction Fuzzy Hash: 5CF01D7181424DABDF159FA0C845BBE7FB4FF04305F108059F955A6191C379C6159F94

Function 00BF10BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00BF11FC), ref: 00BF10D4
CloseHandle.KERNEL32(?,?,00BF11FC), ref: 00BF10E9

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 882d1798ea8624500d564b9701369cb5280ee41febee6025515bfe37e6d16b2c
Instruction ID: 830350ba43b7c40c7e0c7f309069c43daa435e39d7b72e856b3305ee28deb0f6
Opcode Fuzzy Hash: 882d1798ea8624500d564b9701369cb5280ee41febee6025515bfe37e6d16b2c
Instruction Fuzzy Hash: 85E04F32018601EEE7352B61FC05FBB77E9EB04320B20886EF5A5814B1DB626CA1DB54

Function 00B9CAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00BE0C40

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.
API String ID: 0-1840281001
Opcode ID: dd4e14472c226ff2203bcb6f0813f5307bca2ccba88f52065d62c81f73c1c90a
Instruction ID: f20c4577eda19b3cd957e84a7cb6c24c54f511c4503fbf7cbf9f440d7122aecd
Opcode Fuzzy Hash: dd4e14472c226ff2203bcb6f0813f5307bca2ccba88f52065d62c81f73c1c90a
Instruction Fuzzy Hash: 7F326A709102189BCF14EF90D995BEDBBF5FF05304F6480B9E806AB292D775AE49CB60

Function 00BC676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00BC6766,?,?,00000008,?,?,00BCFEFE,00000000), ref: 00BC6998

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: f2e063475fc78b754e536b299459917d125975eae510ba6e08e7526d6850a6a2
Instruction ID: 7546c84369e80498800b0c83ddb04a8778c425c66bdc4c5a4e59c269f8d02ccd
Opcode Fuzzy Hash: f2e063475fc78b754e536b299459917d125975eae510ba6e08e7526d6850a6a2
Instruction Fuzzy Hash: F2B129316106099FD719CF28C48AF657BE0FF49364F25869DE89ACF2A2C735E991CB40

Function 00BAB119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 00BE851F

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 08aa7f3188888b76397cea8b86629aaf45897e6fc1ecb2979474cd6aa3e2120a
Instruction ID: 3892c1eccc86f13c6e30fbf418e59f818f5f6e537411976f45da434c0fbd7e44
Opcode Fuzzy Hash: 08aa7f3188888b76397cea8b86629aaf45897e6fc1ecb2979474cd6aa3e2120a
Instruction Fuzzy Hash: 441260719046299FCB14CF59C880AEEB7F5FF49710F1481AAE859EB252DB309E81CF90

Function 00C0EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00C0EABD

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 30d567fd71c426645236f20d1b0c8f573f4b426578fc330c905bf1763b6cbd66
Instruction ID: d4e79823d86d8b4f9c86c52b5676a9af10fc951c8e301837b6fb96d0eab5f5a2
Opcode Fuzzy Hash: 30d567fd71c426645236f20d1b0c8f573f4b426578fc330c905bf1763b6cbd66
Instruction Fuzzy Hash: 86E04F323102049FC710EF5AD844E9AFBE9AF98760F01846AFC49C73A1DB70E841CBA0

Function 00BB09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,00BB03EE), ref: 00BB09DA

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c152ac2ad09c581ff45f713776ea9ee2ce565c702e752d12e85ba31751d56ea6
Instruction ID: af833f6f3f1922a45162f2aa935bc1d155bb51f107208c2b274d37eff9f7c43f
Opcode Fuzzy Hash: c152ac2ad09c581ff45f713776ea9ee2ce565c702e752d12e85ba31751d56ea6
Instruction Fuzzy Hash:

Function 00BB781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 00BB798B

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: e65e674b17472d443a00f1c5b018174ab8221d1bec4dedbbd8e8d22793b15326
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: 875134616CC6056BDB38896A8C9EBFE23D9DBD2340F1805C9D8C6D7282CED5DE01D356

Function 00BC6DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b21575775a831e4f663d02c85bda6ab922901210b2dfa008131726931b0f296c
Instruction ID: 1db6e9efd6ff72ab8b70766b9c8a5bdd60f650c195c2287b7d205bc2e3747398
Opcode Fuzzy Hash: b21575775a831e4f663d02c85bda6ab922901210b2dfa008131726931b0f296c
Instruction Fuzzy Hash: 66322231E79F014DDB239634D822339A689AFB73D5F15D73BE81AB5AA5EF29C4834100

Function 00BACC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4405103641a43a269ceb68236f7fbcbcadf12cc32158c8f259c454aaa7dc2d7b
Instruction ID: 8e6fec4ad74340f6bfb0aa5c2f958a7b5410de8ffe18d15866e7b0f9e11a3e7b
Opcode Fuzzy Hash: 4405103641a43a269ceb68236f7fbcbcadf12cc32158c8f259c454aaa7dc2d7b
Instruction Fuzzy Hash: 2832F831A081958FDF24CF2AC4D467D7FE1EB46310F2885EAD45A9B296E730DD82DB81

Function 00B97920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c5f38b9c714d938ffd8eceaa5ae31896a9ab62c1ae272b3b85ec5a6134b02a8
Instruction ID: ebd070070c8159120076428b0aeed97cb6cd81861b8ea940ae76cf25913e8d8b
Opcode Fuzzy Hash: 6c5f38b9c714d938ffd8eceaa5ae31896a9ab62c1ae272b3b85ec5a6134b02a8
Instruction Fuzzy Hash: B8229E70A0460ADFDF14CFA8D881AAEB7F5FF44310F2045BAE816A7391EB35A955CB50

Function 00B991C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00992b5c91e4a13218183ad4773484386cf6edc600998d6ed04702a74504a07c
Instruction ID: ca4d3484e0b66ba920fca002b25458f568baf2fcd81323b18e542d883466a0c4
Opcode Fuzzy Hash: 00992b5c91e4a13218183ad4773484386cf6edc600998d6ed04702a74504a07c
Instruction Fuzzy Hash: 540297B0E1020AEBDF05EF54D881AADB7F1FF44340F5181A9E4169B391EB31EA51CB95

Function 00BC9EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d14760ce7d97bbe591f305e598b4c37113db38e0c38bc054f431485ed25175e8
Instruction ID: c1b8e5153d041f7e91feacc2250589b8934b783499e9becd7f495d5b4e1b40c8
Opcode Fuzzy Hash: d14760ce7d97bbe591f305e598b4c37113db38e0c38bc054f431485ed25175e8
Instruction Fuzzy Hash: A0B1D030D3AF814DD2639639887133AB69CAFBB6D5B91D71BFC1674D62EB2185834140

Function 00BB1C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 82405c67f0026d74c8bcbc74bdb9ed677f250fae97c432419381564d541d4ef9
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: 019155721090A34BDB69463E85740BEFFE1DB923A135A0FEDD4F2CA1C5EE64C964D620

Function 00BB19B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: a0d4d74db8017628ecc2c1c8958bf9fe4415cb0347481940f728967e8e9037bb
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 3B9182722090E34BDB29427E85740BEFFE19B923A135A0BDDD4F2CA1C5FE94D564D620

Function 00BB7A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2414415b84f4bd876da58afe988809b18cd91a7f88bff69b677819e1b1a71951
Instruction ID: 1145b891edeb8cc98dc95a2d3a039ffd26e893c4fe540c971928793b6343a8ce
Opcode Fuzzy Hash: 2414415b84f4bd876da58afe988809b18cd91a7f88bff69b677819e1b1a71951
Instruction Fuzzy Hash: F06137612C870967DE749A2889B5BFE23D8DFC1700F1409D9E882DB2D1DED19E42CB55

Function 00BB7CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6cd041076b6fb907a7785937c9366edef88044abbb9c19dcf4fefcd1be3215b
Instruction ID: becbd74bda32b594fdc7c24306f43346ca7a460143bf0970889bc263dfc01cbe
Opcode Fuzzy Hash: b6cd041076b6fb907a7785937c9366edef88044abbb9c19dcf4fefcd1be3215b
Instruction Fuzzy Hash: A96138B16C870957DA389A2888A5BFE23DCDFC2780F1409E9E943DF681DED2DD42C255

Function 00BB1706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 565aa89ed6f83514ec6149827765c038d05b39cb3e57f6af6b7477c0d1356437
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: 708175726090E34BDB2D463E85744BEFFE1AB923A135A0BDDD4F2CB1C1EE948954D620

Function 00C02046 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59064366cf13993a79fe67cf019fd756fe1d93f4d3a38316fcb0d2d5f393a610
Instruction ID: 5a4719893af63d450857615c38777f39f3aa57385bde36c2f1850b78d2640d72
Opcode Fuzzy Hash: 59064366cf13993a79fe67cf019fd756fe1d93f4d3a38316fcb0d2d5f393a610
Instruction Fuzzy Hash: 6921A5326206118BDB38CE79C82677E73E9A754314F15862EE4A7C37D0DE75E904CB80

Function 00C270D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00C2712F
GetSysColorBrush.USER32(0000000F), ref: 00C27160
GetSysColor.USER32(0000000F), ref: 00C2716C
SetBkColor.GDI32(?,000000FF), ref: 00C27186
SelectObject.GDI32(?,?), ref: 00C27195
InflateRect.USER32(?,000000FF,000000FF), ref: 00C271C0
GetSysColor.USER32(00000010), ref: 00C271C8
CreateSolidBrush.GDI32(00000000), ref: 00C271CF
FrameRect.USER32(?,?,00000000), ref: 00C271DE
DeleteObject.GDI32(00000000), ref: 00C271E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00C27230
FillRect.USER32(?,?,?), ref: 00C27262
GetWindowLongW.USER32(?,000000F0), ref: 00C27284

Part of subcall function 00C273E8: GetSysColor.USER32(00000012), ref: 00C27421
Part of subcall function 00C273E8: SetTextColor.GDI32(?,?), ref: 00C27425
Part of subcall function 00C273E8: GetSysColorBrush.USER32(0000000F), ref: 00C2743B
Part of subcall function 00C273E8: GetSysColor.USER32(0000000F), ref: 00C27446
Part of subcall function 00C273E8: GetSysColor.USER32(00000011), ref: 00C27463
Part of subcall function 00C273E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00C27471
Part of subcall function 00C273E8: SelectObject.GDI32(?,00000000), ref: 00C27482
Part of subcall function 00C273E8: SetBkColor.GDI32(?,00000000), ref: 00C2748B
Part of subcall function 00C273E8: SelectObject.GDI32(?,?), ref: 00C27498
Part of subcall function 00C273E8: InflateRect.USER32(?,000000FF,000000FF), ref: 00C274B7
Part of subcall function 00C273E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00C274CE
Part of subcall function 00C273E8: GetWindowLongW.USER32(00000000,000000F0), ref: 00C274DB

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 573635f972364dba04bda415506c9f85b8886f9137b066a3786f26d1ef6f89eb
Instruction ID: f768c2c52e019e5d441b7136276355b06af64b81f9da3463154c4fd55ed5819d
Opcode Fuzzy Hash: 573635f972364dba04bda415506c9f85b8886f9137b066a3786f26d1ef6f89eb
Instruction Fuzzy Hash: 1DA19D72018311EFDB209F64DC88B6E7BA9FF49320F100B29F962965E1D770E945DB92

Function 00BA8D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00BA8E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00BE6AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00BE6AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00BE6F43

Part of subcall function 00BA8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00BA8BE8,?,00000000,?,?,?,?,00BA8BBA,00000000,?), ref: 00BA8FC5

SendMessageW.USER32(?,00001053), ref: 00BE6F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00BE6F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00BE6FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00BE6FB7

Strings

0, xrefs: 00BE6DCF

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: 7eb318b94fb67d1ca1f0d91c84f642863006bfefa993bb25143b0883f029e98a
Instruction ID: d5353db495ac127866c3d20410a3d5c612a72c8d3a9c8971ecb3debb3158c3f4
Opcode Fuzzy Hash: 7eb318b94fb67d1ca1f0d91c84f642863006bfefa993bb25143b0883f029e98a
Instruction Fuzzy Hash: 8712AB30204281DFDB25CF25C894BAAB7E1FF65350F1884A9E5858BA61CB72EC52DF91

Function 00C12711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00C1273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00C1286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00C128A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00C128B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00C12900
GetClientRect.USER32(00000000,?), ref: 00C1290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00C12955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00C12964
GetStockObject.GDI32(00000011), ref: 00C12974
SelectObject.GDI32(00000000,00000000), ref: 00C12978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00C12988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00C12991
DeleteDC.GDI32(00000000), ref: 00C1299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00C129C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 00C129DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00C12A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00C12A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00C12A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00C12A77
GetStockObject.GDI32(00000011), ref: 00C12A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00C12A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00C12A97

Strings

DISPLAY, xrefs: 00C1295A
msctls_progress32, xrefs: 00C12A13
static, xrefs: 00C1294F, 00C12A71
AutoIt v3, xrefs: 00C128F8

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 997182844294858e2b96e736e9cb700da65f551fde973889478b247a78346eb9
Instruction ID: 32fb6fb058f607b58b0165182842eafafe86379c7530c48eb0711abfd4dae60c
Opcode Fuzzy Hash: 997182844294858e2b96e736e9cb700da65f551fde973889478b247a78346eb9
Instruction Fuzzy Hash: 49B17D75A10205AFEB20DF68DC8AFAE7BA9EB08711F048154F915E72E0D770ED41CB94

Function 00C04ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00C04AED
GetDriveTypeW.KERNEL32(?,00C2CB68,?,\\.\,00C2CC08), ref: 00C04BCA
SetErrorMode.KERNEL32(00000000,00C2CB68,?,\\.\,00C2CC08), ref: 00C04D36

Strings

\\.\, xrefs: 00C04B3F
Virtual, xrefs: 00C04CE5
ATAPI, xrefs: 00C04C91
RAMDisk, xrefs: 00C04BF4
SSA, xrefs: 00C04CA6
SAS, xrefs: 00C04CC9
Network, xrefs: 00C04C02
SATA, xrefs: 00C04CD0
USB, xrefs: 00C04CB4
RAID, xrefs: 00C04CBB
CDROM, xrefs: 00C04BFB
MMC, xrefs: 00C04CDE
Fixed, xrefs: 00C04C09
Fibre, xrefs: 00C04CAD
Removable, xrefs: 00C04C10, 00C04C15
ATA, xrefs: 00C04C98
FileBackedVirtual, xrefs: 00C04CEC
iSCSI, xrefs: 00C04CC2
SSD, xrefs: 00C04C4A
Unknown, xrefs: 00C04BED, 00C04C83
SCSI, xrefs: 00C04C8A
PhysicalDrive, xrefs: 00C04B76
1394, xrefs: 00C04C9F

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 5a6d78642317cae98c3c47aefc7eaf914168150fafeb140a9abdecf0f604a780
Instruction ID: 401c342b673a0776a3e3e22828f493172e7fd7aa8393ff55224c6ad48a323551
Opcode Fuzzy Hash: 5a6d78642317cae98c3c47aefc7eaf914168150fafeb140a9abdecf0f604a780
Instruction Fuzzy Hash: 9761F2B4205205EBDB0CDF24CA8297E77B0EB04701B648469FE06AB2D1CB31EE85DB45

Function 00C273E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00C27421
SetTextColor.GDI32(?,?), ref: 00C27425
GetSysColorBrush.USER32(0000000F), ref: 00C2743B
GetSysColor.USER32(0000000F), ref: 00C27446
CreateSolidBrush.GDI32(?), ref: 00C2744B
GetSysColor.USER32(00000011), ref: 00C27463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00C27471
SelectObject.GDI32(?,00000000), ref: 00C27482
SetBkColor.GDI32(?,00000000), ref: 00C2748B
SelectObject.GDI32(?,?), ref: 00C27498
InflateRect.USER32(?,000000FF,000000FF), ref: 00C274B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00C274CE
GetWindowLongW.USER32(00000000,000000F0), ref: 00C274DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00C2752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00C27554
InflateRect.USER32(?,000000FD,000000FD), ref: 00C27572
DrawFocusRect.USER32(?,?), ref: 00C2757D
GetSysColor.USER32(00000011), ref: 00C2758E
SetTextColor.GDI32(?,00000000), ref: 00C27596
DrawTextW.USER32(?,00C270F5,000000FF,?,00000000), ref: 00C275A8
SelectObject.GDI32(?,?), ref: 00C275BF
DeleteObject.GDI32(?), ref: 00C275CA
SelectObject.GDI32(?,?), ref: 00C275D0
DeleteObject.GDI32(?), ref: 00C275D5
SetTextColor.GDI32(?,?), ref: 00C275DB
SetBkColor.GDI32(?,?), ref: 00C275E5

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: e732d61d8ba2a612f85ad70029a2eb888ab0da1018e4c902eac144dcfb7c08e0
Instruction ID: 8bf4ca1c2fc3db4addeb95c166f61cecdb7e4d0499d2be0412a36bcd3d6ef7ee
Opcode Fuzzy Hash: e732d61d8ba2a612f85ad70029a2eb888ab0da1018e4c902eac144dcfb7c08e0
Instruction Fuzzy Hash: 5B616F72900218AFDB119FA4DC89BAEBFB9EF08320F104225F911AB6A1D7749941DF90

Function 00C20FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00C21128
GetDesktopWindow.USER32 ref: 00C2113D
GetWindowRect.USER32(00000000), ref: 00C21144
GetWindowLongW.USER32(?,000000F0), ref: 00C21199
DestroyWindow.USER32(?), ref: 00C211B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00C211ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00C2120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00C2121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00C21232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00C21245
IsWindowVisible.USER32(00000000), ref: 00C212A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00C212BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00C212D0
GetWindowRect.USER32(00000000,?), ref: 00C212E8
MonitorFromPoint.USER32(?,?,00000002), ref: 00C2130E
GetMonitorInfoW.USER32(00000000,?), ref: 00C21328
CopyRect.USER32(?,?), ref: 00C2133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 00C213AA

Strings

tooltips_class32, xrefs: 00C211E6
0, xrefs: 00C210D3
(, xrefs: 00C2131B

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: f6259a65920a76486cfeca2d07690e5c20a8bbe44ccabc0bd923074305f66c37
Instruction ID: 8681c79312dabea3c8ab53693c8af9468dd04bf45dc6bc77197e79befae44b88
Opcode Fuzzy Hash: f6259a65920a76486cfeca2d07690e5c20a8bbe44ccabc0bd923074305f66c37
Instruction Fuzzy Hash: C5B1A971608350AFDB10DF64D884B6EBBE5FF98350F04891CF9999B2A1CB31E945CB92

Function 00C20241 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00C202E5
_wcslen.LIBCMT ref: 00C2031F
_wcslen.LIBCMT ref: 00C20389
_wcslen.LIBCMT ref: 00C203F1
_wcslen.LIBCMT ref: 00C20475
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00C204C5
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00C20504

Part of subcall function 00BAF9F2: _wcslen.LIBCMT ref: 00BAF9FD

Part of subcall function 00BF223F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00BF2258
Part of subcall function 00BF223F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00BF228A

Strings

GETTEXT, xrefs: 00C203EC, 00C20407
GETSELECTEDCOUNT, xrefs: 00C20470, 00C2048B
SELECTCLEAR, xrefs: 00C2052D
FINDITEM, xrefs: 00C20627
VIEWCHANGE, xrefs: 00C20675
SELECT, xrefs: 00C20548
GETSELECTED, xrefs: 00C205E1
GETSUBITEMCOUNT, xrefs: 00C20384, 00C2039F
ISSELECTED, xrefs: 00C204DD
DESELECT, xrefs: 00C2059C
SELECTALL, xrefs: 00C20515
GETITEMCOUNT, xrefs: 00C20316, 00C20337
SELECTINVERT, xrefs: 00C2057E

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: bedef373ee9c18059b22c6947c047e818643578376d2e6f97d0730fdfe619f56
Instruction ID: 3bf6af4aa551db35da4e68429c21a09861eafa663fd6407aaa43e92b5a8b7ad9
Opcode Fuzzy Hash: bedef373ee9c18059b22c6947c047e818643578376d2e6f97d0730fdfe619f56
Instruction Fuzzy Hash: 6EE1C3312182118FCB14DF24D59193EB7E5FF98314B2445AEF8A69BBA2DB30EE45CB41

Function 00BA8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00BA8968
GetSystemMetrics.USER32(00000007), ref: 00BA8970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00BA899B
GetSystemMetrics.USER32(00000008), ref: 00BA89A3
GetSystemMetrics.USER32(00000004), ref: 00BA89C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00BA89E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00BA89F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00BA8A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00BA8A3C
GetClientRect.USER32(00000000,000000FF), ref: 00BA8A5A
GetStockObject.GDI32(00000011), ref: 00BA8A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00BA8A81

Part of subcall function 00BA912D: GetCursorPos.USER32(?), ref: 00BA9141
Part of subcall function 00BA912D: ScreenToClient.USER32(00000000,?), ref: 00BA915E
Part of subcall function 00BA912D: GetAsyncKeyState.USER32(00000001), ref: 00BA9183
Part of subcall function 00BA912D: GetAsyncKeyState.USER32(00000002), ref: 00BA919D

SetTimer.USER32(00000000,00000000,00000028,00BA90FC), ref: 00BA8AA8

Strings

AutoIt v3 GUI, xrefs: 00BA8A20

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: fb8aa8191d21d112a5c0b4f4961615529eae1da0ec666d48491b11dd3b9b207b
Instruction ID: 8ed374d461e569a7b567b8472653a953c6f6e982a5bf056725cc4a70da2899dd
Opcode Fuzzy Hash: fb8aa8191d21d112a5c0b4f4961615529eae1da0ec666d48491b11dd3b9b207b
Instruction Fuzzy Hash: 7AB16971A002099FDB24DFA9CC85BAE3BF5FB48315F144269FA15E7290DB74E841CB51

Function 00BF0D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00BF1114
Part of subcall function 00BF10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00BF0B9B,?,?,?), ref: 00BF1120
Part of subcall function 00BF10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00BF0B9B,?,?,?), ref: 00BF112F
Part of subcall function 00BF10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00BF0B9B,?,?,?), ref: 00BF1136
Part of subcall function 00BF10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00BF114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00BF0DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00BF0E29
GetLengthSid.ADVAPI32(?), ref: 00BF0E40
GetAce.ADVAPI32(?,00000000,?), ref: 00BF0E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00BF0E96
GetLengthSid.ADVAPI32(?), ref: 00BF0EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00BF0EB5
HeapAlloc.KERNEL32(00000000), ref: 00BF0EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00BF0EDD
CopySid.ADVAPI32(00000000), ref: 00BF0EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00BF0F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00BF0F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00BF0F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00BF0F6E
HeapFree.KERNEL32(00000000), ref: 00BF0F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00BF0F7E
HeapFree.KERNEL32(00000000), ref: 00BF0F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00BF0F8E
HeapFree.KERNEL32(00000000), ref: 00BF0F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00BF0FA1
HeapFree.KERNEL32(00000000), ref: 00BF0FA8

Part of subcall function 00BF1193: GetProcessHeap.KERNEL32(00000008,00BF0BB1,?,00000000,?,00BF0BB1,?), ref: 00BF11A1
Part of subcall function 00BF1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00BF0BB1,?), ref: 00BF11A8
Part of subcall function 00BF1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00BF0BB1,?), ref: 00BF11B7

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 50b0bb2959ede92500b7a2abc0d82637b68b40398be7d1f1d043b76877c51696
Instruction ID: c1b821d5958f4bc1bc87e9e32748f672b90d6c3810afda4764481de6300f81ca
Opcode Fuzzy Hash: 50b0bb2959ede92500b7a2abc0d82637b68b40398be7d1f1d043b76877c51696
Instruction Fuzzy Hash: 6D714D7291020AEBDF20AFA4DC45FBEBBB8FF04310F144555FA19A71A2D771991ACB60

Function 00C1C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C1C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,00C2CC08,00000000,?,00000000,?,?), ref: 00C1C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00C1C5A4
_wcslen.LIBCMT ref: 00C1C5F4
_wcslen.LIBCMT ref: 00C1C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00C1C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00C1C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00C1C84D
RegCloseKey.ADVAPI32(?), ref: 00C1C881
RegCloseKey.ADVAPI32(00000000), ref: 00C1C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00C1C960

Strings

REG_BINARY, xrefs: 00C1C913
REG_SZ, xrefs: 00C1C644
REG_QWORD, xrefs: 00C1C8C3
REG_EXPAND_SZ, xrefs: 00C1C5CD
REG_DWORD, xrefs: 00C1C804
REG_MULTI_SZ, xrefs: 00C1C6F5

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: fc3aff81fe678dfd679d2c99e9b1e93b8e8fdf426423ed6142b4bae76d10a713
Instruction ID: c91f46d5710a6e726e119d3ca98a72666073079eaec6f14694360acfbe4a5af3
Opcode Fuzzy Hash: fc3aff81fe678dfd679d2c99e9b1e93b8e8fdf426423ed6142b4bae76d10a713
Instruction Fuzzy Hash: E7128B356182009FDB14DF14C891B6AB7E5FF89714F0588ACF85A9B3A2DB31ED41DB81

Function 00C2091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00C209C6
_wcslen.LIBCMT ref: 00C20A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00C20A54
_wcslen.LIBCMT ref: 00C20A8A
_wcslen.LIBCMT ref: 00C20B06
_wcslen.LIBCMT ref: 00C20B81

Part of subcall function 00BAF9F2: _wcslen.LIBCMT ref: 00BAF9FD

Part of subcall function 00BF2BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00BF2BFA

Strings

SELECT, xrefs: 00C20D11
GETSELECTED, xrefs: 00C20C4E
ISCHECKED, xrefs: 00C20CE1
GETTOTALCOUNT, xrefs: 00C209F2, 00C20A17
GETTEXT, xrefs: 00C20C97
COLLAPSE, xrefs: 00C20B01, 00C20B1C
UNCHECK, xrefs: 00C20D3E
EXPAND, xrefs: 00C20BF8
EXISTS, xrefs: 00C20B7C, 00C20B97
GETITEMCOUNT, xrefs: 00C20C1E
CHECK, xrefs: 00C20A85, 00C20AA0

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 741d31f15ad3c65a82c978da5f8b3c2e18fb2a2e2b598206732e8d377aa5e65f
Instruction ID: babc4ed9e0345cffd522f29035ac31e9faec7513796313e086ab88e84c74c00d
Opcode Fuzzy Hash: 741d31f15ad3c65a82c978da5f8b3c2e18fb2a2e2b598206732e8d377aa5e65f
Instruction Fuzzy Hash: 49E1B2352083118FCB14DF25D45092AB7E1FF98314F6589AEF8A65B762DB30EE49CB81

Function 00C1C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C1B6AE,?,?), ref: 00C1C9B5
_wcslen.LIBCMT ref: 00C1C9F1
_wcslen.LIBCMT ref: 00C1CA68
_wcslen.LIBCMT ref: 00C1CA9E
_wcslen.LIBCMT ref: 00C1CAF9
_wcslen.LIBCMT ref: 00C1CB2F
_wcslen.LIBCMT ref: 00C1CB7F

Strings

HKCU, xrefs: 00C1CBCE
HKEY_CURRENT_CONFIG, xrefs: 00C1CB79, 00C1CB7E
HKCC, xrefs: 00C1CBAC
HKEY_CURRENT_USER, xrefs: 00C1CBBD
HKEY_CLASSES_ROOT, xrefs: 00C1CAF3, 00C1CAF8
HKEY_USERS, xrefs: 00C1CBDF
HKEY_LOCAL_MACHINE, xrefs: 00C1CA62, 00C1CA67
HKU, xrefs: 00C1CBF0
HKCR, xrefs: 00C1CB29, 00C1CB2E
HKLM, xrefs: 00C1CA98, 00C1CA9D

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 8ddd39f0301f064808725449aae6b1f7ae8f2388f044e31e051ac5283f5f0aac
Instruction ID: b9d915b972ae963984d9fdfa5bebb0dee042fd94699e424f7021bde54d846d2a
Opcode Fuzzy Hash: 8ddd39f0301f064808725449aae6b1f7ae8f2388f044e31e051ac5283f5f0aac
Instruction Fuzzy Hash: 8371E33268412A8BCF21DE68D9D15FF3391AF66754B250268FC7697284E631CEC5E3A0

Function 00C2833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00C2835A
_wcslen.LIBCMT ref: 00C2836E
_wcslen.LIBCMT ref: 00C28391
_wcslen.LIBCMT ref: 00C283B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00C283F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00C25BF2), ref: 00C2844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00C28487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00C284CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00C28501
FreeLibrary.KERNEL32(?), ref: 00C2850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00C2851D
DestroyIcon.USER32(?,?,?,?,?,00C25BF2), ref: 00C2852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00C28549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00C28555

Strings

.exe, xrefs: 00C28388
.icl, xrefs: 00C28368
.dll, xrefs: 00C283AB

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 365ac7587b12857fb9503c7c3890dceee56cc213d12c2bc0316fc2c54cb607d0
Instruction ID: a98227e8f46ae89e712c1e939c4d674212c64973a8bd451389fc2d3042eec92f
Opcode Fuzzy Hash: 365ac7587b12857fb9503c7c3890dceee56cc213d12c2bc0316fc2c54cb607d0
Instruction Fuzzy Hash: 5D61ED71510225BFEB24DF64EC81BBE77A8BF08B11F104259F825D64D1DBB4EA84CBA0

Function 00B97778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#ce, xrefs: 00B978ED
", xrefs: 00BD5153
#comments-end, xrefs: 00B978D9
Unterminated group of comments, xrefs: 00BD528C
#OnAutoItStartRegister, xrefs: 00B97817
#notrayicon, xrefs: 00B977E7
#include, xrefs: 00B97847
#requireadmin, xrefs: 00B977FF
Bad directive syntax error, xrefs: 00BD519A
Cannot parse #include, xrefs: 00BD5279
', xrefs: 00BD5169
#pragma compile, xrefs: 00B977D3
#cs, xrefs: 00B97873, 00B978C5
#include-once, xrefs: 00B9782F
#comments-start, xrefs: 00B9785F, 00B978B1

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 8d724f01a719824974e730925dfd8829f742f1d4c360202b2596b0e856f56ba6
Instruction ID: bf6ad9c6cef17ea8dca7754afef4c14f556914f691d2248c889d45c0fe516f2e
Opcode Fuzzy Hash: 8d724f01a719824974e730925dfd8829f742f1d4c360202b2596b0e856f56ba6
Instruction Fuzzy Hash: 6781DF71694605ABDF24AFA0DC82FBE77E9EF15300F0440B5F805AA292EF74DA15C6A1

Function 00BF5A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00BF5A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00BF5A40
SetWindowTextW.USER32(?,?), ref: 00BF5A57
GetDlgItem.USER32(?,000003EA), ref: 00BF5A6C
SetWindowTextW.USER32(00000000,?), ref: 00BF5A72
GetDlgItem.USER32(?,000003E9), ref: 00BF5A82
SetWindowTextW.USER32(00000000,?), ref: 00BF5A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00BF5AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00BF5AC3
GetWindowRect.USER32(?,?), ref: 00BF5ACC
_wcslen.LIBCMT ref: 00BF5B33
SetWindowTextW.USER32(?,?), ref: 00BF5B6F
GetDesktopWindow.USER32 ref: 00BF5B75
GetWindowRect.USER32(00000000), ref: 00BF5B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00BF5BD3
GetClientRect.USER32(?,?), ref: 00BF5BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00BF5C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00BF5C2F

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: d539819176dd0025fffb454f1cfbf27df11e5519c6c167641cc2f77b31184abd
Instruction ID: 4fc16457c6378824dbc51173c685768041caeba5d32836a5140a3354a393ebaa
Opcode Fuzzy Hash: d539819176dd0025fffb454f1cfbf27df11e5519c6c167641cc2f77b31184abd
Instruction Fuzzy Hash: 4C713A31900B09AFDB30DFA8CE85BAEBBF5FF48705F104558E682A35A0D775A949CB50

Function 00BB00C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00BB00C6

Part of subcall function 00BB00ED: InitializeCriticalSectionAndSpinCount.KERNEL32(00C6070C,00000FA0,B6BCF633,?,?,?,?,00BD23B3,000000FF), ref: 00BB011C
Part of subcall function 00BB00ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00BD23B3,000000FF), ref: 00BB0127
Part of subcall function 00BB00ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00BD23B3,000000FF), ref: 00BB0138
Part of subcall function 00BB00ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00BB014E
Part of subcall function 00BB00ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00BB015C
Part of subcall function 00BB00ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00BB016A
Part of subcall function 00BB00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00BB0195
Part of subcall function 00BB00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00BB01A0

___scrt_fastfail.LIBCMT ref: 00BB00E7

Part of subcall function 00BB00A3: __onexit.LIBCMT ref: 00BB00A9

Strings

SleepConditionVariableCS, xrefs: 00BB0154
WakeAllConditionVariable, xrefs: 00BB0162
InitializeConditionVariable, xrefs: 00BB0148
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00BB0122
kernel32.dll, xrefs: 00BB0133

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: e8084637911bfb08d710ec22be3db12de3b3c89a4f36d5f208ad10eb055ccdb1
Instruction ID: 4664affe84f8b848aac0f0ecb9aaccb99f449fdfa3e2358b996aac5c50bb4f17
Opcode Fuzzy Hash: e8084637911bfb08d710ec22be3db12de3b3c89a4f36d5f208ad10eb055ccdb1
Instruction Fuzzy Hash: B021F932A647156BD7347BA8AC46BBF73E4EF05B51F10057AF801B2A91DFF098018A90

Function 00BF30F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00BF318D
_wcslen.LIBCMT ref: 00BF31F8

Strings

TEXT, xrefs: 00BF347C
REGEXPCLASS, xrefs: 00BF3255, 00BF3266
INSTANCE, xrefs: 00BF3453
NAME, xrefs: 00BF3335, 00BF3346
CLASS, xrefs: 00BF3188, 00BF31A5
CLASSNN, xrefs: 00BF31F3, 00BF3204

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: 51aea28a67143d91223270ba196447b06b74cb32b5c2f0f3a2ba0db7cbebfb36
Instruction ID: d2699fdba8e62ed4abe86f81d9bdb8691c3156d7c2d95b96e75f1321dab2f56b
Opcode Fuzzy Hash: 51aea28a67143d91223270ba196447b06b74cb32b5c2f0f3a2ba0db7cbebfb36
Instruction Fuzzy Hash: 79E19432A0051A9BCF14DFB8C4916FDBBF4FF54B50F5481A9EA56A7240DB30AE8D8790

Function 00C044C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,00C2CC08), ref: 00C04527
_wcslen.LIBCMT ref: 00C0453B
_wcslen.LIBCMT ref: 00C04599
_wcslen.LIBCMT ref: 00C045F4
_wcslen.LIBCMT ref: 00C0463F
_wcslen.LIBCMT ref: 00C046A7

Part of subcall function 00BAF9F2: _wcslen.LIBCMT ref: 00BAF9FD

GetDriveTypeW.KERNEL32(?,00C56BF0,00000061), ref: 00C04743

Strings

network, xrefs: 00C0469D, 00C046A2
cdrom, xrefs: 00C0458F, 00C04594
all, xrefs: 00C04531, 00C04536
fixed, xrefs: 00C04635, 00C0463A
removable, xrefs: 00C045EA, 00C045EF
unknown, xrefs: 00C04708
ramdisk, xrefs: 00C046F1

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: e904adec783ade80955d4f8e133c10423befe7c0a506ceb1902ab404cd74f21c
Instruction ID: df2f27bd4efb94d784b0724cca97747938fcc9ae398a09282af5aee5478ddade
Opcode Fuzzy Hash: e904adec783ade80955d4f8e133c10423befe7c0a506ceb1902ab404cd74f21c
Instruction Fuzzy Hash: 5FB1D2B16083029FC718DF28C890A7BB7E5AFA5750F50492DF6A6C72D1E731DA44CB52

Function 00C1AFF9 Relevance: 24.4, APIs: 16, Instructions: 418processCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00C1B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00C1B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00C1B1D4
_wcslen.LIBCMT ref: 00C1B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00C1B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00C1B236
_wcslen.LIBCMT ref: 00C1B332

Part of subcall function 00C005A7: GetStdHandle.KERNEL32(000000F6), ref: 00C005C6

_wcslen.LIBCMT ref: 00C1B34B
_wcslen.LIBCMT ref: 00C1B366
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00C1B3B6
GetLastError.KERNEL32(00000000), ref: 00C1B407
CloseHandle.KERNEL32(?), ref: 00C1B439
CloseHandle.KERNEL32(00000000), ref: 00C1B44A
CloseHandle.KERNEL32(00000000), ref: 00C1B45C
CloseHandle.KERNEL32(00000000), ref: 00C1B46E
CloseHandle.KERNEL32(?), ref: 00C1B4E3

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: f40560cd5bafa281c322367517a0302776a4c12ae56a4f02a3ec88b46cf1a34c
Instruction ID: 93a050df4b2c8fd40504d1ed102c533670ca6b12120973ad45a2e1c73b0861a3
Opcode Fuzzy Hash: f40560cd5bafa281c322367517a0302776a4c12ae56a4f02a3ec88b46cf1a34c
Instruction Fuzzy Hash: EBF19D715083409FCB14EF24C891BAEBBE1AF86310F14899DF4999B2A2DB31ED44DF52

Function 00B9326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00C61990), ref: 00BD2F8D
GetMenuItemCount.USER32(00C61990), ref: 00BD303D
GetCursorPos.USER32(?), ref: 00BD3081
SetForegroundWindow.USER32(00000000), ref: 00BD308A
TrackPopupMenuEx.USER32(00C61990,00000000,?,00000000,00000000,00000000), ref: 00BD309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00BD30A9

Strings

0, xrefs: 00B9327D

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 978dee74dcac552e8680a84970ed48d80e30a918b0966d5143d99aaad7e91ede
Instruction ID: f55f4025339dbd13fa540c7a2d5b1e8e45891e2c943eb941fc2d97eb2a4e724c
Opcode Fuzzy Hash: 978dee74dcac552e8680a84970ed48d80e30a918b0966d5143d99aaad7e91ede
Instruction Fuzzy Hash: AD710631644245BEEB218F24CC89FAEFFE4FF05724F2402A6F5146A2E1D7B1A910DB90

Function 00C26CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00C26DEB

Part of subcall function 00B96B57: _wcslen.LIBCMT ref: 00B96B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00C26E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00C26E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00C26E94
DestroyWindow.USER32(?), ref: 00C26EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00B90000,00000000), ref: 00C26EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00C26EFD
GetDesktopWindow.USER32 ref: 00C26F16
GetWindowRect.USER32(00000000), ref: 00C26F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00C26F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00C26F4D

Part of subcall function 00BA9944: GetWindowLongW.USER32(?,000000EB), ref: 00BA9952

Strings

tooltips_class32, xrefs: 00C26E58, 00C26EDD
0, xrefs: 00C26D98

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 804d8280c9004a2fe4f4c1e1809a683e6258f54ae8c58d6a79a98954b2e45282
Instruction ID: ff3b26fffd4848922b3f56462345ee00a91c5ca7f43ea7057217e96350e33bd0
Opcode Fuzzy Hash: 804d8280c9004a2fe4f4c1e1809a683e6258f54ae8c58d6a79a98954b2e45282
Instruction Fuzzy Hash: 83716774104244AFDB21CF58EC84FAABBF9FB89304F18041DF99997661C770AA06CF21

Function 00C2911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00BA9BB2

DragQueryPoint.SHELL32(?,?), ref: 00C29147

Part of subcall function 00C27674: ClientToScreen.USER32(?,?), ref: 00C2769A
Part of subcall function 00C27674: GetWindowRect.USER32(?,?), ref: 00C27710
Part of subcall function 00C27674: PtInRect.USER32(?,?,00C28B89), ref: 00C27720

SendMessageW.USER32(?,000000B0,?,?), ref: 00C291B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00C291BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00C291DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00C29225
SendMessageW.USER32(?,000000B0,?,?), ref: 00C2923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00C29255
SendMessageW.USER32(?,000000B1,?,?), ref: 00C29277
DragFinish.SHELL32(?), ref: 00C2927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00C29371

Strings

@GUI_DRAGID, xrefs: 00C292E9
@GUI_DROPID, xrefs: 00C2929E
@GUI_DRAGFILE, xrefs: 00C29320

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: 1cfbff4fdc3a464cdff6c05693e9948b75d7fd54c1fde8972c2c9de8b99347e1
Instruction ID: 28f7468c97a48ebb4b70673779589648bdb9bbe14cbe442129f62fff63aca9fb
Opcode Fuzzy Hash: 1cfbff4fdc3a464cdff6c05693e9948b75d7fd54c1fde8972c2c9de8b99347e1
Instruction Fuzzy Hash: F6616C71108301AFC711EF64DC85EAFBBE8EF89750F400A6EF595931A1DB709A49CB62

Function 00C0C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00C0C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00C0C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00C0C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00C0C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00C0C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00C0C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00C0C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00C0C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00C0C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00C0C5F0
InternetCloseHandle.WININET(00000000), ref: 00C0C5FB

Strings

, xrefs: 00C0C575

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 40ce148013a1c07462eb8b964f0b8c1dff65697bb920ea9194fc0caf0dee956f
Instruction ID: b749b641102367c849470e205f9f8ad2bd6dccdfdd1967de178a1b250a8aac72
Opcode Fuzzy Hash: 40ce148013a1c07462eb8b964f0b8c1dff65697bb920ea9194fc0caf0dee956f
Instruction Fuzzy Hash: 7D514AB4500604AFDB218FA1CDC8BAF7BBCFB08754F004519F95596690DB34EA45EBA0

Function 00C2856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00000000,?,000000EC), ref: 00C28592
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00C285A2
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00C285AD
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00C285BA
GlobalLock.KERNEL32(00000000), ref: 00C285C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00C285D7
GlobalUnlock.KERNEL32(00000000), ref: 00C285E0
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00C285E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,000000F0,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00C285F8
OleLoadPicture.OLEAUT32(000000F0,00000000,00000000,00C2FC38,?), ref: 00C28611
GlobalFree.KERNEL32(00000000), ref: 00C28621
GetObjectW.GDI32(?,00000018,?), ref: 00C28641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00C28671
DeleteObject.GDI32(?), ref: 00C28699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00C286AF

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 55ff38605366c37d70a07ed1dd394a2f3f8492e6d76af66efb6bcb9b482c27ab
Instruction ID: c025fc93925b52d5f1418920fc69a33e898050d0235e8cd247c629b17186a8a6
Opcode Fuzzy Hash: 55ff38605366c37d70a07ed1dd394a2f3f8492e6d76af66efb6bcb9b482c27ab
Instruction Fuzzy Hash: 9C412A75601214EFDB21DFA5DC88FAE7BB8EF89711F104059F915E7660DB30AA06CB60

Function 00C014BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00C01502
VariantCopy.OLEAUT32(?,?), ref: 00C0150B
VariantClear.OLEAUT32(?), ref: 00C01517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00C015FB
VarR8FromDec.OLEAUT32(?,?), ref: 00C01657
VariantInit.OLEAUT32(?), ref: 00C01708
SysFreeString.OLEAUT32(?), ref: 00C0178C
VariantClear.OLEAUT32(?), ref: 00C017D8
VariantClear.OLEAUT32(?), ref: 00C017E7
VariantInit.OLEAUT32(00000000), ref: 00C01823

Strings

Default, xrefs: 00C016AF
%4d%02d%02d%02d%02d%02d, xrefs: 00C01625

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 6f65a1ec756a328404895540d91e7e89f06fb4335a46a011c7ff22a5549ff244
Instruction ID: bc3e08542857b54d473bd9945ae4e5ad91439f71d2a44c50f7148060d1766b24
Opcode Fuzzy Hash: 6f65a1ec756a328404895540d91e7e89f06fb4335a46a011c7ff22a5549ff244
Instruction Fuzzy Hash: 7BD1CE31A08519DBDB10AF66D885B7DF7F5BF45700F1880AAE846AF1C0DB30E945DBA1

Function 00C1B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00B99CB3: _wcslen.LIBCMT ref: 00B99CBD

Part of subcall function 00C1C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C1B6AE,?,?), ref: 00C1C9B5
Part of subcall function 00C1C998: _wcslen.LIBCMT ref: 00C1C9F1
Part of subcall function 00C1C998: _wcslen.LIBCMT ref: 00C1CA68
Part of subcall function 00C1C998: _wcslen.LIBCMT ref: 00C1CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C1B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00C1B772
RegDeleteValueW.ADVAPI32(?,?), ref: 00C1B80A
RegCloseKey.ADVAPI32(?), ref: 00C1B87E
RegCloseKey.ADVAPI32(?), ref: 00C1B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 00C1B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00C1B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 00C1B922
FreeLibrary.KERNEL32(00000000), ref: 00C1B983
RegCloseKey.ADVAPI32(00000000), ref: 00C1B994

Strings

advapi32.dll, xrefs: 00C1B8ED
RegDeleteKeyExW, xrefs: 00C1B8FE

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 0303323f994fbdffdf35e11e10ebe52ada8f9769502a64fa8b1ec4cf58611d94
Instruction ID: 302e717c8437e04163f57723605f456ff7dda15cc98882570373c37072ad28f2
Opcode Fuzzy Hash: 0303323f994fbdffdf35e11e10ebe52ada8f9769502a64fa8b1ec4cf58611d94
Instruction Fuzzy Hash: BBC18D31208201AFD714DF24C495F6ABBE5BF85318F14859CF4AA4B2A2CB71ED86DF91

Function 00C1255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00C125D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00C125E8
CreateCompatibleDC.GDI32(?), ref: 00C125F4
SelectObject.GDI32(00000000,?), ref: 00C12601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00C1266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00C126AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00C126D0
SelectObject.GDI32(?,?), ref: 00C126D8
DeleteObject.GDI32(?), ref: 00C126E1
DeleteDC.GDI32(?), ref: 00C126E8
ReleaseDC.USER32(00000000,?), ref: 00C126F3

Strings

(, xrefs: 00C1268D

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 2b09878e1433b32ad3cef622ba5092d2c1dac09e3c5f00abe1f1778981bd112e
Instruction ID: cf0f9e6795b0a25ca0e71f9d9ab526db1ef00724f9a1ef1352636d47758ad2ef
Opcode Fuzzy Hash: 2b09878e1433b32ad3cef622ba5092d2c1dac09e3c5f00abe1f1778981bd112e
Instruction Fuzzy Hash: 4661E175D00219EFCF14CFA8D885AAEBBF6FF48310F208529E955A7250D770A951DFA0

Function 00BCDA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00BCDAA1

Part of subcall function 00BCD63C: _free.LIBCMT ref: 00BCD659
Part of subcall function 00BCD63C: _free.LIBCMT ref: 00BCD66B
Part of subcall function 00BCD63C: _free.LIBCMT ref: 00BCD67D
Part of subcall function 00BCD63C: _free.LIBCMT ref: 00BCD68F
Part of subcall function 00BCD63C: _free.LIBCMT ref: 00BCD6A1
Part of subcall function 00BCD63C: _free.LIBCMT ref: 00BCD6B3
Part of subcall function 00BCD63C: _free.LIBCMT ref: 00BCD6C5
Part of subcall function 00BCD63C: _free.LIBCMT ref: 00BCD6D7
Part of subcall function 00BCD63C: _free.LIBCMT ref: 00BCD6E9
Part of subcall function 00BCD63C: _free.LIBCMT ref: 00BCD6FB
Part of subcall function 00BCD63C: _free.LIBCMT ref: 00BCD70D
Part of subcall function 00BCD63C: _free.LIBCMT ref: 00BCD71F
Part of subcall function 00BCD63C: _free.LIBCMT ref: 00BCD731

_free.LIBCMT ref: 00BCDA96

Part of subcall function 00BC29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00BCD7D1,00000000,00000000,00000000,00000000,?,00BCD7F8,00000000,00000007,00000000,?,00BCDBF5,00000000), ref: 00BC29DE
Part of subcall function 00BC29C8: GetLastError.KERNEL32(00000000,?,00BCD7D1,00000000,00000000,00000000,00000000,?,00BCD7F8,00000000,00000007,00000000,?,00BCDBF5,00000000,00000000), ref: 00BC29F0

_free.LIBCMT ref: 00BCDAB8
_free.LIBCMT ref: 00BCDACD
_free.LIBCMT ref: 00BCDAD8
_free.LIBCMT ref: 00BCDAFA
_free.LIBCMT ref: 00BCDB0D
_free.LIBCMT ref: 00BCDB1B
_free.LIBCMT ref: 00BCDB26
_free.LIBCMT ref: 00BCDB5E
_free.LIBCMT ref: 00BCDB65
_free.LIBCMT ref: 00BCDB82
_free.LIBCMT ref: 00BCDB9A

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: f260df6e992a66283ab6fd0ad5fd8babe06d98a4c199615df65f564b9b3dc7ff
Instruction ID: c5196cba14ae1c08ce96667cfb7457aaea2dc32b8209a725478a6dd5b784d3c1
Opcode Fuzzy Hash: f260df6e992a66283ab6fd0ad5fd8babe06d98a4c199615df65f564b9b3dc7ff
Instruction Fuzzy Hash: A53136366047059FEB22AB39E845F5AB7E9FF04311F1544BDF489D72A1DA71AC80CB24

Function 00BF365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00BF369C
_wcslen.LIBCMT ref: 00BF36A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00BF3797
GetClassNameW.USER32(?,?,00000400), ref: 00BF380C
GetDlgCtrlID.USER32(?), ref: 00BF385D
GetWindowRect.USER32(?,?), ref: 00BF3882
GetParent.USER32(?), ref: 00BF38A0
ScreenToClient.USER32(00000000), ref: 00BF38A7
GetClassNameW.USER32(?,?,00000100), ref: 00BF3921
GetWindowTextW.USER32(?,?,00000400), ref: 00BF395D

Strings

%s%u, xrefs: 00BF3734

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: 672fecac3a862330a5e84b9e3370a23214419d09acb9a145c820d1830b0cf2a2
Instruction ID: 2c217312f7f345256d03d92a3fec5456fc31f949d9c3ad40aefea3c7f8111c11
Opcode Fuzzy Hash: 672fecac3a862330a5e84b9e3370a23214419d09acb9a145c820d1830b0cf2a2
Instruction Fuzzy Hash: 3F91917120460AAFD715DF24C885FBAF7E8FF44750F008569FA9AC3190DB74AA49CB91

Function 00BF4954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00BF4994
GetWindowTextW.USER32(?,?,00000400), ref: 00BF49DA
_wcslen.LIBCMT ref: 00BF49EB
CharUpperBuffW.USER32(?,00000000), ref: 00BF49F7
_wcsstr.LIBVCRUNTIME ref: 00BF4A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00BF4A64
GetWindowTextW.USER32(?,?,00000400), ref: 00BF4A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00BF4AE6
GetClassNameW.USER32(?,?,00000400), ref: 00BF4B20
GetWindowRect.USER32(?,?), ref: 00BF4B8B

Strings

ThumbnailClass, xrefs: 00BF4A6F, 00BF4AF1

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: ac9b1899c1203985c798817d497d76a48160a61766017a35c41020c300f71144
Instruction ID: d1f11494bfa6779794f446be6de2b0d3be3308a884e8981e379105d614c1e6e5
Opcode Fuzzy Hash: ac9b1899c1203985c798817d497d76a48160a61766017a35c41020c300f71144
Instruction Fuzzy Hash: 47918B311082099FDB14CF14C985BBBB7E8EF84314F0484A9FE859B196DB70ED49CBA1

Function 00C28D0E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00BA9BB2

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00C28D5A
GetFocus.USER32 ref: 00C28D6A
GetDlgCtrlID.USER32(00000000), ref: 00C28D75
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?,?,?,?), ref: 00C28E1D
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00C28ECF
GetMenuItemCount.USER32(?), ref: 00C28EEC
GetMenuItemID.USER32(?,00000000), ref: 00C28EFC
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00C28F2E
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00C28F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00C28FA1

Strings

0, xrefs: 00C28E9F

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0
API String ID: 1026556194-4108050209
Opcode ID: 3cc2bf9f467c42d338e353472be7d54feb29663c629db7996a24fc331b36c782
Instruction ID: f7a74a8adc503d615f132ecd9eaa415de7c16a6524cad240365afde53d51f742
Opcode Fuzzy Hash: 3cc2bf9f467c42d338e353472be7d54feb29663c629db7996a24fc331b36c782
Instruction Fuzzy Hash: 1581D1715093219FDB20CF14E984AAF7BE9FF88314F040919F99497A91DB70DA09DBA1

Function 00BFDC0E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00BFDC20
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00BFDC46
_wcslen.LIBCMT ref: 00BFDC50
_wcsstr.LIBVCRUNTIME ref: 00BFDCA0
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00BFDCBC

Strings

04090000, xrefs: 00BFDCF2
%u.%u.%u.%u, xrefs: 00BFDD9A
\VarFileInfo\Translation, xrefs: 00BFDCB4
DefaultLangCodepage, xrefs: 00BFDD1F
StringFileInfo\, xrefs: 00BFDC8F

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 1939486746-1459072770
Opcode ID: 3a80c2d7f1a8f94ea1fa51bad3d9d06c25fad655f643d081d72cce8c5b642840
Instruction ID: e72e69ddf67a1151d85933bd84211a993e449f6f37c0574f735337eeae62646a
Opcode Fuzzy Hash: 3a80c2d7f1a8f94ea1fa51bad3d9d06c25fad655f643d081d72cce8c5b642840
Instruction Fuzzy Hash: 0F4102369442057BEB14A7649C83EFF77ECEF56710F5000B9FA00A7182EBB4990597A9

Function 00C1CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00C1CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00C1CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00C1CD48

Part of subcall function 00C1CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00C1CCAA
Part of subcall function 00C1CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00C1CCBD
Part of subcall function 00C1CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00C1CCCF
Part of subcall function 00C1CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00C1CD05
Part of subcall function 00C1CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00C1CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 00C1CCF3

Strings

advapi32.dll, xrefs: 00C1CCB8
RegDeleteKeyExW, xrefs: 00C1CCC9

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 1871f73aee693ea6e0482ee76eedf477362940eee9c5bee8faa75330a6aa2d06
Instruction ID: c2b86226828ce7e68f114ec5e1b6ff637a39b871f84c4c5f506ebb1a0b87718a
Opcode Fuzzy Hash: 1871f73aee693ea6e0482ee76eedf477362940eee9c5bee8faa75330a6aa2d06
Instruction Fuzzy Hash: 2D317A71941129BBDB209B55ECC8FFFBB7CEF06740F000165F916E2640DA749E86EAA0

Function 00C03D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00C03D40
_wcslen.LIBCMT ref: 00C03D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00C03D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00C03DBE
RemoveDirectoryW.KERNEL32(?), ref: 00C03DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00C03E55
CloseHandle.KERNEL32(00000000), ref: 00C03E60
CloseHandle.KERNEL32(00000000), ref: 00C03E6B

Strings

\??\%s, xrefs: 00C03D5B
\, xrefs: 00C03D77
:, xrefs: 00C03D82

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: 3f95dca5d7d9ba7cdde9ef9e7898c31f6d958b4171d288a1f7788c809ecec371
Instruction ID: a5ddf12b891dd18eac5d2ef7b892c4bd62081c0827e192602d86b206f15ec4eb
Opcode Fuzzy Hash: 3f95dca5d7d9ba7cdde9ef9e7898c31f6d958b4171d288a1f7788c809ecec371
Instruction Fuzzy Hash: 5F31A175A20249ABDB219BA0DC89FEF37BCEF88710F1041B6F515D61A0EB749745CB24

Function 00BFE6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00BFE6B4

Part of subcall function 00BAE551: timeGetTime.WINMM(?,?,00BFE6D4), ref: 00BAE555

Sleep.KERNEL32(0000000A), ref: 00BFE6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 00BFE705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00BFE727
SetActiveWindow.USER32 ref: 00BFE746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00BFE754
SendMessageW.USER32(00000010,00000000,00000000), ref: 00BFE773
Sleep.KERNEL32(000000FA), ref: 00BFE77E
IsWindow.USER32 ref: 00BFE78A
EndDialog.USER32(00000000), ref: 00BFE79B

Strings

BUTTON, xrefs: 00BFE719

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: eb0dd3aac2c8ff3285a36a93186a0e0619c6bdd04ad93d2dd4a29fa227d6eb97
Instruction ID: 07b2eec794906c034d86d4e6d0401b46913411e76aaa3f72a0dec1376b386dea
Opcode Fuzzy Hash: eb0dd3aac2c8ff3285a36a93186a0e0619c6bdd04ad93d2dd4a29fa227d6eb97
Instruction Fuzzy Hash: 92219270210A08AFEB206F66ECCDB3D3BA9F754749B040465FA22835B1DBB1DC199B24

Function 00BFE9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00B99CB3: _wcslen.LIBCMT ref: 00B99CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00BFEA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00BFEA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00BFEA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00BFEA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00BFEAA7

Strings

close PlayMe, xrefs: 00BFEA6E, 00BFEA9B
play PlayMe, xrefs: 00BFEAA2
open , xrefs: 00BFEA0C
status PlayMe mode, xrefs: 00BFEA58
alias PlayMe, xrefs: 00BFEA36
play PlayMe wait, xrefs: 00BFEA91

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 877fbfbe0539f79c2efe2f9b31c16d93d83217d80e4deb9d70165d81090f0886
Instruction ID: 9de08610f6bdad633028d52ce1d8a4d5ff8b54c4b99e604c113920ec1aa497d0
Opcode Fuzzy Hash: 877fbfbe0539f79c2efe2f9b31c16d93d83217d80e4deb9d70165d81090f0886
Instruction Fuzzy Hash: 8C115175A902197DDB20A7A5DC4AEFFAAFCEBD1F01F400579B911A30E1EAB04949C5B0

Function 00BF5CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00BF5CE2
GetWindowRect.USER32(00000000,?), ref: 00BF5CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00BF5D59
GetDlgItem.USER32(?,00000002), ref: 00BF5D69
GetWindowRect.USER32(00000000,?), ref: 00BF5D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00BF5DCF
GetDlgItem.USER32(?,000003E9), ref: 00BF5DDD
GetWindowRect.USER32(00000000,?), ref: 00BF5DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00BF5E31
GetDlgItem.USER32(?,000003EA), ref: 00BF5E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00BF5E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00BF5E67

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 6b94eb9b64df10e54091e90627ea65c574a12a525df08b863608249d2297fe3c
Instruction ID: 75af86844b3fa1ff09c296c22cf4900783f0592f97fb08a971fc1f824650bdf7
Opcode Fuzzy Hash: 6b94eb9b64df10e54091e90627ea65c574a12a525df08b863608249d2297fe3c
Instruction Fuzzy Hash: 28512E74A10609AFDB28CF68CD89BAEBBF5FB48300F108169F615E7690D7709E05CB50

Function 00BA8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00BA8BE8,?,00000000,?,?,?,?,00BA8BBA,00000000,?), ref: 00BA8FC5

DestroyWindow.USER32(?), ref: 00BA8C81
KillTimer.USER32(00000000,?,?,?,?,00BA8BBA,00000000,?), ref: 00BA8D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00BE6973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00BA8BBA,00000000,?), ref: 00BE69A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00BA8BBA,00000000,?), ref: 00BE69B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00BA8BBA,00000000), ref: 00BE69D4
DeleteObject.GDI32(00000000), ref: 00BE69E6

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 1fe5f49bf84223bc1c205290914726e7562924f7c51ab481696b9cf259753264
Instruction ID: 953c48b2eff49b9fb7f0881936b53b23cf43adbdb262b2c0c2f1c91334b4aaab
Opcode Fuzzy Hash: 1fe5f49bf84223bc1c205290914726e7562924f7c51ab481696b9cf259753264
Instruction Fuzzy Hash: E461A930406640DFCB359F16C988B2DB7F1FB56362F1845ACE4429B9A0DBB5A891CF90

Function 00BA9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00BA9944: GetWindowLongW.USER32(?,000000EB), ref: 00BA9952

GetSysColor.USER32(0000000F), ref: 00BA9862

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 13b2b7cc3e676a7962731953950eef8d8f0e49a456215fd6d3f8d38d95b56082
Instruction ID: f5f192f43ba374db49637eb89f5fbb846919cce2e051e3d9e68d95178134465c
Opcode Fuzzy Hash: 13b2b7cc3e676a7962731953950eef8d8f0e49a456215fd6d3f8d38d95b56082
Instruction Fuzzy Hash: 4A418D31148640AADB309B399C85BBE3BE5EB17361F144695E9B28B1E1C7799C42EB10

Function 00BF96E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,00BDF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00BF9717
LoadStringW.USER32(00000000,?,00BDF7F8,00000001), ref: 00BF9720

Part of subcall function 00B99CB3: _wcslen.LIBCMT ref: 00B99CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00BDF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00BF9742
LoadStringW.USER32(00000000,?,00BDF7F8,00000001), ref: 00BF9745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00BF9866

Strings

Line %d:, xrefs: 00BF97A0
Error: , xrefs: 00BF981D
Line %d (File "%s"):, xrefs: 00BF978F
%s (%d) : ==> %s: %s %s, xrefs: 00BF984A
^ ERROR, xrefs: 00BF97FB

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 539e8f7529543e4e8d00437ff53ad6beda03368c6f267b808bee93f666145cb7
Instruction ID: 1de2c3da2ba17839eca5e043671ea32799f2a89a9ffcd22ccbcd5c878eea2605
Opcode Fuzzy Hash: 539e8f7529543e4e8d00437ff53ad6beda03368c6f267b808bee93f666145cb7
Instruction Fuzzy Hash: D2411A72804209AACF14EBE4DD86EFEB7B8AF15740F5040B9F60573092EB656F49CB61

Function 00C13C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C13C5C
CoInitialize.OLE32(00000000), ref: 00C13C8A
CoUninitialize.OLE32 ref: 00C13C94
_wcslen.LIBCMT ref: 00C13D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00C13DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00C13ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00C13F0E
CoGetObject.OLE32(?,00000000,00C2FB98,?), ref: 00C13F2D
SetErrorMode.KERNEL32(00000000), ref: 00C13F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00C13FC4
VariantClear.OLEAUT32(?), ref: 00C13FD8

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 497195daea1bf4e70389a219d8b91173fcb27e7e0b017f9a26d43c03bb881007
Instruction ID: d8215162291a7a7fa1700bfddb9a774b3dd61d7f9730fe2a1d8d1b7ff0a0fb56
Opcode Fuzzy Hash: 497195daea1bf4e70389a219d8b91173fcb27e7e0b017f9a26d43c03bb881007
Instruction Fuzzy Hash: 7DC168716083459FD700DF68C88496BB7E9FF8A748F00496DF98A9B250D730EE86DB52

Function 00C07A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00C07AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00C07B8F
SHGetDesktopFolder.SHELL32(?), ref: 00C07BA3
CoCreateInstance.OLE32(00C2FD08,00000000,00000001,00C56E6C,?), ref: 00C07BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00C07C74
CoTaskMemFree.OLE32(?,?), ref: 00C07CCC
SHBrowseForFolderW.SHELL32(?), ref: 00C07D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00C07D7A
CoTaskMemFree.OLE32(00000000), ref: 00C07D81
CoTaskMemFree.OLE32(00000000), ref: 00C07DD6
CoUninitialize.OLE32 ref: 00C07DDC

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: a88510ed08b1aa0b587c78a6e9c780afb5d5fb8a39de1e35130c05eaa6ee244b
Instruction ID: 9fdfde5f1834ee7047af36279ed040774985a56f8f5e5312ab7228c68360c73b
Opcode Fuzzy Hash: a88510ed08b1aa0b587c78a6e9c780afb5d5fb8a39de1e35130c05eaa6ee244b
Instruction Fuzzy Hash: F8C12C75A04209AFCB14DF64C888EAEBBF9FF48304B1485A9F815DB661D730EE45CB90

Function 00C2541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00C25504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00C25515
CharNextW.USER32(00000158), ref: 00C25544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00C25585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00C2559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00C255AC

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: acad9be595055620a136dfa7aa60bf7a5c20da1defc2b29e89f11f36b4c3bf24
Instruction ID: 4e3b33fbec8c6ce97aeb4f36ded5c56ae4810814f3700f2bf2ce988b949a4944
Opcode Fuzzy Hash: acad9be595055620a136dfa7aa60bf7a5c20da1defc2b29e89f11f36b4c3bf24
Instruction Fuzzy Hash: 2E61AD74900628AFDF20EF55EC84AFF7BB9EF09720F108155F925A7A90D7708A81DB60

Function 00BEFA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00BEFAAF
SafeArrayAllocData.OLEAUT32(?), ref: 00BEFB08
VariantInit.OLEAUT32(?), ref: 00BEFB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00BEFB3A
VariantCopy.OLEAUT32(?,?), ref: 00BEFB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00BEFBA1
VariantClear.OLEAUT32(?), ref: 00BEFBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 00BEFBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00BEFBCC
VariantClear.OLEAUT32(?), ref: 00BEFBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00BEFBE9

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 6acdb23913054691833feaa7937758db888328f86f2c5be4040e3ad85850a001
Instruction ID: 3af932fc5345bbb9fdc50c6733dfec2f5850338912f7323426651122e9cd485a
Opcode Fuzzy Hash: 6acdb23913054691833feaa7937758db888328f86f2c5be4040e3ad85850a001
Instruction Fuzzy Hash: E1415135A1021A9FCF10EF65DC94ABEBBF9EF48344F0080A5E915A7261D734E946CF90

Function 00BF9C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00BF9CA1
GetAsyncKeyState.USER32(000000A0), ref: 00BF9D22
GetKeyState.USER32(000000A0), ref: 00BF9D3D
GetAsyncKeyState.USER32(000000A1), ref: 00BF9D57
GetKeyState.USER32(000000A1), ref: 00BF9D6C
GetAsyncKeyState.USER32(00000011), ref: 00BF9D84
GetKeyState.USER32(00000011), ref: 00BF9D96
GetAsyncKeyState.USER32(00000012), ref: 00BF9DAE
GetKeyState.USER32(00000012), ref: 00BF9DC0
GetAsyncKeyState.USER32(0000005B), ref: 00BF9DD8
GetKeyState.USER32(0000005B), ref: 00BF9DEA

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 346a9d0e1a711b9ce90d07a71a759a9fe321528749c52c7e5d31eb529339a486
Instruction ID: a00684940e8f1b121e858c2ac6b40e7d59afaa66d806786cc4877a33fb312821
Opcode Fuzzy Hash: 346a9d0e1a711b9ce90d07a71a759a9fe321528749c52c7e5d31eb529339a486
Instruction Fuzzy Hash: C941A634504BCD69FF35966488443B9BEE0EF12344F1480EADBC6575C2DBA599CCC7A2

Function 00C1055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00C105BC
inet_addr.WSOCK32(?), ref: 00C1061C
gethostbyname.WSOCK32(?), ref: 00C10628
IcmpCreateFile.IPHLPAPI ref: 00C10636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00C106C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00C106E5
IcmpCloseHandle.IPHLPAPI(?), ref: 00C107B9
WSACleanup.WSOCK32 ref: 00C107BF

Strings

Ping, xrefs: 00C10676

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: f49069f20467b9593313673249f951e1e250701a76b085bc171cf1cb64c1d0f6
Instruction ID: d295c591d86118c0717d4f08b3e861a1144a2595cb5771f55877ee2a91cec7fc
Opcode Fuzzy Hash: f49069f20467b9593313673249f951e1e250701a76b085bc171cf1cb64c1d0f6
Instruction Fuzzy Hash: 42919C356082019FD720DF15C889F5ABBE0AF45318F2485A9F4698B6A2C7B0EDC1DFD1

Function 00C18CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00C18CF3

Part of subcall function 00BF8E54: _wcslen.LIBCMT ref: 00BF8E77

_wcslen.LIBCMT ref: 00C18D4E
_wcslen.LIBCMT ref: 00C18D9C
_wcslen.LIBCMT ref: 00C18DDC
_wcslen.LIBCMT ref: 00C18E6E

Strings

stdcall, xrefs: 00C18DD6, 00C18DDB
none, xrefs: 00C18E65, 00C18E6A
cdecl, xrefs: 00C18D48, 00C18D4D
winapi, xrefs: 00C18D96, 00C18D9B

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: f5d56f09935d4ff36984bcd94da399f54ce2c33ef34ab65dcd1ef92cab105f2d
Instruction ID: 51b58bc0675cef08cfe60d13405a8d6368547765831f3d2f0a7b9b9d76a67ed1
Opcode Fuzzy Hash: f5d56f09935d4ff36984bcd94da399f54ce2c33ef34ab65dcd1ef92cab105f2d
Instruction Fuzzy Hash: 1851A335A081169BCF14DF6CC9409FEB7E5BF66724B204269E825E72C5DB30DE88D790

Function 00C1372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00C13774
CoUninitialize.OLE32 ref: 00C1377F
CoCreateInstance.OLE32(?,00000000,00000017,00C2FB78,?), ref: 00C137D9
IIDFromString.OLE32(?,?), ref: 00C1384C
VariantInit.OLEAUT32(?), ref: 00C138E4
VariantClear.OLEAUT32(?), ref: 00C13936

Strings

Failed to create object, xrefs: 00C137E4, 00C1389A
NULL Pointer assignment, xrefs: 00C1381E
Invalid parameter, xrefs: 00C13865

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 60a8c35a62fae53d0e576801e6b7e82eec601a07c386109727e74f5f0069d42d
Instruction ID: 770816ff6c57cb2e7c84423dd03dff72a25b28dceafca1ac2dc2610e99fd057a
Opcode Fuzzy Hash: 60a8c35a62fae53d0e576801e6b7e82eec601a07c386109727e74f5f0069d42d
Instruction Fuzzy Hash: DA61B2706083419FD711DF54C888BAEB7E4EF46718F10445AF995972D1C770EE88DB92

Function 00C03388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00C033CF

Part of subcall function 00B99CB3: _wcslen.LIBCMT ref: 00B99CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00C033F0

Strings

"%s" (%d) : ==> %s:, xrefs: 00C03522
Error: , xrefs: 00C034D1
Line %d (File "%s"):, xrefs: 00C03443, 00C0345C
Incorrect parameters to object property !, xrefs: 00C034AB
"%s" (%d) : ==> %s:%s%s, xrefs: 00C03504
^ ERROR , xrefs: 00C0349E

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 049c4f359dd74ecdb830194861d0d41bfd4b2fe7589659c4e7109634b59af70b
Instruction ID: 04dbd063ede44af4d4622066e099aad9bd9d8a305a06c479e554cdd4bd766eb5
Opcode Fuzzy Hash: 049c4f359dd74ecdb830194861d0d41bfd4b2fe7589659c4e7109634b59af70b
Instruction Fuzzy Hash: 79517D31900209AADF15EBE4CD82EFEB7B8AF14741F1441B5F905721A2EB716F98DB60

Function 00BFB5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00BFB5FC
_wcslen.LIBCMT ref: 00BFB608
_wcslen.LIBCMT ref: 00BFB64D
_wcslen.LIBCMT ref: 00BFB68C
_wcslen.LIBCMT ref: 00BFB6C7

Strings

APPEND, xrefs: 00BFB6C1, 00BFB6C6
REMOVE, xrefs: 00BFB602, 00BFB607
KEYS, xrefs: 00BFB647, 00BFB64C
EXISTS, xrefs: 00BFB686, 00BFB68B

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 0ca88cf9195decaec63c81ce3dcdef832b7e4b8667572ce46636c7ccee6bfb06
Instruction ID: 1dd5c9be605dd0cc4a17decde5c327cef6554fd99f7ffa1b2f4a6cb52cea6aa8
Opcode Fuzzy Hash: 0ca88cf9195decaec63c81ce3dcdef832b7e4b8667572ce46636c7ccee6bfb06
Instruction Fuzzy Hash: 6641A632A0012AABCB106F7DC8909BEF7E5FF65794B2441A9E661D7284F731CD89C790

Function 00C05393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00C053A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00C05416
GetLastError.KERNEL32 ref: 00C05420
SetErrorMode.KERNEL32(00000000,READY), ref: 00C054A7

Strings

READY, xrefs: 00C05460, 00C05468
NOTREADY, xrefs: 00C0544B
INVALID, xrefs: 00C05459
READONLY, xrefs: 00C05452
UNKNOWN, xrefs: 00C05444

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: dfe7741c31336fcb2abdb9a231bd7ca47fef054cbe604be290687f3c36da5ad8
Instruction ID: 699e68a6f6b1819586911ccd234c01fbd5b63f04befd6d20f0d9f05ce3bc91bf
Opcode Fuzzy Hash: dfe7741c31336fcb2abdb9a231bd7ca47fef054cbe604be290687f3c36da5ad8
Instruction Fuzzy Hash: 3C319D75A006059FCB10DFA8C485BEEBBB8EB04305F548069E915CB2D2DB70DE86CF91

Function 00C23C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00C23C79
SetMenu.USER32(?,00000000), ref: 00C23C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C23D10
IsMenu.USER32(?), ref: 00C23D24
CreatePopupMenu.USER32 ref: 00C23D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00C23D5B
DrawMenuBar.USER32 ref: 00C23D63

Strings

F, xrefs: 00C23D4E
0, xrefs: 00C23C54

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 813d7820d0ea94a2456f184569d8c4bca540525322d43e277a36a64c57736b79
Instruction ID: 59029beedf726f11cb018bafd15ac4f5423262b18655185b93d451d04c3d02d6
Opcode Fuzzy Hash: 813d7820d0ea94a2456f184569d8c4bca540525322d43e277a36a64c57736b79
Instruction Fuzzy Hash: 4A418778A11219AFDB24CF64E888BAE7BB5FF49350F140028F956A7360D774EA10DF94

Function 00C23A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00C23A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00C23AA0
GetWindowLongW.USER32(?,000000F0), ref: 00C23AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00C23AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00C23B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00C23BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00C23BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00C23BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00C23BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00C23C13

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: ac8787f9020b374ea882957d6e0aafff42ca669b363221fca753e149704ccf62
Instruction ID: 3b248e23b7ae153c550259469c189349d1725558c04e47439fc66786ff481866
Opcode Fuzzy Hash: ac8787f9020b374ea882957d6e0aafff42ca669b363221fca753e149704ccf62
Instruction Fuzzy Hash: 47616975900258AFDB20DFA8DC81FEE77F8EB09710F140199FA15A72A1D774AE41DB50

Function 00BFB12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00BFB151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00BFA1E1,?,00000001), ref: 00BFB165
GetWindowThreadProcessId.USER32(00000000), ref: 00BFB16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00BFA1E1,?,00000001), ref: 00BFB17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 00BFB18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00BFA1E1,?,00000001), ref: 00BFB1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00BFA1E1,?,00000001), ref: 00BFB1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00BFA1E1,?,00000001), ref: 00BFB1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00BFA1E1,?,00000001), ref: 00BFB212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00BFA1E1,?,00000001), ref: 00BFB21D

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 3ce2b35c3ad96c836d91c1ed08f93a0f8cb2cf62ba13ddfcb4d03b353a7d6ec7
Instruction ID: 3e9fad6cbc756822a4b704e3de521f96b2015f314c427d10e22948020b22371f
Opcode Fuzzy Hash: 3ce2b35c3ad96c836d91c1ed08f93a0f8cb2cf62ba13ddfcb4d03b353a7d6ec7
Instruction Fuzzy Hash: DC316B75520208BFEB209F65DC88FBD7BA9FB61311F104055FA05D7190D7B89A498F60

Function 00BC2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BC2C94

Part of subcall function 00BC29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00BCD7D1,00000000,00000000,00000000,00000000,?,00BCD7F8,00000000,00000007,00000000,?,00BCDBF5,00000000), ref: 00BC29DE
Part of subcall function 00BC29C8: GetLastError.KERNEL32(00000000,?,00BCD7D1,00000000,00000000,00000000,00000000,?,00BCD7F8,00000000,00000007,00000000,?,00BCDBF5,00000000,00000000), ref: 00BC29F0

_free.LIBCMT ref: 00BC2CA0
_free.LIBCMT ref: 00BC2CAB
_free.LIBCMT ref: 00BC2CB6
_free.LIBCMT ref: 00BC2CC1
_free.LIBCMT ref: 00BC2CCC
_free.LIBCMT ref: 00BC2CD7
_free.LIBCMT ref: 00BC2CE2
_free.LIBCMT ref: 00BC2CED
_free.LIBCMT ref: 00BC2CFB

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 19c81468e03af758510858ad8855e8e1c433a7d1dfadbe7982bcebf9b9052770
Instruction ID: b0cb16e32b4f84fb95c9b56d9828c35b3f85410d6db251085702261860eca1d0
Opcode Fuzzy Hash: 19c81468e03af758510858ad8855e8e1c433a7d1dfadbe7982bcebf9b9052770
Instruction Fuzzy Hash: 6C117476510108AFCB02EF54D982EDD3BA5FF05350F5145A9FA889F322DA71EE509B90

Function 00B91410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00B91459
OleUninitialize.OLE32(?,00000000), ref: 00B914F8
UnregisterHotKey.USER32(?), ref: 00B916DD
DestroyWindow.USER32(?), ref: 00BD24B9
FreeLibrary.KERNEL32(?), ref: 00BD251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00BD254B

Strings

close all, xrefs: 00B91454

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 1025881c572519dec7d583a375249867fc8a7e689c64501dc3eb27671f09904b
Instruction ID: 12219f283077142913c02f17742734975bcfd854f88be45e59e0e6d08ac32865
Opcode Fuzzy Hash: 1025881c572519dec7d583a375249867fc8a7e689c64501dc3eb27671f09904b
Instruction Fuzzy Hash: 24D169316012128FCB29EF58D895A29F7E4BF25700F1546EEE44A6B361DB30EC12DF50

Function 00C07DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00C07FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00C07FC1
GetFileAttributesW.KERNEL32(?), ref: 00C07FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00C08005
SetCurrentDirectoryW.KERNEL32(?), ref: 00C08017
SetCurrentDirectoryW.KERNEL32(?), ref: 00C08060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00C080B0

Strings

*.*, xrefs: 00C08066

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 7d72086662c1eebec7bceb885cde5ed5841fd561ad2bf7feb296643d462c7fb2
Instruction ID: af27d65f77b1f3bbdd94955034293990bbb114104208f783d9a45b5d531b64b3
Opcode Fuzzy Hash: 7d72086662c1eebec7bceb885cde5ed5841fd561ad2bf7feb296643d462c7fb2
Instruction Fuzzy Hash: E181B4729082059FCB24DF15C444AAEB7D8BF84314F548D6EF8A5C7290EB35EE49CB52

Function 00B95BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00B95C7A

Part of subcall function 00B95D0A: GetClientRect.USER32(?,?), ref: 00B95D30
Part of subcall function 00B95D0A: GetWindowRect.USER32(?,?), ref: 00B95D71
Part of subcall function 00B95D0A: ScreenToClient.USER32(?,?), ref: 00B95D99

GetDC.USER32 ref: 00BD46F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00BD4708
SelectObject.GDI32(00000000,00000000), ref: 00BD4716
SelectObject.GDI32(00000000,00000000), ref: 00BD472B
ReleaseDC.USER32(?,00000000), ref: 00BD4733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00BD47C4

Strings

U, xrefs: 00BD4693

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 58ef6a625b22b31b27170045e644571f1e9497b59cb07af33d835a5b0b9c40f6
Instruction ID: 0263ad69e6e54a83e3969897dc40a749bf342c7c061cd12c04f2f21cef36b087
Opcode Fuzzy Hash: 58ef6a625b22b31b27170045e644571f1e9497b59cb07af33d835a5b0b9c40f6
Instruction Fuzzy Hash: D271AC31500205DFCF228F64C984AAABBF5FF4A361F1842AAED565A2A6E7319C41DF50

Function 00C0359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00C035E4

Part of subcall function 00B99CB3: _wcslen.LIBCMT ref: 00B99CBD

LoadStringW.USER32(00C62390,?,00000FFF,?), ref: 00C0360A

Strings

"%s" (%d) : ==> %s:, xrefs: 00C03742
Error: , xrefs: 00C036EF
Line %d (File "%s"):, xrefs: 00C0366B
^ ERROR, xrefs: 00C036C9
"%s" (%d) : ==> %s:%s%s, xrefs: 00C03724

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 254d837f4c590084ce888d2d23fa49b1c27200a553ba1b6299e762ae43d6ee85
Instruction ID: 65f60a87a65d92565039773c6318fcc8dd0e142e1859e1ad2e06303cf450ae18
Opcode Fuzzy Hash: 254d837f4c590084ce888d2d23fa49b1c27200a553ba1b6299e762ae43d6ee85
Instruction Fuzzy Hash: 29519F71800209BADF14EBA4CC82EEDBBB8EF14741F0841B9F515721A1EB711B99DFA0

Function 00C28B02 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00BA9BB2

Part of subcall function 00BA912D: GetCursorPos.USER32(?), ref: 00BA9141
Part of subcall function 00BA912D: ScreenToClient.USER32(00000000,?), ref: 00BA915E
Part of subcall function 00BA912D: GetAsyncKeyState.USER32(00000001), ref: 00BA9183
Part of subcall function 00BA912D: GetAsyncKeyState.USER32(00000002), ref: 00BA919D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?,?), ref: 00C28B6B
ImageList_EndDrag.COMCTL32 ref: 00C28B71
ReleaseCapture.USER32 ref: 00C28B77
SetWindowTextW.USER32(?,00000000), ref: 00C28C12
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00C28C25
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?,?), ref: 00C28CFF

Strings

@GUI_DROPID, xrefs: 00C28C51
@GUI_DRAGFILE, xrefs: 00C28C9A

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 9c7a918f4d37574a450cec2545fa1e7e9d2874e38036f9e09a21eb9aa5839f57
Instruction ID: 768bed810208190d1e78dfc6afed18a034029dfa97214088dd44e390049be2ec
Opcode Fuzzy Hash: 9c7a918f4d37574a450cec2545fa1e7e9d2874e38036f9e09a21eb9aa5839f57
Instruction Fuzzy Hash: 22519A70109310AFDB14DF24DC96BAE77E4FB88711F04066DF996972E1CB709A48CBA2

Function 00C0C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00C0C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00C0C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00C0C2CA
GetLastError.KERNEL32 ref: 00C0C322
SetEvent.KERNEL32(?), ref: 00C0C336
InternetCloseHandle.WININET(00000000), ref: 00C0C341

Strings

, xrefs: 00C0C2BB

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 47fe89977d842e4bf6c0c97271a4b4e85923d5ee5abf32306a742ff5920db312
Instruction ID: 4ef310b762c3fe27e7b62486f0e2ac8e930c4293a0a412ff6b3221aa4cdadc47
Opcode Fuzzy Hash: 47fe89977d842e4bf6c0c97271a4b4e85923d5ee5abf32306a742ff5920db312
Instruction Fuzzy Hash: 0D318BB1610608AFD7219FA588C8BAF7BFCEB49B44B10861EF456D2690DB34DE05DB60

Function 00BF989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00BD3AAF,?,?,Bad directive syntax error,00C2CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 00BF98BC
LoadStringW.USER32(00000000,?,00BD3AAF,?), ref: 00BF98C3

Part of subcall function 00B99CB3: _wcslen.LIBCMT ref: 00B99CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00BF9987

Strings

Line %d:, xrefs: 00BF9912
Error: , xrefs: 00BF9955
Line %d (File "%s"):, xrefs: 00BF992D
., xrefs: 00BF996D
%s (%d) : ==> %s.: %s %s, xrefs: 00BF98F1

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 93dcc03593c15e0df669973da6bdf1c5fa0b8fec83edfad76ae0cac034a921dd
Instruction ID: d90c5dcbf8bce6b719d9cd50d5f1047db19553893667c4c96048ae6e4c13d228
Opcode Fuzzy Hash: 93dcc03593c15e0df669973da6bdf1c5fa0b8fec83edfad76ae0cac034a921dd
Instruction Fuzzy Hash: 5E217E3184421EABCF11AF90CC46FFE77B5FF28701F0444AAF915620A2EB719658DB60

Function 00BF209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00BF20AB
GetClassNameW.USER32(00000000,?,00000100), ref: 00BF20C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00BF214D

Strings

list, xrefs: 00BF212F
details, xrefs: 00BF20FB
SHELLDLL_DefView, xrefs: 00BF20CC
largeicons, xrefs: 00BF20E1
smallicons, xrefs: 00BF2115

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 697d90bc6f2119587f6c4c9c788cc401a6ebaf62ed3f50dfaec1475048634d12
Instruction ID: 207518184cc83db979ebe9cc46f9c321de40645fc8f00286be95d42bf170770a
Opcode Fuzzy Hash: 697d90bc6f2119587f6c4c9c788cc401a6ebaf62ed3f50dfaec1475048634d12
Instruction Fuzzy Hash: D111EB7A58470ABAFA116320DC1BDFA77DCDB05315B2001A5FB04B60D2EBA1994E551D

Function 00BC8D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bab143d8c0679d38e63ed80b47e076ccb1250166bbc3cbce77bfc50288ea146
Instruction ID: 3a1cc1804ed215231c3be30e582331377ada46ef6a05d839763a7b2941e69001
Opcode Fuzzy Hash: 7bab143d8c0679d38e63ed80b47e076ccb1250166bbc3cbce77bfc50288ea146
Instruction Fuzzy Hash: D5C19D75A04249AFEB21DFA8D885FEDBBF0AF09310F1441DDF915A7292C7B09942CB61

Function 00BCCE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00BCCEB7
_free.LIBCMT ref: 00BCCF22
_free.LIBCMT ref: 00BCCF48
_free.LIBCMT ref: 00BCCF71
_free.LIBCMT ref: 00BCCFA9
_free.LIBCMT ref: 00BCCFDA
_free.LIBCMT ref: 00BCD01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 00BCD09C
_free.LIBCMT ref: 00BCD0B5

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 8809621080fff82a3bbadccdcaa148c6bd5b0dee73411a89637d14aa25666d0d
Instruction ID: db3ada028faad74cb58fce526c1ab2c50472d4644dc846f63fe2b3ecfe5539ca
Opcode Fuzzy Hash: 8809621080fff82a3bbadccdcaa148c6bd5b0dee73411a89637d14aa25666d0d
Instruction Fuzzy Hash: 6E610371904201AFDB21AFB89891F6E7FE9EF15320F1442FDF949E7282D6719D058790

Function 00C250D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00C25186
ShowWindow.USER32(?,00000000), ref: 00C251C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 00C251CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 00C251D1

Part of subcall function 00C26FBA: DeleteObject.GDI32(00000000), ref: 00C26FE6

GetWindowLongW.USER32(?,000000F0), ref: 00C2520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00C2521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00C2524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00C25287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00C25296

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: c2fe540b264bfc64bed729f952825d5c78e9c272be5c8dcefda35e635e1f3288
Instruction ID: 8beb03c7ee3430086f6895430aea6ce6ad063c1a0b6b70890d15bc408febe1bf
Opcode Fuzzy Hash: c2fe540b264bfc64bed729f952825d5c78e9c272be5c8dcefda35e635e1f3288
Instruction Fuzzy Hash: 0451C530A50A28FFEF309F25EC49BDE3B65FB05321F144011F62596AE0C775AA94DB50

Function 00BA8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00BE6890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00BE68A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00BE68B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00BE68D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00BE68F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00BA8874,00000000,00000000,00000000,000000FF,00000000), ref: 00BE6901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00BE691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00BA8874,00000000,00000000,00000000,000000FF,00000000), ref: 00BE692D

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 0f583e1a7e6af8e30d14c9ee1976055d036ba83201ed7b33dd8616850a248e93
Instruction ID: 635b7964eee6fb3d1a1396ca647334baf21add00fccc52701ce3ef23110386bc
Opcode Fuzzy Hash: 0f583e1a7e6af8e30d14c9ee1976055d036ba83201ed7b33dd8616850a248e93
Instruction Fuzzy Hash: D751B770600209EFDB20CF25CC85BAE3BF5FB58360F140168F902976A0DB71E990DB60

Function 00C0C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00C0C182
GetLastError.KERNEL32 ref: 00C0C195
SetEvent.KERNEL32(?), ref: 00C0C1A9

Part of subcall function 00C0C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00C0C272
Part of subcall function 00C0C253: GetLastError.KERNEL32 ref: 00C0C322
Part of subcall function 00C0C253: SetEvent.KERNEL32(?), ref: 00C0C336
Part of subcall function 00C0C253: InternetCloseHandle.WININET(00000000), ref: 00C0C341

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: bcfe865b19227dc15c94583e07be3d7e916f8d6bc6a6208396c80bc5352a0d0b
Instruction ID: ad03fe18a71e64b293ce8a890baaa028a265af47b5585b00e3749e6182607fce
Opcode Fuzzy Hash: bcfe865b19227dc15c94583e07be3d7e916f8d6bc6a6208396c80bc5352a0d0b
Instruction Fuzzy Hash: 78318E71600601EFDB259FE5DD84B6ABBF8FF18300B00461DF96682A60DB30E915EBA0

Function 00BF25A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00BF3A57
Part of subcall function 00BF3A3D: GetCurrentThreadId.KERNEL32 ref: 00BF3A5E
Part of subcall function 00BF3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00BF25B3), ref: 00BF3A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 00BF25BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00BF25DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00BF25DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 00BF25E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00BF2601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00BF2605
MapVirtualKeyW.USER32(00000025,00000000), ref: 00BF260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00BF2623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00BF2627

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 02d15912ce309c829b469a609407797c6aab4e6beeb8529d63eff9a3c1fdb995
Instruction ID: 67bd7bd4099d3cd62a5af29084a09837980a73e1faf8601a7f2568fc52e893c6
Opcode Fuzzy Hash: 02d15912ce309c829b469a609407797c6aab4e6beeb8529d63eff9a3c1fdb995
Instruction Fuzzy Hash: A901D4303A0614BBFB2067699CCAF6D3F99DF4EB12F100001F328AF0D1C9E224598A69

Function 00BF1803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00BF1449,?,?,00000000), ref: 00BF180C
HeapAlloc.KERNEL32(00000000,?,00BF1449,?,?,00000000), ref: 00BF1813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00BF1449,?,?,00000000), ref: 00BF1828
GetCurrentProcess.KERNEL32(?,00000000,?,00BF1449,?,?,00000000), ref: 00BF1830
DuplicateHandle.KERNEL32(00000000,?,00BF1449,?,?,00000000), ref: 00BF1833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00BF1449,?,?,00000000), ref: 00BF1843
GetCurrentProcess.KERNEL32(00BF1449,00000000,?,00BF1449,?,?,00000000), ref: 00BF184B
DuplicateHandle.KERNEL32(00000000,?,00BF1449,?,?,00000000), ref: 00BF184E
CreateThread.KERNEL32(00000000,00000000,00BF1874,00000000,00000000,00000000), ref: 00BF1868

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 04cd81023571ed22cb5cf925e1c8c92c753b46270a0b892101f313a89c1d2901
Instruction ID: 818289c5270633378a90656c8afbbde70ee7a888ea4e345c45445708170cb84c
Opcode Fuzzy Hash: 04cd81023571ed22cb5cf925e1c8c92c753b46270a0b892101f313a89c1d2901
Instruction Fuzzy Hash: 9D01BBB5650308BFE720ABA5DC8EF6F3BACEB89B11F104411FA05DB5A1CA709815CB60

Function 00C1A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00BFD4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 00BFD501
Part of subcall function 00BFD4DC: Process32FirstW.KERNEL32(00000000,?), ref: 00BFD50F
Part of subcall function 00BFD4DC: CloseHandle.KERNEL32(00000000), ref: 00BFD5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00C1A16D
GetLastError.KERNEL32 ref: 00C1A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00C1A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 00C1A268
GetLastError.KERNEL32(00000000), ref: 00C1A273
CloseHandle.KERNEL32(00000000), ref: 00C1A2C4

Strings

SeDebugPrivilege, xrefs: 00C1A18F

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 0e24c0b1f14938286b7ae4de81059cf1ef75010601b2ad3055b249c270a4b6eb
Instruction ID: f2294380728399f555aeead87866364e009ad502954e43394c50578b6e734c5c
Opcode Fuzzy Hash: 0e24c0b1f14938286b7ae4de81059cf1ef75010601b2ad3055b249c270a4b6eb
Instruction Fuzzy Hash: 3061C431205241AFD720DF18C494F69BBE1AF45318F54849CE46A8BBA3C772ED89DB92

Function 00C23886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00C23925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00C2393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00C23954
_wcslen.LIBCMT ref: 00C23999
SendMessageW.USER32(?,00001057,00000000,?), ref: 00C239C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00C239F4

Strings

SysListView32, xrefs: 00C238F7

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 4ebe5d05ec445a12f6e37428ea97cfc0ac7524ed46a0f6180d2eea688ff6fc07
Instruction ID: 1581467f7fd6e6796b61dea3beafa1c33b9b364c8b81a40329f04aa2c5c1854e
Opcode Fuzzy Hash: 4ebe5d05ec445a12f6e37428ea97cfc0ac7524ed46a0f6180d2eea688ff6fc07
Instruction Fuzzy Hash: 1A41C571A00228ABDF21DF64DC45BEE7BA9EF08350F100526F954E7681D7759A84CB90

Function 00BFBC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00BFBCFD
IsMenu.USER32(00000000), ref: 00BFBD1D
CreatePopupMenu.USER32 ref: 00BFBD53
GetMenuItemCount.USER32(017F5500), ref: 00BFBDA4
InsertMenuItemW.USER32(017F5500,?,00000001,00000030), ref: 00BFBDCC

Strings

2, xrefs: 00BFBD37
0, xrefs: 00BFBCA8

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 747e4562226f2b4423ceb85d6d6f99987cd819cbd538f64af9a6a8039acecc32
Instruction ID: 335fd69e19f4ef6043416cc2339c938788d9b8efa579f1f0ed92acc6642beb50
Opcode Fuzzy Hash: 747e4562226f2b4423ceb85d6d6f99987cd819cbd538f64af9a6a8039acecc32
Instruction Fuzzy Hash: 75519E74A0020D9BDB20DFA8D8C4FBEBBF4EF45314F1441A9E61197290D7709949CB52

Function 00BFC874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00BFC913

Strings

question, xrefs: 00BFC8CC
stop, xrefs: 00BFC8E4
blank, xrefs: 00BFC895
warning, xrefs: 00BFC8FC
info, xrefs: 00BFC8B4

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: f22bf4c9f0e44ca2ad125f09ceb0220ffa06f62028f912a6729664c29256cc2d
Instruction ID: bad570fa28325e93adddd12b916b46716e6a389ec5f23afe16ae9b92bcf82e9f
Opcode Fuzzy Hash: f22bf4c9f0e44ca2ad125f09ceb0220ffa06f62028f912a6729664c29256cc2d
Instruction Fuzzy Hash: 3D115E3568970EBBE7015710DDC2DFE6BDCDF15355B5040BAF600A7182D7F19E885268

Function 00BED3A2 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 00BED3AD
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00BED3BF
FreeLibrary.KERNEL32(00000000), ref: 00BED3E5
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00BED3FC

Strings

kernel32.dll, xrefs: 00BED3A8
X64, xrefs: 00BED2A8
GetSystemWow64DirectoryW, xrefs: 00BED3B9

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: GetSystemWow64DirectoryW$X64$kernel32.dll
API String ID: 582185067-2904798639
Opcode ID: 135f090891cbe544519dcb9196b28e9cd07c6162dc32cea2e03b5f47be10dfe1
Instruction ID: 28e8c76da7a23200bb17a0e5693ea245a9b2748160ccee31302619a8ea4062ce
Opcode Fuzzy Hash: 135f090891cbe544519dcb9196b28e9cd07c6162dc32cea2e03b5f47be10dfe1
Instruction Fuzzy Hash: 2AF027319066659BC3319711CCD9BAD73B4AF00B01F8480D1F602F6040DBB0CD448AA4

Function 00BFED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00BFED2A
_wcslen.LIBCMT ref: 00BFED3B
_wcslen.LIBCMT ref: 00BFED79
_wcslen.LIBCMT ref: 00BFEDAF
_wcslen.LIBCMT ref: 00BFEDDF
_wcslen.LIBCMT ref: 00BFEDEF
_wcslen.LIBCMT ref: 00BFEE2B
_wcslen.LIBCMT ref: 00BFEE5A

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: cb7468467b3c35cc5ccee23b256bc2c2608663ec61a05c54da93faa7e60201ac
Instruction ID: 362a83d023ea8ac42cd91a2ff3e991045e16dd2c73dcf460a43768490c316d3a
Opcode Fuzzy Hash: cb7468467b3c35cc5ccee23b256bc2c2608663ec61a05c54da93faa7e60201ac
Instruction Fuzzy Hash: 8841C665C1011877DB11EBF4CC8A9EFB7E8AF45310F5084A6E614E3122FB78D649C3A5

Function 00BAF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00BE682C,00000004,00000000,00000000), ref: 00BAF953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,00BE682C,00000004,00000000,00000000), ref: 00BEF3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00BE682C,00000004,00000000,00000000), ref: 00BEF454

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 3f84ed624b434b952ed85a2ce5b0013686ea72dcee736b405bf5757d809d5c1f
Instruction ID: 81d5501a7d940791206112b1c3e712f6e0ee3618830982a87fc61f513fc15110
Opcode Fuzzy Hash: 3f84ed624b434b952ed85a2ce5b0013686ea72dcee736b405bf5757d809d5c1f
Instruction Fuzzy Hash: 7841093160C682BAC7798BAA88C87BF7BE2EF57311F1844BDE04752A60C771E881C751

Function 00C22D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00C22D1B
GetDC.USER32(00000000), ref: 00C22D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00C22D2E
ReleaseDC.USER32(00000000,00000000), ref: 00C22D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00C22D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00C22D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00C25A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00C22DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00C22DE1

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 97e0589051d226b4dcf2f45dba77375200521d398bfeced641ee27f20b5b237a
Instruction ID: 69107b4df09cbdb4df01ae39226f3866c284c01d6a9fba1c174e1c237e289a74
Opcode Fuzzy Hash: 97e0589051d226b4dcf2f45dba77375200521d398bfeced641ee27f20b5b237a
Instruction Fuzzy Hash: 19319872211224BFEB218F50DC8AFEF3BA9EF09711F044065FE089A691C6759C51CBA4

Function 00BF5622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00BF5637
_memcmp.LIBVCRUNTIME ref: 00BF5659
_memcmp.LIBVCRUNTIME ref: 00BF5671
_memcmp.LIBVCRUNTIME ref: 00BF5684
_memcmp.LIBVCRUNTIME ref: 00BF569E
_memcmp.LIBVCRUNTIME ref: 00BF56B1
_memcmp.LIBVCRUNTIME ref: 00BF56C9
_memcmp.LIBVCRUNTIME ref: 00BF56E4

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: a91bee3187691954f064cef97df32b82703288373873bb00501c3fbf358efe04
Instruction ID: 09a03ddda14a7814ad6419c0b42b467773f9f4b482443481a2157148547f4177
Opcode Fuzzy Hash: a91bee3187691954f064cef97df32b82703288373873bb00501c3fbf358efe04
Instruction Fuzzy Hash: DC21C561644A1D77D6346A249D92FFA23DCEF20384F8400B4FF15DBA81F760ED1982A9

Function 00C14FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00C15007
NULL Pointer assignment, xrefs: 00C1502E, 00C15383

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: abc5b474909a980107fc8de186ecca83d6c4d704bbfb25a0c239f4285d599f42
Instruction ID: f338cce49b65cba6a7dfcfa18d376d64cca2f56728909a0b05cc4887e7044731
Opcode Fuzzy Hash: abc5b474909a980107fc8de186ecca83d6c4d704bbfb25a0c239f4285d599f42
Instruction Fuzzy Hash: 14D1B475A0060AEFDF10CF98C880BEEB7B5BF89344F148069E925AB291D770DE85DB50

Function 00BD1522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,00BD17FB,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 00BD15CE
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00BD17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00BD1651
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00BD17FB,?,00BD17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00BD16E4
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00BD17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00BD16FB

Part of subcall function 00BC3820: RtlAllocateHeap.NTDLL(00000000,?,00C61444,?,00BAFDF5,?,?,00B9A976,00000010,00C61440,00B913FC,?,00B913C6,?,00B91129), ref: 00BC3852

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,00BD17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00BD1777
__freea.LIBCMT ref: 00BD17A2
__freea.LIBCMT ref: 00BD17AE

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 94acc2d7c54be0f93cd17088f5b43f99250dfc5127ebe9f71dce4fe88eadfe7d
Instruction ID: 3b488c6dca4f4a94f8cd488146499194aa6a234ca36f2f6c48eaec7b37ffb1c5
Opcode Fuzzy Hash: 94acc2d7c54be0f93cd17088f5b43f99250dfc5127ebe9f71dce4fe88eadfe7d
Instruction Fuzzy Hash: DC91B371E00216BADB208E68D881AEEFBF5EF59714F184A9AE805E7351F739DD40C760

Function 00C14523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C14648
VariantInit.OLEAUT32(?), ref: 00C14749
VariantClear.OLEAUT32(?), ref: 00C14753
VariantClear.OLEAUT32(?), ref: 00C147B0

Strings

Null Object assignment in FOR..IN loop, xrefs: 00C145D8, 00C14706, 00C147BE
Incorrect Object type in FOR..IN loop, xrefs: 00C1472C

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: e3851d83c60f44b83abf7191a0c108eed77ca50301e3b9adf7b2ace3596d58e7
Instruction ID: 4022fa66962fd2d06c797abe4d9813345a5fd947a6c16574a883eb784fca6b84
Opcode Fuzzy Hash: e3851d83c60f44b83abf7191a0c108eed77ca50301e3b9adf7b2ace3596d58e7
Instruction Fuzzy Hash: 8F91A271A00215AFDF24CFA5C844FEEBBB8EF46714F108559F515AB280D7709985DFA0

Function 00C01187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 00C0125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00C01284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 00C012A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00C012D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00C0135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00C013C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00C01430

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 66908f1782da16d653889c8e4aebde1ff330311d7a9fa7731ec2ecfbf0fb9e5c
Instruction ID: 6881d29b594d2fe47b4fc046d6b16cf90e08594eace224b17490371d12fca434
Opcode Fuzzy Hash: 66908f1782da16d653889c8e4aebde1ff330311d7a9fa7731ec2ecfbf0fb9e5c
Instruction Fuzzy Hash: B191CE71A00219AFEB00DFA4C884BBEB7F5FF45724F294069E951EB2E1D774A941CB90

Function 00BA948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: dfa3c618c25b3bcf4eecc6337ee7026ea79145ed51025fb72e23439358b74d3f
Instruction ID: a08f7290d3590082616abde7ac733ba9cd7e7a83639b3c1d921a4701ad7e5080
Opcode Fuzzy Hash: dfa3c618c25b3bcf4eecc6337ee7026ea79145ed51025fb72e23439358b74d3f
Instruction Fuzzy Hash: C7914471D44219EFCB14CFA9C885AEEBBF8FF4A320F148089E515B7251D734AA42DB60

Function 00C13947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C1396B
CharUpperBuffW.USER32(?,?), ref: 00C13A7A
_wcslen.LIBCMT ref: 00C13A8A
VariantClear.OLEAUT32(?), ref: 00C13C1F

Part of subcall function 00C00CDF: VariantInit.OLEAUT32(00000000), ref: 00C00D1F
Part of subcall function 00C00CDF: VariantCopy.OLEAUT32(?,?), ref: 00C00D28
Part of subcall function 00C00CDF: VariantClear.OLEAUT32(?), ref: 00C00D34

Strings

Incorrect Parameter format, xrefs: 00C139A6, 00C13BA1
AUTOIT.ERROR, xrefs: 00C13A80, 00C13A85

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 9dbbd6e2651b4fc4f9b24b0d484243b2939fd73a7f18d01f261990901b6bd60e
Instruction ID: aeb212077f384805778174ab6e1848df173822ae85a2cb599ca018832493b632
Opcode Fuzzy Hash: 9dbbd6e2651b4fc4f9b24b0d484243b2939fd73a7f18d01f261990901b6bd60e
Instruction Fuzzy Hash: 57918E746083459FCB04DF64C4909AAB7E4FF89318F14896DF89997351DB30EE45DB82

Function 00C14BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00BF000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00BEFF41,80070057,?,?,?,00BF035E), ref: 00BF002B
Part of subcall function 00BF000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00BEFF41,80070057,?,?), ref: 00BF0046
Part of subcall function 00BF000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00BEFF41,80070057,?,?), ref: 00BF0054
Part of subcall function 00BF000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00BEFF41,80070057,?), ref: 00BF0064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00C14C51
_wcslen.LIBCMT ref: 00C14D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00C14DCF
CoTaskMemFree.OLE32(?), ref: 00C14DDA

Strings

NULL Pointer assignment, xrefs: 00C14E23, 00C14E52

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 41612fba3be0a14d159a5fabf8c0dcbe49ecaf26fab93d6a4e226d678cabada2
Instruction ID: a9f339ca26310278a0d6c2a662fb1810ebcbca56a762c3a0f592832efd5bcf08
Opcode Fuzzy Hash: 41612fba3be0a14d159a5fabf8c0dcbe49ecaf26fab93d6a4e226d678cabada2
Instruction Fuzzy Hash: F5912A71D0021DEFDF14DFA4D891AEEB7B9BF09310F108169E915A7291DB309A85DFA0

Function 00C220FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00C22183
GetMenuItemCount.USER32(00000000), ref: 00C221B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00C221DD
_wcslen.LIBCMT ref: 00C22213
GetMenuItemID.USER32(?,?), ref: 00C2224D
GetSubMenu.USER32(?,?), ref: 00C2225B

Part of subcall function 00BF3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00BF3A57
Part of subcall function 00BF3A3D: GetCurrentThreadId.KERNEL32 ref: 00BF3A5E
Part of subcall function 00BF3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00BF25B3), ref: 00BF3A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00C222E3

Part of subcall function 00BFE97B: Sleep.KERNEL32 ref: 00BFE9F3

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: d00d4d9848d6e3785cd37be048cabf432ad2a43ff99fe3559f871a4cce6b58a9
Instruction ID: ab3aeb6b89534e05eef7ebadfe13fa8b903c9e375212fde4279075e146622ffb
Opcode Fuzzy Hash: d00d4d9848d6e3785cd37be048cabf432ad2a43ff99fe3559f871a4cce6b58a9
Instruction Fuzzy Hash: 7271B235A00215EFCB10DFA5D881AAEB7F1EF48320F1184A9E826EB751D735EE418B90

Function 00C27E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(017F55A0), ref: 00C27F37
IsWindowEnabled.USER32(017F55A0), ref: 00C27F43
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 00C2801E
SendMessageW.USER32(017F55A0,000000B0,?,?), ref: 00C28051
IsDlgButtonChecked.USER32(?,?), ref: 00C28089
GetWindowLongW.USER32(017F55A0,000000EC), ref: 00C280AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00C280C3

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 990bb1e51c8eff99a48e3fb08bf9009741a1fef783ac37db37476041fe92c352
Instruction ID: a13ce990df17ed75d597d6ba105af579aa40c8de2636d4750dce1b512c69852b
Opcode Fuzzy Hash: 990bb1e51c8eff99a48e3fb08bf9009741a1fef783ac37db37476041fe92c352
Instruction Fuzzy Hash: 4571B03460D224AFEB30DF94E9C4FAE7BB5EF09300F140159F96593AA1CB31AA45DB20

Function 00BFAEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00BFAEF9
GetKeyboardState.USER32(?), ref: 00BFAF0E
SetKeyboardState.USER32(?), ref: 00BFAF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 00BFAF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 00BFAFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 00BFAFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00BFB020

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 2c1a6291f3f9f1981ae851a2f368923babb506f41861bb39b51c8694ca5f9f2d
Instruction ID: f41b7f06abb17b4f6180c04aa6bf2c3f66252e40758d8030aa1e75495a216f38
Opcode Fuzzy Hash: 2c1a6291f3f9f1981ae851a2f368923babb506f41861bb39b51c8694ca5f9f2d
Instruction Fuzzy Hash: 7651B4E06147D93DFB364234CC45BBA7EE99B06304F0885C9E2D99A8C2C798A8CCD751

Function 00BFACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00BFAD19
GetKeyboardState.USER32(?), ref: 00BFAD2E
SetKeyboardState.USER32(?), ref: 00BFAD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00BFADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00BFADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00BFAE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00BFAE38

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 7a638c63a224676e7ac167f52e69f67fe648db8449e2e4b59fe4101841a3f1b0
Instruction ID: 4ba0b17b3fdadadb91cfe0a3b9c31a9ffd0313cff35889563e57abc673693f30
Opcode Fuzzy Hash: 7a638c63a224676e7ac167f52e69f67fe648db8449e2e4b59fe4101841a3f1b0
Instruction Fuzzy Hash: 0551D3E15047D93DFB3A8224CC85B7ABEE9AB46300F0884D8E2D9578C2C294EC8CD752

Function 00BC542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00BD3CD6,?,?,?,?,?,?,?,?,00BC5BA3,?,?,00BD3CD6,?,?), ref: 00BC5470
__fassign.LIBCMT ref: 00BC54EB
__fassign.LIBCMT ref: 00BC5506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00BD3CD6,00000005,00000000,00000000), ref: 00BC552C
WriteFile.KERNEL32(?,00BD3CD6,00000000,00BC5BA3,00000000,?,?,?,?,?,?,?,?,?,00BC5BA3,?), ref: 00BC554B
WriteFile.KERNEL32(?,?,00000001,00BC5BA3,00000000,?,?,?,?,?,?,?,?,?,00BC5BA3,?), ref: 00BC5584

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 4358f30a991ac3c346f084c258e32c1dfd51e08c7314a36bbade3732888772c5
Instruction ID: 41fab33328469cb149b5552aaed6ff30d1b56c7d140b15be42aff347304f49b4
Opcode Fuzzy Hash: 4358f30a991ac3c346f084c258e32c1dfd51e08c7314a36bbade3732888772c5
Instruction Fuzzy Hash: 0351B571A006099FDB20CFA8D885FEEBBF5EF18300F14455EE555E7291D670AA81CB60

Function 00BB2D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00BB2D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00BB2D53
_ValidateLocalCookies.LIBCMT ref: 00BB2DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00BB2E0C
_ValidateLocalCookies.LIBCMT ref: 00BB2E61

Strings

csm, xrefs: 00BB2DF6

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 3dc68b1c62fff48ed33d1c6ba48bbe7b425a4fe7b4ed42b0ef20de3ae9efd847
Instruction ID: adbfe197067139e97f84f742061b23f7b99f05d7f31d671f90f12f124ed34c8e
Opcode Fuzzy Hash: 3dc68b1c62fff48ed33d1c6ba48bbe7b425a4fe7b4ed42b0ef20de3ae9efd847
Instruction Fuzzy Hash: EE419334A00209ABCF10DF68CC85AEEBBF5FF45324F1481A5E8156B392D7B1EA55CB91

Function 00C110B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00C1304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00C1307A
Part of subcall function 00C1304E: _wcslen.LIBCMT ref: 00C1309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00C11112
WSAGetLastError.WSOCK32 ref: 00C11121
WSAGetLastError.WSOCK32 ref: 00C111C9
closesocket.WSOCK32(00000000), ref: 00C111F9

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 34e71193165c04f9636a74cd9e124e94b787e4ff2f65f84d8adc9f2aaebc5a0c
Instruction ID: fe0f0f6c7bebd645e5c8497a2d436564b701d3fb5c700b76a5b4497ce032bc87
Opcode Fuzzy Hash: 34e71193165c04f9636a74cd9e124e94b787e4ff2f65f84d8adc9f2aaebc5a0c
Instruction Fuzzy Hash: 7341D631600204AFDB109F14C884BEDBBE9EF46324F288059FE199B291D774EE85DBE1

Function 00BFCF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00BFCF22,?), ref: 00BFDDFD

Part of subcall function 00BFDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00BFCF22,?), ref: 00BFDE16

lstrcmpiW.KERNEL32(?,?), ref: 00BFCF45
MoveFileW.KERNEL32(?,?), ref: 00BFCF7F
_wcslen.LIBCMT ref: 00BFD005
_wcslen.LIBCMT ref: 00BFD01B
SHFileOperationW.SHELL32(?), ref: 00BFD061

Strings

\*.*, xrefs: 00BFCFF3

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: aac9c87185f483bbccf3a2b1e13cbddcc64e32b3a886c5f1f0244f7c6b5699e5
Instruction ID: 2d220250545192251878ee6edd536edd69abe22b35ede4926d4c29ab27a89e6d
Opcode Fuzzy Hash: aac9c87185f483bbccf3a2b1e13cbddcc64e32b3a886c5f1f0244f7c6b5699e5
Instruction Fuzzy Hash: EE41247194521D5FDF12EBA4CA81AFDB7F9EF08340F1000E6E605E7151EA34A68DCB50

Function 00C22DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00C22E1C
GetWindowLongW.USER32(00000000,000000F0), ref: 00C22E4F
GetWindowLongW.USER32(00000000,000000F0), ref: 00C22E84
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00C22EB6
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00C22EE0
GetWindowLongW.USER32(00000000,000000F0), ref: 00C22EF1
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00C22F0B

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: a98a00ba94b1538486a5dbf820e27ce0612489b2559688bd0a7a9502342aceca
Instruction ID: f1118e5641dcce325a5a75291df76183e5021317bbed51a2e4dba01ed74376a8
Opcode Fuzzy Hash: a98a00ba94b1538486a5dbf820e27ce0612489b2559688bd0a7a9502342aceca
Instruction Fuzzy Hash: D1310730614160AFDB21CF59EC84F6937E1EB5A722F1A0164F9118F6B1CBB1AD41EF41

Function 00BF7726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00BF7769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00BF778F
SysAllocString.OLEAUT32(00000000), ref: 00BF7792
SysAllocString.OLEAUT32(?), ref: 00BF77B0
SysFreeString.OLEAUT32(?), ref: 00BF77B9
StringFromGUID2.OLE32(?,?,00000028), ref: 00BF77DE
SysAllocString.OLEAUT32(?), ref: 00BF77EC

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: bf14b676ef69dfe03d0105cf754f98a7d4f7e19647f18af0c9e79022d8e2d86e
Instruction ID: c3922882b0ca5ce88b7d1b96933c99775a2ced329b8961344bd48b9441117721
Opcode Fuzzy Hash: bf14b676ef69dfe03d0105cf754f98a7d4f7e19647f18af0c9e79022d8e2d86e
Instruction Fuzzy Hash: 9D219176618219AFDB10AFA8CC88EFF73ECEB0936471080A5FA04DB150DA709C458BA0

Function 00BF77FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00BF7842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00BF7868
SysAllocString.OLEAUT32(00000000), ref: 00BF786B
SysAllocString.OLEAUT32 ref: 00BF788C
SysFreeString.OLEAUT32 ref: 00BF7895
StringFromGUID2.OLE32(?,?,00000028), ref: 00BF78AF
SysAllocString.OLEAUT32(?), ref: 00BF78BD

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 9b017b61623651cab082482134787a9ccaf9dbfc33d4dbd1dd8d2cc6bc14a42e
Instruction ID: 58c91919384e973fe2bf8cff9d260b6b4512c1dd3cdae6c1157fd3c7838a197b
Opcode Fuzzy Hash: 9b017b61623651cab082482134787a9ccaf9dbfc33d4dbd1dd8d2cc6bc14a42e
Instruction Fuzzy Hash: A2216531608108AFDB10AFA9DCCDEBE77ECEB0976071081A5FA15CB1A1DA74DC45CB64

Function 00C004D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00C004F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00C0052E

Strings

nul, xrefs: 00C00567

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 064882ea09933d741811e3ef71521292f1c4084cfaa7d9ddd556bc07f4d9cd06
Instruction ID: bf3e6ad87fbd92a36479ad3ae5ff3254335337130461569c6582c78341eb7e86
Opcode Fuzzy Hash: 064882ea09933d741811e3ef71521292f1c4084cfaa7d9ddd556bc07f4d9cd06
Instruction Fuzzy Hash: A4218975600305ABDB208F29DC45B9E7BB4AF44724F314A29F8B1E72E0E7709A41CF24

Function 00C005A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00C005C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00C00601

Strings

nul, xrefs: 00C00639

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 3cdd04386e2fdad167e18e7f1157dbe1e6f34608445506c717cafe2157527c12
Instruction ID: 41a15f8a8f4f3ddf9d00e87a60eb565b2d2ec045bb2ed22ee3a49f058193bb32
Opcode Fuzzy Hash: 3cdd04386e2fdad167e18e7f1157dbe1e6f34608445506c717cafe2157527c12
Instruction Fuzzy Hash: 93219C35500305DBDB208F699C44B9E77A9AF85721F310A19FCB1E32E0DBB19A61CB20

Function 00C240AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B9600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00B9604C
Part of subcall function 00B9600E: GetStockObject.GDI32(00000011), ref: 00B96060
Part of subcall function 00B9600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00B9606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00C24112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00C2411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00C2412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00C24139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00C24145

Strings

Msctls_Progress32, xrefs: 00C240E3

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 8af7d1786a8d3aa6fe6c945260deb022558baba4288ca64b1a0d1ba3833df837
Instruction ID: 755df8cea8ec303fd693ce208237bb67282974b989ac53a50980b5fd87621127
Opcode Fuzzy Hash: 8af7d1786a8d3aa6fe6c945260deb022558baba4288ca64b1a0d1ba3833df837
Instruction Fuzzy Hash: 6411B6B11502297FEF218F64DC85EEB7F5DEF09798F014110FA18A2090C7729C61DBA4

Function 00BCD7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BCD7A3: _free.LIBCMT ref: 00BCD7CC

_free.LIBCMT ref: 00BCD82D

Part of subcall function 00BC29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00BCD7D1,00000000,00000000,00000000,00000000,?,00BCD7F8,00000000,00000007,00000000,?,00BCDBF5,00000000), ref: 00BC29DE
Part of subcall function 00BC29C8: GetLastError.KERNEL32(00000000,?,00BCD7D1,00000000,00000000,00000000,00000000,?,00BCD7F8,00000000,00000007,00000000,?,00BCDBF5,00000000,00000000), ref: 00BC29F0

_free.LIBCMT ref: 00BCD838
_free.LIBCMT ref: 00BCD843
_free.LIBCMT ref: 00BCD897
_free.LIBCMT ref: 00BCD8A2
_free.LIBCMT ref: 00BCD8AD
_free.LIBCMT ref: 00BCD8B8

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: ee21a4db04849bb884b43d00282d0704cdb3e9cd92275e43dac9d32a70570e54
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: E6112E75640B04AAD621BFB0CC47FCB7BDCAF04700F40587EB29DA6992DA75B9058660

Function 00BFDA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00BFDA74
LoadStringW.USER32(00000000), ref: 00BFDA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00BFDA91
LoadStringW.USER32(00000000), ref: 00BFDA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00BFDADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00BFDAB9

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: e3c37b718f3c327c836ad7cf4b7f09d9ee9e473bdfc34aec08adf9a7e9752026
Instruction ID: b823ba0f75378217d343907cbd64bfbd5b24df155e43f8c9fa85a4a2d50f782a
Opcode Fuzzy Hash: e3c37b718f3c327c836ad7cf4b7f09d9ee9e473bdfc34aec08adf9a7e9752026
Instruction Fuzzy Hash: 2E0162F65002087FE7109BA49DC9FFF326CEB08701F4004A6B706E2041EA749E854F74

Function 00C0096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(017EE608,017EE608), ref: 00C0097B
EnterCriticalSection.KERNEL32(017EE5E8,00000000), ref: 00C0098D
TerminateThread.KERNEL32(00000007,000001F6), ref: 00C0099B
WaitForSingleObject.KERNEL32(00000007,000003E8), ref: 00C009A9
CloseHandle.KERNEL32(00000007), ref: 00C009B8
InterlockedExchange.KERNEL32(017EE608,000001F6), ref: 00C009C8
LeaveCriticalSection.KERNEL32(017EE5E8), ref: 00C009CF

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: a46f6440fdddd6191287ee63341d11ef9ba5ce9c9c00f9357ed8730354aaf81a
Instruction ID: eaf20f2f5ea8a6fc0de0361839271467a05f6e87f0327043466275ef98f8e670
Opcode Fuzzy Hash: a46f6440fdddd6191287ee63341d11ef9ba5ce9c9c00f9357ed8730354aaf81a
Instruction Fuzzy Hash: FCF01D31452902EBD7615B94EEC9BDE7A25BF01702F501015F10150CA1CB749576CF90

Function 00C11C60 Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00C11DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00C11DE1
WSAGetLastError.WSOCK32 ref: 00C11DF2
htons.WSOCK32(?,?,?,?,?), ref: 00C11EDB
inet_ntoa.WSOCK32(?), ref: 00C11E8C

Part of subcall function 00BF39E8: _strlen.LIBCMT ref: 00BF39F2

Part of subcall function 00C13224: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,00C0EC0C), ref: 00C13240

_strlen.LIBCMT ref: 00C11F35

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
String ID:
API String ID: 3203458085-0
Opcode ID: 9db565fa44b8f0dbb1ce1a8e0da3a8f7a980de13d6b5f2b280cd9cf9239d2364
Instruction ID: fbd57037166f0d59859a6f86f84e2f2b44a3cccac8401af45466f4e3854af844
Opcode Fuzzy Hash: 9db565fa44b8f0dbb1ce1a8e0da3a8f7a980de13d6b5f2b280cd9cf9239d2364
Instruction Fuzzy Hash: B1B12931104340AFC724DF64C895F6A77E5AF86318F58859CF9664B2E2CB31EE86CB91

Function 00B95D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00B95D30
GetWindowRect.USER32(?,?), ref: 00B95D71
ScreenToClient.USER32(?,?), ref: 00B95D99
GetClientRect.USER32(?,?), ref: 00B95ED7
GetWindowRect.USER32(?,?), ref: 00B95EF8

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 900bf379277dca205fa54074bbdb8a370b8b3010313ba279577d7981a555dc20
Instruction ID: dce414ac288cb92e99739109736439724624a13c9c62bc562dbe66fc36cecb3b
Opcode Fuzzy Hash: 900bf379277dca205fa54074bbdb8a370b8b3010313ba279577d7981a555dc20
Instruction Fuzzy Hash: 02B16D35A00A4ADBDF24CFA9C4807EEB7F1FF48310F14846AE8A9D7250E734AA51DB50

Function 00BC01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00BC00BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00BC00D6
__allrem.LIBCMT ref: 00BC00ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00BC010B
__allrem.LIBCMT ref: 00BC0122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00BC0140

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction ID: 5d51b83895bbd1a40ddc650a86e1b8ea11c823ef1893808d86209ed3800c8ebe
Opcode Fuzzy Hash: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction Fuzzy Hash: FC81C671601706DBE724AF68CC82FBAB3E9EF41764F2445BEF551D6681E7B0D9008750

Function 00BC61FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00BB82D9,00BB82D9,?,?,?,00BC644F,00000001,00000001,8BE85006), ref: 00BC6258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00BC644F,00000001,00000001,8BE85006,?,?,?), ref: 00BC62DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00BC63D8
__freea.LIBCMT ref: 00BC63E5

Part of subcall function 00BC3820: RtlAllocateHeap.NTDLL(00000000,?,00C61444,?,00BAFDF5,?,?,00B9A976,00000010,00C61440,00B913FC,?,00B913C6,?,00B91129), ref: 00BC3852

__freea.LIBCMT ref: 00BC63EE
__freea.LIBCMT ref: 00BC6413

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 927abd99e43436ad00ccdb55967fc0f587c4f166218af4fb6fd8b933379cd6df
Instruction ID: 59ff2982ec3c3ee37bc1081259fc0653cf5ea3a26ea6655c1c903561935501f1
Opcode Fuzzy Hash: 927abd99e43436ad00ccdb55967fc0f587c4f166218af4fb6fd8b933379cd6df
Instruction Fuzzy Hash: 8651AF72A10256ABEB258F68CC81FAF77E9EF84750F1546ADFC05DA181EB34DC40C664

Function 00C1BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B99CB3: _wcslen.LIBCMT ref: 00B99CBD

Part of subcall function 00C1C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C1B6AE,?,?), ref: 00C1C9B5
Part of subcall function 00C1C998: _wcslen.LIBCMT ref: 00C1C9F1
Part of subcall function 00C1C998: _wcslen.LIBCMT ref: 00C1CA68
Part of subcall function 00C1C998: _wcslen.LIBCMT ref: 00C1CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C1BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00C1BD25
RegCloseKey.ADVAPI32(00000000), ref: 00C1BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00C1BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00C1BDF3
RegCloseKey.ADVAPI32(?), ref: 00C1BDFF

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 70ccdbf4ea83e6861a47c5672c711b711bd9bcc8347b9d3cbb521a69999c0a08
Instruction ID: ba10ba7e1b8488c9148e9b7da0d27ec692efccf02029ce2d55e16dc6f7408a8a
Opcode Fuzzy Hash: 70ccdbf4ea83e6861a47c5672c711b711bd9bcc8347b9d3cbb521a69999c0a08
Instruction Fuzzy Hash: A6815D30218241AFD714DF24C895E6ABBE5FF85308F1485ACF4554B2A2DB31ED45DF92

Function 00BEF7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 00BEF7B9
SysAllocString.OLEAUT32(00000001), ref: 00BEF860
VariantCopy.OLEAUT32(00BEFA64,00000000), ref: 00BEF889
VariantClear.OLEAUT32(00BEFA64), ref: 00BEF8AD
VariantCopy.OLEAUT32(00BEFA64,00000000), ref: 00BEF8B1
VariantClear.OLEAUT32(?), ref: 00BEF8BB

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 4011aafbf3690c840e436bcf37c9e32ed01b4ffce6e1615d9dfb151a0d2874b2
Instruction ID: ca28fd79656d062224d2ab79ebbc4142f441b7c9c7a1e2e2c3dae9aeebf8b400
Opcode Fuzzy Hash: 4011aafbf3690c840e436bcf37c9e32ed01b4ffce6e1615d9dfb151a0d2874b2
Instruction Fuzzy Hash: D351B435510352EADF20AB66D8D5B39B3E8EF45310B2494F6E806DF292DB70CC40CB96

Function 00C0910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00B97620: _wcslen.LIBCMT ref: 00B97625

Part of subcall function 00B96B57: _wcslen.LIBCMT ref: 00B96B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 00C094E5
_wcslen.LIBCMT ref: 00C09506
_wcslen.LIBCMT ref: 00C0952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00C09585

Strings

X, xrefs: 00C09412

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: ac48a8ab1e9a2f9c51f0f7d3fc579161a43f2185d4f8b15ea348c1f0978f27d2
Instruction ID: 6cf4ec2571625900f173dd9e1f91293205dd9f6063d49262eccfaf3748ae83c8
Opcode Fuzzy Hash: ac48a8ab1e9a2f9c51f0f7d3fc579161a43f2185d4f8b15ea348c1f0978f27d2
Instruction Fuzzy Hash: 66E17D715083019FDB24DF25C881B6AB7E4FF85314F1489ADF8999B2A2DB31DE05CB92

Function 00BA920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00BA9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00BA9BB2

BeginPaint.USER32(?,?,?), ref: 00BA9241
GetWindowRect.USER32(?,?), ref: 00BA92A5
ScreenToClient.USER32(?,?), ref: 00BA92C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00BA92D3
EndPaint.USER32(?,?,?,?,?), ref: 00BA9321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00BE71EA

Part of subcall function 00BA9339: BeginPath.GDI32(00000000), ref: 00BA9357

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 82c67db3aa03dbecca526d3a3e3d543853680aa56b6266cdbc12fb3aef93266f
Instruction ID: 7cef895a7425d662b0b68926518569bd9fe58623d8935ab654c2d7195fdcb16a
Opcode Fuzzy Hash: 82c67db3aa03dbecca526d3a3e3d543853680aa56b6266cdbc12fb3aef93266f
Instruction Fuzzy Hash: D041A070108300AFDB20DF25D8C5FAA7BF8EF46721F1802A9F954971A1CB719845EB62

Function 00C007EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00C0080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00C00847
EnterCriticalSection.KERNEL32(?), ref: 00C00863
LeaveCriticalSection.KERNEL32(?), ref: 00C008DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00C008F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00C00921

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 5bad6b028f38b0b521a483c79f5b0f51ed262defc6bc19a9d3c00219d3109909
Instruction ID: e099e91953c5e838dd631f6643ed74f99c8f7eee1476bd42a7afd190c4e965bd
Opcode Fuzzy Hash: 5bad6b028f38b0b521a483c79f5b0f51ed262defc6bc19a9d3c00219d3109909
Instruction Fuzzy Hash: 87414A71900205EBDF14AF94DC85BAE77B9FF04310F1580A5ED00AA29BDB30EE65DBA4

Function 00C281DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,00BEF3AB,00000000,?,?,00000000,?,00BE682C,00000004,00000000,00000000), ref: 00C2824C
EnableWindow.USER32(00000000,00000000), ref: 00C28272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00C282D1
ShowWindow.USER32(00000000,00000004), ref: 00C282E5
EnableWindow.USER32(00000000,00000001), ref: 00C2830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00C2832F

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: a8f60df052547d4da34e3d00242687ac385d3a7a3edd1049cee6c299be1baf32
Instruction ID: d722211cd657fcb80eedbcc95a54c22f337281a0401dd91ae22e9dbec53ca3f5
Opcode Fuzzy Hash: a8f60df052547d4da34e3d00242687ac385d3a7a3edd1049cee6c299be1baf32
Instruction Fuzzy Hash: 6441C530602654EFDF21CF15E899BE87BE0FB0A715F1C4169E9184B672CB71A949CF50

Function 00BF4C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00BF4C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00BF4CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00BF4CEA
_wcslen.LIBCMT ref: 00BF4D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00BF4D10
_wcsstr.LIBVCRUNTIME ref: 00BF4D1A

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: d5373abbf5b3a3878ec58a50ab863c8e140616bf6aa32bf72c68fe25556c6645
Instruction ID: 19cd65ad9bbcaa888b5a784bb0108c4be37a7db8beaa25fe5cb55aed6cf42cea
Opcode Fuzzy Hash: d5373abbf5b3a3878ec58a50ab863c8e140616bf6aa32bf72c68fe25556c6645
Instruction Fuzzy Hash: E021D7352042057BEB255B699C89F7F7BD8DF45750F1040B9F905CB191DB61DC0596A0

Function 00C0581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00B93AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00B93A97,?,?,00B92E7F,?,?,?,00000000), ref: 00B93AC2

_wcslen.LIBCMT ref: 00C0587B
CoInitialize.OLE32(00000000), ref: 00C05995
CoCreateInstance.OLE32(00C2FCF8,00000000,00000001,00C2FB68,?), ref: 00C059AE
CoUninitialize.OLE32 ref: 00C059CC

Strings

.lnk, xrefs: 00C05876, 00C058C1, 00C05985

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 03cedcdb9a0a72f3379bf0bfefb723ad561112abe36b602b312054bb9c6b4d66
Instruction ID: 46b9d230d46bf2bf60252bff5aa2c1a9a6c1c61893e056e30df2bdad8c7b3ae8
Opcode Fuzzy Hash: 03cedcdb9a0a72f3379bf0bfefb723ad561112abe36b602b312054bb9c6b4d66
Instruction Fuzzy Hash: 44D165756086019FCB14DF14C480A2BBBE5EF89710F1588ADF8999B3A1DB31ED46CF92

Function 00BF175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF0FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00BF0FCA
Part of subcall function 00BF0FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00BF0FD6
Part of subcall function 00BF0FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00BF0FE5
Part of subcall function 00BF0FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00BF0FEC
Part of subcall function 00BF0FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00BF1002

GetLengthSid.ADVAPI32(?,00000000,00BF1335), ref: 00BF17AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00BF17BA
HeapAlloc.KERNEL32(00000000), ref: 00BF17C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 00BF17DA
GetProcessHeap.KERNEL32(00000000,00000000,00BF1335), ref: 00BF17EE
HeapFree.KERNEL32(00000000), ref: 00BF17F5

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: e8c9c6b86a6ca3fa8ff6a44caf83b982ed78fa4c1cbb3110d84ae7e85ee2fc1f
Instruction ID: 85dee16ccf0dc1b96752017a76f06da7d87870b3be015ea319f11683f359b818
Opcode Fuzzy Hash: e8c9c6b86a6ca3fa8ff6a44caf83b982ed78fa4c1cbb3110d84ae7e85ee2fc1f
Instruction Fuzzy Hash: 8211ACB1910209EFDB20EFA8CC8ABBF7BE9EB41355F104898F54597210C735AD59CB60

Function 00BF14CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00BF14FF
OpenProcessToken.ADVAPI32(00000000), ref: 00BF1506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00BF1515
CloseHandle.KERNEL32(00000004), ref: 00BF1520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00BF154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00BF1563

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 10540ef2914ecda91a79d7928356ecf07d140f2c2a4556e09fc93bd1faacb04a
Instruction ID: c9385f4dcc80ff5e6c010dea30dfb361dfbc42d844b952c90370915def3e1683
Opcode Fuzzy Hash: 10540ef2914ecda91a79d7928356ecf07d140f2c2a4556e09fc93bd1faacb04a
Instruction Fuzzy Hash: 8B11597250020DEBDF21CF98DD89BEE7BA9EF48704F144854FA05A2160C375CE65DB60

Function 00BB3382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00BB3379,00BB2FE5), ref: 00BB3390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00BB339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00BB33B7
SetLastError.KERNEL32(00000000,?,00BB3379,00BB2FE5), ref: 00BB3409

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 7c58b6e5d76f3be2036cad6afb3f750822eb5a7551bdd78a4c7aec6bc13e4c6c
Instruction ID: 44337e336a49a9ef44909f32da2fd90a2ce27ddec4ef911003c79beec198b185
Opcode Fuzzy Hash: 7c58b6e5d76f3be2036cad6afb3f750822eb5a7551bdd78a4c7aec6bc13e4c6c
Instruction Fuzzy Hash: C701243220C311BFAA2427B4BCC6BFF2BD4EB45B7A72002A9F411912F0EFD14D429148

Function 00BC2D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00BC5686,00BD3CD6,?,00000000,?,00BC5B6A,?,?,?,?,?,00BBE6D1,?,00C58A48), ref: 00BC2D78
_free.LIBCMT ref: 00BC2DAB
_free.LIBCMT ref: 00BC2DD3
SetLastError.KERNEL32(00000000,?,?,?,?,00BBE6D1,?,00C58A48,00000010,00B94F4A,?,?,00000000,00BD3CD6), ref: 00BC2DE0
SetLastError.KERNEL32(00000000,?,?,?,?,00BBE6D1,?,00C58A48,00000010,00B94F4A,?,?,00000000,00BD3CD6), ref: 00BC2DEC
_abort.LIBCMT ref: 00BC2DF2

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: a775cfe556fd0b8ee8c15dc33d7c08c0b1dfec846998eec7d569d6003c528b92
Instruction ID: d61267e94f845a159b69a2b699585041ae9572f5513d7b98f2768fc09cf5f129
Opcode Fuzzy Hash: a775cfe556fd0b8ee8c15dc33d7c08c0b1dfec846998eec7d569d6003c528b92
Instruction Fuzzy Hash: DBF0C835504B006BD6227734BC46F5F26D9EFD17A1F2445BCF825A22E2EF348C424160

Function 00C28A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00BA9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00BA9693
Part of subcall function 00BA9639: SelectObject.GDI32(?,00000000), ref: 00BA96A2
Part of subcall function 00BA9639: BeginPath.GDI32(?), ref: 00BA96B9
Part of subcall function 00BA9639: SelectObject.GDI32(?,00000000), ref: 00BA96E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00C28A4E
LineTo.GDI32(?,00000003,00000000), ref: 00C28A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00C28A70
LineTo.GDI32(?,00000000,00000003), ref: 00C28A80
EndPath.GDI32(?), ref: 00C28A90
StrokePath.GDI32(?), ref: 00C28AA0

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 8193864039fb3df7ffe6c4f7ce6d1532d517e0d31960ed9606d9d2db8deae954
Instruction ID: 995df57ddb48ed7ce4de961b97953b1bbcbbc9087013b713e29635ca00d1e6cd
Opcode Fuzzy Hash: 8193864039fb3df7ffe6c4f7ce6d1532d517e0d31960ed9606d9d2db8deae954
Instruction Fuzzy Hash: 85110976000118FFEF229F94DC88FAE7F6CEB08350F048012FA199A5A1C771AE55DBA0

Function 00BF51FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00BF5218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00BF5229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00BF5230
ReleaseDC.USER32(00000000,00000000), ref: 00BF5238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00BF524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00BF5261

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: d37a3d483c084f76d03b89e583899b5869abce1e309fae0eb0feb555252e6953
Instruction ID: 773745748f1801c18513408017cca4b39e07a0f4bf4062048595038db310bf77
Opcode Fuzzy Hash: d37a3d483c084f76d03b89e583899b5869abce1e309fae0eb0feb555252e6953
Instruction Fuzzy Hash: F5018F75E00708BBEB209BA69C89B5EBFB8EF48751F044165FB04A7681D6709801CBA0

Function 00B91BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00B91BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00B91BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00B91C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00B91C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00B91C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00B91C22

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 6cf09841d197cb1d1fc95896cda4abdd21fd2f9df675327bad80e966ac43d492
Instruction ID: 28dc1c9649149a529a8732fc01372f1aec07989258bb663523ff7b2d38084cac
Opcode Fuzzy Hash: 6cf09841d197cb1d1fc95896cda4abdd21fd2f9df675327bad80e966ac43d492
Instruction Fuzzy Hash: 9C0167B0902B5ABDE3008F6A8C85B56FFA8FF19354F00411BA15C4BA42C7F5A864CBE5

Function 00BFEB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00BFEB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00BFEB46
GetWindowThreadProcessId.USER32(?,?), ref: 00BFEB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00BFEB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00BFEB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00BFEB75

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: a4a7fae5c1879b26b6b2d5749399e60b801c8c5e52e8f4df11d52dec3bad964f
Instruction ID: dfed716b31fdd692133546ea5585f8c0d82d95ea0e7ee0559192c1a90deade60
Opcode Fuzzy Hash: a4a7fae5c1879b26b6b2d5749399e60b801c8c5e52e8f4df11d52dec3bad964f
Instruction Fuzzy Hash: 60F05E72250558BBE7315B629C8EFEF3E7CEFCAB11F000158F611E1491D7A05A02C6B5

Function 00BE7439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00BE7452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00BE7469
GetWindowDC.USER32(?), ref: 00BE7475
GetPixel.GDI32(00000000,?,?), ref: 00BE7484
ReleaseDC.USER32(?,00000000), ref: 00BE7496
GetSysColor.USER32(00000005), ref: 00BE74B0

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 399181c16d4233bf599dbf04a28483797f11624ac51bf3c766266d6108220591
Instruction ID: c4805b69105149dfab02a91d1491eb6d9e0d1c61270704b3702ca713e4ce162f
Opcode Fuzzy Hash: 399181c16d4233bf599dbf04a28483797f11624ac51bf3c766266d6108220591
Instruction Fuzzy Hash: 3B018631410205EFEB319FA4DC88BAE7BB5FF04321F2400A0F926A26A0CF751E52AB50

Function 00BF1874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00BF187F
UnloadUserProfile.USERENV(?,?), ref: 00BF188B
CloseHandle.KERNEL32(?), ref: 00BF1894
CloseHandle.KERNEL32(?), ref: 00BF189C
GetProcessHeap.KERNEL32(00000000,?), ref: 00BF18A5
HeapFree.KERNEL32(00000000), ref: 00BF18AC

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 215ca75715a18138f10ace5cb9f4a5a701e295357da0b1e6a4154fcd4d683092
Instruction ID: f30185df724a8abb556281d5a5921e0c74d77a3f6923c86d3c66038131366f14
Opcode Fuzzy Hash: 215ca75715a18138f10ace5cb9f4a5a701e295357da0b1e6a4154fcd4d683092
Instruction Fuzzy Hash: C7E0E536014501BBDB115FA1ED4DB4EBF39FF49B22B208620F22581874CB329432DF50

Function 00BFC5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B97620: _wcslen.LIBCMT ref: 00B97625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00BFC6EE
_wcslen.LIBCMT ref: 00BFC735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00BFC79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00BFC7CA

Strings

0, xrefs: 00BFC6AF

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 735387c15adcbab37c1d56c896ccb5550789db2307b0a0bcbe4784b8cebbb02f
Instruction ID: cd68173f7f2b7773d6baa7fb5c5c58513365d290a11e4f29ffb756bc781d9992
Opcode Fuzzy Hash: 735387c15adcbab37c1d56c896ccb5550789db2307b0a0bcbe4784b8cebbb02f
Instruction Fuzzy Hash: E851D17160830D9BD725AF28CA85B7B7BE4EF85310F0809A9FA95D3190DB70DD88CB52

Function 00C1AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 00C1AEA3

Part of subcall function 00B97620: _wcslen.LIBCMT ref: 00B97625

GetProcessId.KERNEL32(00000000), ref: 00C1AF38
CloseHandle.KERNEL32(00000000), ref: 00C1AF67

Strings

<, xrefs: 00C1AE6B
@, xrefs: 00C1AE72

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 4f0cc8a45ce825fc18252e7385854cac6b0ed9578e1f50706639c7a707afc434
Instruction ID: 4cf50e851cb2458a07a82eea78ce704dfb1a96d9f5ed270653a1ded2915546a1
Opcode Fuzzy Hash: 4f0cc8a45ce825fc18252e7385854cac6b0ed9578e1f50706639c7a707afc434
Instruction Fuzzy Hash: 62714A71A00615DFCF14DF54C494A9EBBF0EF09314F0584A9E81AAB3A1CB74ED85CB91

Function 00BF719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00BF7206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00BF723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00BF724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00BF72CF

Strings

DllGetClassObject, xrefs: 00BF7242

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: f709ce333cde6dceff513b3ca79fa718eda60bedafcaf5f8c7b738bd2cfc20a1
Instruction ID: 19f0f423d865d3c50a047b24561a98619f1c5f41d77770548acaf4745fa9ba10
Opcode Fuzzy Hash: f709ce333cde6dceff513b3ca79fa718eda60bedafcaf5f8c7b738bd2cfc20a1
Instruction Fuzzy Hash: 1E415E71644208AFDF15CF54C885BAA7BE9EF45310F1480EDBE059F24ADBB1D949CBA0

Function 00C23D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C23E35
IsMenu.USER32(?), ref: 00C23E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00C23E92
DrawMenuBar.USER32 ref: 00C23EA5

Strings

0, xrefs: 00C23D89

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 19762c7c9396255efb15b3846248e92ce522da64dede7d8e839256aaacb768fc
Instruction ID: 703c5d4e3618da7f79a65c81e998263a49b6b48b88a325d3b8a6f2522708a334
Opcode Fuzzy Hash: 19762c7c9396255efb15b3846248e92ce522da64dede7d8e839256aaacb768fc
Instruction Fuzzy Hash: 3A418875A10259AFDB20DF50E884AAEBBB9FF49350F054029E911A7650C334EE09CFA0

Function 00BF1DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B99CB3: _wcslen.LIBCMT ref: 00B99CBD

Part of subcall function 00BF3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00BF3CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00BF1E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00BF1E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00BF1EA9

Part of subcall function 00B96B57: _wcslen.LIBCMT ref: 00B96B6A

Strings

ComboBox, xrefs: 00BF1DF0
ListBox, xrefs: 00BF1E25

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 53ab373985fd7eb01a486c1542a455dac445a20610de6e40ff230aac063e039f
Instruction ID: 23b1e8b5dfc63050abeb8457ea8ac987c636bd8aa909826db4fa8e4423c6feb6
Opcode Fuzzy Hash: 53ab373985fd7eb01a486c1542a455dac445a20610de6e40ff230aac063e039f
Instruction Fuzzy Hash: 7F210271A00108FADB14ABA9DC96DFFB7F8DF46350B1049A9F925A71E1DB34490E8620

Function 00C22F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00C22F8D
LoadLibraryW.KERNEL32(?), ref: 00C22F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00C22FA9
DestroyWindow.USER32(?), ref: 00C22FB1

Strings

SysAnimate32, xrefs: 00C22F68

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 562357211f0df5fe8258aa84aafb7d459fb71e1e302bcd2c364db6ffe47de686
Instruction ID: 72c33bae49533ad4aa91249fa5acc5374609e3355029fddf6327a64cf2a7d2cf
Opcode Fuzzy Hash: 562357211f0df5fe8258aa84aafb7d459fb71e1e302bcd2c364db6ffe47de686
Instruction Fuzzy Hash: 2521AE71200225BBEB208FA4ED80FBB37B9EB59364F100228F960D2990D771DC919760

Function 00BB4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00BB4D1E,00BC28E9,?,00BB4CBE,00BC28E9,00C588B8,0000000C,00BB4E15,00BC28E9,00000002), ref: 00BB4D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00BB4DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00BB4D1E,00BC28E9,?,00BB4CBE,00BC28E9,00C588B8,0000000C,00BB4E15,00BC28E9,00000002,00000000), ref: 00BB4DC3

Strings

CorExitProcess, xrefs: 00BB4D98
mscoree.dll, xrefs: 00BB4D86

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 095c23f637f67b7161effc6f8b426570f658db54afc54d834b2bfae54108b28b
Instruction ID: 813cb9c81a0e9a7e0ae3d8f03cd90024db8a34dd1dd4ec57bffbd30ec8ae0550
Opcode Fuzzy Hash: 095c23f637f67b7161effc6f8b426570f658db54afc54d834b2bfae54108b28b
Instruction Fuzzy Hash: 5FF06235A50308BBDB219F90DC89BEEBFF5EF44752F0000A4F805A26A1CBB05D51CB90

Function 00B94E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00B94EDD,?,00C61418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00B94E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00B94EAE
FreeLibrary.KERNEL32(00000000,?,?,00B94EDD,?,00C61418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00B94EC0

Strings

kernel32.dll, xrefs: 00B94E94
Wow64DisableWow64FsRedirection, xrefs: 00B94EA8

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 70ce6a1f1eb83949d6d04f815638156138d71d13ea7c5884532f29c0f47ba2b5
Instruction ID: f671a451980ef58848b903b29a7b730cbcc9a7571fa16567e815428e4043c5a4
Opcode Fuzzy Hash: 70ce6a1f1eb83949d6d04f815638156138d71d13ea7c5884532f29c0f47ba2b5
Instruction Fuzzy Hash: 3BE0CD36A11D325BD63117257C59F6F6594EF81F637050175FC01D2500DB60CD0380E0

Function 00B94E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00BD3CDE,?,00C61418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00B94E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00B94E74
FreeLibrary.KERNEL32(00000000,?,?,00BD3CDE,?,00C61418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00B94E87

Strings

kernel32.dll, xrefs: 00B94E5B
Wow64RevertWow64FsRedirection, xrefs: 00B94E6E

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 6faf1a1fdc5a3f58effc16e5b60adcbe8750cb58fc54da0a3ad33887cac7b1ea
Instruction ID: b9826a68d28b59c8b2d319595b60e7cc30b4f9318609b219767e727ac94e1dac
Opcode Fuzzy Hash: 6faf1a1fdc5a3f58effc16e5b60adcbe8750cb58fc54da0a3ad33887cac7b1ea
Instruction Fuzzy Hash: 82D0C236922E31574A321B247C09F8F2A58EF85B513050170BC00A2210CF20CD13C1D0

Function 00C02947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00C02C05
DeleteFileW.KERNEL32(?), ref: 00C02C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00C02C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00C02CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00C02CC0

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 00634e65285cd36d9cf3fc799c4367a0e53cd831452215dbfe9f63410a047171
Instruction ID: 79b736b5f7a6f3b6814cd89a5ba9fcc317f3c01c01bad92f2e81b93930e5c763
Opcode Fuzzy Hash: 00634e65285cd36d9cf3fc799c4367a0e53cd831452215dbfe9f63410a047171
Instruction Fuzzy Hash: DEB12F71E00119ABDF21DBA4CC89EEEB7BDEF49350F1040A6F909E6191EB709A44DF61

Function 00C1A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00C1A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00C1A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00C1A468
CloseHandle.KERNEL32(?), ref: 00C1A63D

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 1638667bf0f42d3ceafc819d84fff381af13d06151017661848a7e8488cd92c0
Instruction ID: d8600ab9f25b81dc5f19deb11fb99cae21e429514ee07b2f9d5ad69480b4612b
Opcode Fuzzy Hash: 1638667bf0f42d3ceafc819d84fff381af13d06151017661848a7e8488cd92c0
Instruction Fuzzy Hash: 26A1A1716043009FD720DF24D886F2ABBE5AF88714F14885DF56A9B392DBB0ED45CB92

Function 00BCBB27 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00C33700), ref: 00BCBB91
WideCharToMultiByte.KERNEL32(00000000,00000000,00C6121C,000000FF,00000000,0000003F,00000000,?,?), ref: 00BCBC09
WideCharToMultiByte.KERNEL32(00000000,00000000,00C61270,000000FF,?,0000003F,00000000,?), ref: 00BCBC36
_free.LIBCMT ref: 00BCBB7F

Part of subcall function 00BC29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00BCD7D1,00000000,00000000,00000000,00000000,?,00BCD7F8,00000000,00000007,00000000,?,00BCDBF5,00000000), ref: 00BC29DE
Part of subcall function 00BC29C8: GetLastError.KERNEL32(00000000,?,00BCD7D1,00000000,00000000,00000000,00000000,?,00BCD7F8,00000000,00000007,00000000,?,00BCDBF5,00000000,00000000), ref: 00BC29F0

_free.LIBCMT ref: 00BCBD4B

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: d806bdeda2cb8d46ccf0dec27a403304c6f1b62da24355ff3b4dcc3381f81254
Instruction ID: ffde944e15b7e89ff741410eeda699cfede2da8afa4dbbbb860283ab1f223c1d
Opcode Fuzzy Hash: d806bdeda2cb8d46ccf0dec27a403304c6f1b62da24355ff3b4dcc3381f81254
Instruction Fuzzy Hash: 9A51B671900209AFCB24EF659C82FAEB7F8EB41361F1442EEE555E7191EB705E418B50

Function 00BFE3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00BFCF22,?), ref: 00BFDDFD

Part of subcall function 00BFDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00BFCF22,?), ref: 00BFDE16

Part of subcall function 00BFE199: GetFileAttributesW.KERNEL32(?,00BFCF95), ref: 00BFE19A

lstrcmpiW.KERNEL32(?,?), ref: 00BFE473
MoveFileW.KERNEL32(?,?), ref: 00BFE4AC
_wcslen.LIBCMT ref: 00BFE5EB
_wcslen.LIBCMT ref: 00BFE603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00BFE650

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: edffeb8b66bdf0b31d5738f643cab3df0b7b782992589c924c65061dce1975c3
Instruction ID: e43cc86932e6f35a9851561b51c66268679d44d7995c136bcf27b5959c3324ce
Opcode Fuzzy Hash: edffeb8b66bdf0b31d5738f643cab3df0b7b782992589c924c65061dce1975c3
Instruction Fuzzy Hash: D35131B24083499BC764EB94DC819FFB3ECAF84340F00496EF69993151EE74E68C8766

Function 00C1B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B99CB3: _wcslen.LIBCMT ref: 00B99CBD

Part of subcall function 00C1C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C1B6AE,?,?), ref: 00C1C9B5
Part of subcall function 00C1C998: _wcslen.LIBCMT ref: 00C1C9F1
Part of subcall function 00C1C998: _wcslen.LIBCMT ref: 00C1CA68
Part of subcall function 00C1C998: _wcslen.LIBCMT ref: 00C1CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C1BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00C1BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00C1BB63
RegCloseKey.ADVAPI32(?,?), ref: 00C1BBA6
RegCloseKey.ADVAPI32(00000000), ref: 00C1BBB3

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 732310592967781ad66f0fc33a220c2340b55b73611b181f54beb95c36d8a7c5
Instruction ID: 256a23bee890582c35861b0e9dbbc63c427f15cde037144de9b8fc415f9fcb7d
Opcode Fuzzy Hash: 732310592967781ad66f0fc33a220c2340b55b73611b181f54beb95c36d8a7c5
Instruction Fuzzy Hash: 87619131218241AFD714DF24C490E6ABBE5FF85308F1485ACF4994B2A2DB31ED85DF92

Function 00BF8BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00BF8BCD
VariantClear.OLEAUT32 ref: 00BF8C3E
VariantClear.OLEAUT32 ref: 00BF8C9D
VariantClear.OLEAUT32(?), ref: 00BF8D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00BF8D3B

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 46bfa9d6b67ee13885cdb3ef799e6af85338e1045f8b327aa472f108aaf26504
Instruction ID: 9fc64197d37410ed28de17941d628cde535efe9a76c375d234817db64f3602eb
Opcode Fuzzy Hash: 46bfa9d6b67ee13885cdb3ef799e6af85338e1045f8b327aa472f108aaf26504
Instruction Fuzzy Hash: 38517BB5A00619EFCB10CF68C884AAAB7F9FF89310B158569F909DB354E730E911CF90

Function 00C08AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00C08BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00C08BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00C08C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00C08C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00C08C5F

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 320732ca978e6d45c86b5543f03d09944653b9ad76b9c641b3e83ff14a81dbee
Instruction ID: 55109982c7a77c32b959512d0c111949bc7bd9a2526d3989bd6b33e8a27ed334
Opcode Fuzzy Hash: 320732ca978e6d45c86b5543f03d09944653b9ad76b9c641b3e83ff14a81dbee
Instruction Fuzzy Hash: 94512635A10215AFDF11DF64C880A6DBBF5EF49314F09C0A8E849AB3A2DB31ED55CB90

Function 00C18EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00C18F40
GetProcAddress.KERNEL32(00000000,?), ref: 00C18FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00C18FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00C19032
FreeLibrary.KERNEL32(00000000), ref: 00C19052

Part of subcall function 00BAF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00C01043,?,761DE610), ref: 00BAF6E6
Part of subcall function 00BAF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00BEFA64,00000000,00000000,?,?,00C01043,?,761DE610,?,00BEFA64), ref: 00BAF70D

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: fe8f65ec76695511bfbc5cd4dbc8403c21457082f1fa1299dc892ca6d941ae6e
Instruction ID: e1c79bdb085df8f88bea087fbdd10e4b5cc9f2f41515386b7f4038fd92be4e8b
Opcode Fuzzy Hash: fe8f65ec76695511bfbc5cd4dbc8403c21457082f1fa1299dc892ca6d941ae6e
Instruction Fuzzy Hash: 14512935A04205DFCB15DF58C4949EDBBF1FF4A314B0580A8E81A9B762DB31EE86DB90

Function 00C26B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00C26C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00C26C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00C26C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00C0AB79,00000000,00000000), ref: 00C26C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00C26CC7

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: d878042c2efbc3167b06d949bf365392486638505bf07058d328803aaf279580
Instruction ID: ed5181d924245bf95a176ea68744f5f47f3ee6bb548bafdd2809c0bd6c82fb64
Opcode Fuzzy Hash: d878042c2efbc3167b06d949bf365392486638505bf07058d328803aaf279580
Instruction Fuzzy Hash: 51410835604124AFD724EF39DC94FA97BA5EB09360F140268FCA5A76E0C771EE41DA60

Function 00BC2051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00BC20C3
_free.LIBCMT ref: 00BC20E3

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 6c7ef695d6c2f0c3f92d4cc3c190d2c490f66b64cfeeba05fcdee68795145836
Instruction ID: 305ecf505da662c70c12c4b030fe1488e6b13dcafc5331f36f92c8f15700353d
Opcode Fuzzy Hash: 6c7ef695d6c2f0c3f92d4cc3c190d2c490f66b64cfeeba05fcdee68795145836
Instruction Fuzzy Hash: 7541AF36A002009FCB24DF78C881F6DB7E5EF89314F1545ADE615EB392DA31AD01CB90

Function 00BA912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00BA9141
ScreenToClient.USER32(00000000,?), ref: 00BA915E
GetAsyncKeyState.USER32(00000001), ref: 00BA9183
GetAsyncKeyState.USER32(00000002), ref: 00BA919D

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 5f090fa999bc165d1e6da114e3014522206d1480a8f466b6098e0e8120679040
Instruction ID: 292d4d1718090b2f8d32c895127610ff71f8438f03413397e02c547bdb41da2a
Opcode Fuzzy Hash: 5f090fa999bc165d1e6da114e3014522206d1480a8f466b6098e0e8120679040
Instruction Fuzzy Hash: 84414F31A0865AFBDF159F65C884BEEB7B4FF06320F208255E425B7290CB346D54EB91

Function 00C03874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00C038CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00C03922
TranslateMessage.USER32(?), ref: 00C0394B
DispatchMessageW.USER32(?), ref: 00C03955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00C03966

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 1c9cdba4d25ce4fa82e0359aa6dc6f89e6465b39759158238632fa18bee3cc4b
Instruction ID: 445c3ebb8a752ccf18ef92c7dfe9dd993bf782d7488b064d4dbcd05a0b282093
Opcode Fuzzy Hash: 1c9cdba4d25ce4fa82e0359aa6dc6f89e6465b39759158238632fa18bee3cc4b
Instruction Fuzzy Hash: D031C6709143C19EEB35CB369848BBA37ACAB05305F0C456AE872861E0E3F49785DB51

Function 00C0CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,00C0C21E,00000000), ref: 00C0CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 00C0CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,00C0C21E,00000000), ref: 00C0CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,00C0C21E,00000000), ref: 00C0CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,00C0C21E,00000000), ref: 00C0CFF2

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 3afbb2fd7be8bcf45a99af3f9a247b201457915132b7f6025be72c2ef7870fb2
Instruction ID: 7ce07e23b22572f24e596680a47fa2e70e6205337b6a9d1f1e0b85cf62f010b0
Opcode Fuzzy Hash: 3afbb2fd7be8bcf45a99af3f9a247b201457915132b7f6025be72c2ef7870fb2
Instruction Fuzzy Hash: F9316971604206EFDB20DFE5C8C4AAEBBF9EB14350B10456EF516D2180DB30AE41DB61

Function 00BF1901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00BF1915
PostMessageW.USER32(00000001,00000201,00000001), ref: 00BF19C1
Sleep.KERNEL32(00000000,?,?,?), ref: 00BF19C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 00BF19DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 00BF19E2

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: bff4957344e65f9b259a29d3433b0c0e504787805583dafc7fd07f9470b40836
Instruction ID: 8eedab239234b965c825c1e2d08cbceecc2712041d3ed3b2eebf2e695d2e5c28
Opcode Fuzzy Hash: bff4957344e65f9b259a29d3433b0c0e504787805583dafc7fd07f9470b40836
Instruction Fuzzy Hash: 6231C47190021DEFCB14CFACC999BEE3BB5EB04314F008A55FA21A72D0C3B09959CB90

Function 00C25706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00C25745
SendMessageW.USER32(?,00001074,?,00000001), ref: 00C2579D
_wcslen.LIBCMT ref: 00C257AF
_wcslen.LIBCMT ref: 00C257BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00C25816

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 775104417ca5d9eb6bff7f94d4cdc50232ee30155ec141f6e69662023aaa9d57
Instruction ID: d70d7bfa66d3d11df0378b7b7c85056d3bee7818781aa3fe2c35cef6afb1004e
Opcode Fuzzy Hash: 775104417ca5d9eb6bff7f94d4cdc50232ee30155ec141f6e69662023aaa9d57
Instruction Fuzzy Hash: 14218F759146289ADB20DFA5EC84AEEB7B8FF04720F108256F929EA580D7708A85CF50

Function 00C10930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00C10951
GetForegroundWindow.USER32 ref: 00C10968
GetDC.USER32(00000000), ref: 00C109A4
GetPixel.GDI32(00000000,?,00000003), ref: 00C109B0
ReleaseDC.USER32(00000000,00000003), ref: 00C109E8

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 8a480b3e139533d4f76bade64c848a68017d6ff4df440460fcf8410abc93bf77
Instruction ID: d85246bdced944c1b867d0fe0204dae2cea4d035cd1abba9364df2390e69d9a0
Opcode Fuzzy Hash: 8a480b3e139533d4f76bade64c848a68017d6ff4df440460fcf8410abc93bf77
Instruction Fuzzy Hash: 5321A135600204AFD714EF65D898BAEBBF5EF44700F14806CF85A977A2CB70AD45DB90

Function 00BCCDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00BCCDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BCCDE9

Part of subcall function 00BC3820: RtlAllocateHeap.NTDLL(00000000,?,00C61444,?,00BAFDF5,?,?,00B9A976,00000010,00C61440,00B913FC,?,00B913C6,?,00B91129), ref: 00BC3852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00BCCE0F
_free.LIBCMT ref: 00BCCE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00BCCE31

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 1e817f59ec104888371ffbcad656157919e08da7aef05852f25431abf6812b14
Instruction ID: 57e05d201a7a20a759b70808708f24128f979b6fd6b39e5e322401080b2456bd
Opcode Fuzzy Hash: 1e817f59ec104888371ffbcad656157919e08da7aef05852f25431abf6812b14
Instruction Fuzzy Hash: 850184726016167F23215ABA6CC9F7F6DEDDED7BA231501ADF909C7201EA719D0281F0

Function 00BA9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00BA9693
SelectObject.GDI32(?,00000000), ref: 00BA96A2
BeginPath.GDI32(?), ref: 00BA96B9
SelectObject.GDI32(?,00000000), ref: 00BA96E2

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: f37d2d05b9e328933c0a1c0507b6185ec3cfb3bc15f99a276deb8fc48e8b2dae
Instruction ID: 5bd40df4dd3c5ca99af92eca2f3bf0b00bd29f79775e8c3ee6429a539d49002b
Opcode Fuzzy Hash: f37d2d05b9e328933c0a1c0507b6185ec3cfb3bc15f99a276deb8fc48e8b2dae
Instruction Fuzzy Hash: A5217F30816305EBEB219F6AEC557AD3BB8FF02316F1C0256F810A61A0D3B05892EF94

Function 00BF5711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00BF5726
_memcmp.LIBVCRUNTIME ref: 00BF5744
_memcmp.LIBVCRUNTIME ref: 00BF5757
_memcmp.LIBVCRUNTIME ref: 00BF576F
_memcmp.LIBVCRUNTIME ref: 00BF5787

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: fc710c9fec89dddff4653329837e00fba7e6f69a896f13774b47b95a370ac459
Instruction ID: c7aecf678146f9f13690074a919f86924df942864df6592813ff37f02daf4355
Opcode Fuzzy Hash: fc710c9fec89dddff4653329837e00fba7e6f69a896f13774b47b95a370ac459
Instruction Fuzzy Hash: 3E01D272345A1DBB9228A515AD82EFB63DCDB20394B4000B4FF059B641F6A0ED2583A4

Function 00BC2DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00BBF2DE,00BC3863,00C61444,?,00BAFDF5,?,?,00B9A976,00000010,00C61440,00B913FC,?,00B913C6), ref: 00BC2DFD
_free.LIBCMT ref: 00BC2E32
_free.LIBCMT ref: 00BC2E59
SetLastError.KERNEL32(00000000,00B91129), ref: 00BC2E66
SetLastError.KERNEL32(00000000,00B91129), ref: 00BC2E6F

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 1ced54c0e2e717f16b534d59b9b4dfea93af40055a75d1247dafbe8fa5961c98
Instruction ID: 9edf89e6ce8e8a44fe9b8328c675a9b0c292f93df2df7827d06a1b17e9e05109
Opcode Fuzzy Hash: 1ced54c0e2e717f16b534d59b9b4dfea93af40055a75d1247dafbe8fa5961c98
Instruction Fuzzy Hash: 3A012836205B026BCA2267746CC5F6F26EDEBC17B1B2044ACF421B22E2EF708C014020

Function 00BF000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00BEFF41,80070057,?,?,?,00BF035E), ref: 00BF002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00BEFF41,80070057,?,?), ref: 00BF0046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00BEFF41,80070057,?,?), ref: 00BF0054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00BEFF41,80070057,?), ref: 00BF0064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00BEFF41,80070057,?,?), ref: 00BF0070

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 84be21546bc35d724039c0642c164b734688b29a7cbd9f4b814b9d76f8bff2d7
Instruction ID: 4eb274e774b612163fa21fad3dd18170ca208d8b2b46855da6b3000b42c57369
Opcode Fuzzy Hash: 84be21546bc35d724039c0642c164b734688b29a7cbd9f4b814b9d76f8bff2d7
Instruction Fuzzy Hash: 98017C7262020CBBDB215F68DC84BAE7BEDEB44751F148164FA05D3221DB75DD458BA0

Function 00BFE97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 00BFE997
QueryPerformanceFrequency.KERNEL32(?), ref: 00BFE9A5
Sleep.KERNEL32(00000000), ref: 00BFE9AD
QueryPerformanceCounter.KERNEL32(?), ref: 00BFE9B7
Sleep.KERNEL32 ref: 00BFE9F3

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 9bdd116d82a186e0a7a5383c3e9a4d5e7ccb85cb1e11373900fcd6a6623857cf
Instruction ID: 404019d80a8be619a9ceb19a19622084edb42fe823e5761130532f798acbc4b3
Opcode Fuzzy Hash: 9bdd116d82a186e0a7a5383c3e9a4d5e7ccb85cb1e11373900fcd6a6623857cf
Instruction Fuzzy Hash: C5013931C0162DDBCF109BE4D8897FDBBB8FB09700F008586E612B3260CB709569C7A1

Function 00BF10F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00BF1114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00BF0B9B,?,?,?), ref: 00BF1120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00BF0B9B,?,?,?), ref: 00BF112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00BF0B9B,?,?,?), ref: 00BF1136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00BF114D

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 301f915c88f5622e229fcb6f772c6586357b92c3ec73f0a2693425db881631b9
Instruction ID: 580d7c0a0d2ca2a1b8f24c41d9a616e07d61bea266fdc7a792c3694e8ed38ecc
Opcode Fuzzy Hash: 301f915c88f5622e229fcb6f772c6586357b92c3ec73f0a2693425db881631b9
Instruction Fuzzy Hash: 7A016D79100205BFDB214F68DC89B6E3BAEEF85360B100854FA41D3360DB31DD158A60

Function 00BF0FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00BF0FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00BF0FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00BF0FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00BF0FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00BF1002

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: b2a467cd9cd6afa23e32a09241d02efd44df86b5043250bf1d024b7606807c80
Instruction ID: 216fbfe8b3ac0df25bdb8b8b47a7f4a98795a1f1c6b6eb2db871a1e19da00457
Opcode Fuzzy Hash: b2a467cd9cd6afa23e32a09241d02efd44df86b5043250bf1d024b7606807c80
Instruction Fuzzy Hash: 93F04936210305EBDB214FA89C8AF6E3BADEF89762F204864FA45C7251CA70DC558A60

Function 00BF1014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00BF102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00BF1036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00BF1045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00BF104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00BF1062

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 7aa3546fad7d19730f9678e1b0d8110f5ee5350b1ee2f5151ab94c787b629699
Instruction ID: 3b2527065ceb007e2a2af19f2255e73b1f8a72c107e56a030e7bac68fee98b16
Opcode Fuzzy Hash: 7aa3546fad7d19730f9678e1b0d8110f5ee5350b1ee2f5151ab94c787b629699
Instruction Fuzzy Hash: 49F06D35210305FBDB215FA8EC89F6E3BADEF89761F200824FA45C7250CE70D8558A60

Function 00C0030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,00C0017D,?,00C032FC,?,00000001,00BD2592,?), ref: 00C00324
CloseHandle.KERNEL32(?,?,?,?,00C0017D,?,00C032FC,?,00000001,00BD2592,?), ref: 00C00331
CloseHandle.KERNEL32(?,?,?,?,00C0017D,?,00C032FC,?,00000001,00BD2592,?), ref: 00C0033E
CloseHandle.KERNEL32(?,?,?,?,00C0017D,?,00C032FC,?,00000001,00BD2592,?), ref: 00C0034B
CloseHandle.KERNEL32(?,?,?,?,00C0017D,?,00C032FC,?,00000001,00BD2592,?), ref: 00C00358
CloseHandle.KERNEL32(?,?,?,?,00C0017D,?,00C032FC,?,00000001,00BD2592,?), ref: 00C00365

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: c0d34a3f9d583cae495f9ef69f3456a9d980480d76b65005c5aac1fffe6d297f
Instruction ID: f6b2926208a3786c83c35ad716841e6b93e375f482ced2fbec46002d40608313
Opcode Fuzzy Hash: c0d34a3f9d583cae495f9ef69f3456a9d980480d76b65005c5aac1fffe6d297f
Instruction Fuzzy Hash: 6401A272800B159FC7319F66D880516F7F9BF503157268A3FD1A652971C371AA55CF80

Function 00BCD73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00BCD752

Part of subcall function 00BC29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00BCD7D1,00000000,00000000,00000000,00000000,?,00BCD7F8,00000000,00000007,00000000,?,00BCDBF5,00000000), ref: 00BC29DE
Part of subcall function 00BC29C8: GetLastError.KERNEL32(00000000,?,00BCD7D1,00000000,00000000,00000000,00000000,?,00BCD7F8,00000000,00000007,00000000,?,00BCDBF5,00000000,00000000), ref: 00BC29F0

_free.LIBCMT ref: 00BCD764
_free.LIBCMT ref: 00BCD776
_free.LIBCMT ref: 00BCD788
_free.LIBCMT ref: 00BCD79A

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e272b432b900598d1804badc1dd8b3f17d07dbb9e378141bf9d38a7e55284bb0
Instruction ID: faf0da63d48c75649dca752b0c473092de06503e95bdb40c49e6bbaed5ba6ab8
Opcode Fuzzy Hash: e272b432b900598d1804badc1dd8b3f17d07dbb9e378141bf9d38a7e55284bb0
Instruction Fuzzy Hash: 35F0FF76544304ABC621EB64F9C5F1A77DDFB4471179508AEF089E7641CB70FC808664

Function 00BF5C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00BF5C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00BF5C6F
MessageBeep.USER32(00000000), ref: 00BF5C87
KillTimer.USER32(?,0000040A), ref: 00BF5CA3
EndDialog.USER32(?,00000001), ref: 00BF5CBD

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: eacb1c5a5c044d9e3aa147311e2185aa287efbec3971c2235dc57c0d907aa2a5
Instruction ID: 01b7a3a244b747456c113d63c5a457a482c67e65e94877f919a081e08088cf9d
Opcode Fuzzy Hash: eacb1c5a5c044d9e3aa147311e2185aa287efbec3971c2235dc57c0d907aa2a5
Instruction Fuzzy Hash: ED011730510B04ABEB315B14DD8EFA977F8FF04B05F041599F743A14E1D7F459598A91

Function 00BC22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BC22BE

Part of subcall function 00BC29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00BCD7D1,00000000,00000000,00000000,00000000,?,00BCD7F8,00000000,00000007,00000000,?,00BCDBF5,00000000), ref: 00BC29DE
Part of subcall function 00BC29C8: GetLastError.KERNEL32(00000000,?,00BCD7D1,00000000,00000000,00000000,00000000,?,00BCD7F8,00000000,00000007,00000000,?,00BCDBF5,00000000,00000000), ref: 00BC29F0

_free.LIBCMT ref: 00BC22D0
_free.LIBCMT ref: 00BC22E3
_free.LIBCMT ref: 00BC22F4
_free.LIBCMT ref: 00BC2305

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0e8e5d417692e7ed38151338f13d2ba622267b6c7c7cbbcb0fd050b4658a0a30
Instruction ID: 2f0c33d3e611fdfe766d97b8ac4e6ec2da53455dbd59f53759905b2a8715f751
Opcode Fuzzy Hash: 0e8e5d417692e7ed38151338f13d2ba622267b6c7c7cbbcb0fd050b4658a0a30
Instruction Fuzzy Hash: 63F03A748402209F8A22AF95BC41F0D3BA4F718762718059EF850EA3B1CBB00952EFA5

Function 00BA95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00BA95D4
StrokeAndFillPath.GDI32(?,?,00BE71F7,00000000,?,?,?), ref: 00BA95F0
SelectObject.GDI32(?,00000000), ref: 00BA9603
DeleteObject.GDI32 ref: 00BA9616
StrokePath.GDI32(?), ref: 00BA9631

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 22a269555317b2579d9cf17734722ad476392628462742f7e710288ed9281500
Instruction ID: 554e1936601713e87e3750fa31c77541d8ae7e0b56faff142cdbf55cc919bd8c
Opcode Fuzzy Hash: 22a269555317b2579d9cf17734722ad476392628462742f7e710288ed9281500
Instruction Fuzzy Hash: 57F01930409304EBEB365F6AED5976C3BA5EB02322F0C8254F825554F0C7B089A6EFA0

Function 00BC0F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00BC10F9
__freea.LIBCMT ref: 00BC1117

Part of subcall function 00BC1537: _free.LIBCMT ref: 00BC154F

Strings

a/p, xrefs: 00BC11DE
am/pm, xrefs: 00BC117A

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 576b055ba4b23f48e3f96265a97294336456142c0134be9c6a370bde3430b8f3
Instruction ID: fc066244bdd765c76f7807b332b0099261df65f458e53b230c12756cbc5be4eb
Opcode Fuzzy Hash: 576b055ba4b23f48e3f96265a97294336456142c0134be9c6a370bde3430b8f3
Instruction Fuzzy Hash: 34D1F035900246EACB249F6CC895FBAB7F0EF47704F2849DDE901BB642D2359D80CBA5

Function 00C17B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00BB0242: EnterCriticalSection.KERNEL32(00C6070C,00C61884,?,?,00BA198B,00C62518,?,?,?,00B912F9,00000000), ref: 00BB024D
Part of subcall function 00BB0242: LeaveCriticalSection.KERNEL32(00C6070C,?,00BA198B,00C62518,?,?,?,00B912F9,00000000), ref: 00BB028A

Part of subcall function 00B99CB3: _wcslen.LIBCMT ref: 00B99CBD

Part of subcall function 00BB00A3: __onexit.LIBCMT ref: 00BB00A9

__Init_thread_footer.LIBCMT ref: 00C17BFB

Part of subcall function 00BB01F8: EnterCriticalSection.KERNEL32(00C6070C,?,?,00BA8747,00C62514), ref: 00BB0202
Part of subcall function 00BB01F8: LeaveCriticalSection.KERNEL32(00C6070C,?,00BA8747,00C62514), ref: 00BB0235

Strings

G, xrefs: 00C17C7F
Variable must be of type 'Object'., xrefs: 00C17C3A
5, xrefs: 00C17C78

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: 5b6d0d689f88bd9c64ad84befa29bc582717c55decb68154b5ab65882e4cd490
Instruction ID: 53246333011845ac8164ee6d5cbf3b4242ccb0f720f824eef0347e84bdbfd44b
Opcode Fuzzy Hash: 5b6d0d689f88bd9c64ad84befa29bc582717c55decb68154b5ab65882e4cd490
Instruction Fuzzy Hash: DF918C74A08209EFCB14EF94D8919FDB7B1FF4A300F108199F8169B291DB71AE85EB51

Function 00BF2716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFB403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00BF21D0,?,?,00000034,00000800,?,00000034), ref: 00BFB42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00BF2760

Part of subcall function 00BFB3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00BF21FF,?,?,00000800,?,00001073,00000000,?,?), ref: 00BFB3F8

Part of subcall function 00BFB32A: GetWindowThreadProcessId.USER32(?,?), ref: 00BFB355
Part of subcall function 00BFB32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00BF2194,00000034,?,?,00001004,00000000,00000000), ref: 00BFB365
Part of subcall function 00BFB32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00BF2194,00000034,?,?,00001004,00000000,00000000), ref: 00BFB37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00BF27CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00BF281A

Strings

@, xrefs: 00BF2832

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: da05396c62024831d5ad6475a4cac3c4411ff10f278d8adf8c08bf215622b82b
Instruction ID: b5d5cbab23133a69c64e5a141db838c74124777942da758bbccd30d0149e2a1e
Opcode Fuzzy Hash: da05396c62024831d5ad6475a4cac3c4411ff10f278d8adf8c08bf215622b82b
Instruction Fuzzy Hash: E741F97690021CAEDB10DBA4C986FEEBBB8EF09740F104095FA55B7191DB706E49CBA1

Function 00BC172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\rOrderRequest09-24.exe,00000104), ref: 00BC1769
_free.LIBCMT ref: 00BC1834
_free.LIBCMT ref: 00BC183E

Strings

C:\Users\user\Desktop\rOrderRequest09-24.exe, xrefs: 00BC1760, 00BC1767, 00BC1796, 00BC17CE

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\rOrderRequest09-24.exe
API String ID: 2506810119-2024235326
Opcode ID: 15af6035f7398e35b3c228b08974bf4ea937b83bbb53a4dd42c872499cee7d30
Instruction ID: fd2b06a3b572b43e68df96323075717a8ac8c17f12e7edc4aab8c1c73f927c61
Opcode Fuzzy Hash: 15af6035f7398e35b3c228b08974bf4ea937b83bbb53a4dd42c872499cee7d30
Instruction Fuzzy Hash: 42316475A44218AFDB21DF999C85F9EBBFCEB86310B1445EAF804E7212D6B04E40CB90

Function 00BFC27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00BFC306
DeleteMenu.USER32(?,00000007,00000000), ref: 00BFC34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00C61990,017F5500), ref: 00BFC395

Strings

0, xrefs: 00BFC2DF

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: d9593a2a4b83d064a1f7c53439de02d8da21493f194f23baf6908334ef17cf1c
Instruction ID: f1a5992726955d3b49bac26093a641257da823cbdcfcb8e440e0842a9371373e
Opcode Fuzzy Hash: d9593a2a4b83d064a1f7c53439de02d8da21493f194f23baf6908334ef17cf1c
Instruction Fuzzy Hash: 7E41B1312083099FD720DF25D984B6ABFE4EF85350F1086ADFAA5972D1D730E948CB5A

Function 00C24416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00C2CC08,00000000,?,?,?,?), ref: 00C244AA
GetWindowLongW.USER32 ref: 00C244C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00C244D7

Strings

SysTreeView32, xrefs: 00C2447C

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 77dd91d9b158401ec98141677f015e2c0eb65bcbd5eaaf92dcdd9981f626ac3a
Instruction ID: 14941805b68a802aa13ce11439125bc0b6609864c5020088d59e7dc2c772b6d6
Opcode Fuzzy Hash: 77dd91d9b158401ec98141677f015e2c0eb65bcbd5eaaf92dcdd9981f626ac3a
Instruction Fuzzy Hash: 0D319A31210225ABDB249E38EC85BEA7BA9EB09324F204325F975A25E0DB70ED519B50

Function 00C1304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00C1335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00C13077,?,?), ref: 00C13378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00C1307A
_wcslen.LIBCMT ref: 00C1309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00C13106

Strings

255.255.255.255, xrefs: 00C13095, 00C1309A

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 93b786ee24adc0a7b898923f0fd69621a8b24e6f075bba6338cea1ce8a534d5c
Instruction ID: 365bd91a29c029119b8e6194b8b1f81f6dadfbcc532e1ca26e867840238caadf
Opcode Fuzzy Hash: 93b786ee24adc0a7b898923f0fd69621a8b24e6f075bba6338cea1ce8a534d5c
Instruction Fuzzy Hash: 8331C6356002419FCB10CF69C585EE977E0EF56318F248099E9258B392D771DF85D760

Function 00C24653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00C24705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00C24713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00C2471A

Strings

msctls_updown32, xrefs: 00C24684

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: b9f2c6f9603ab137a2768542ae578135d8851813560c9040ecc3c600a5dde130
Instruction ID: 02d8fd83b51001a05e34602df614844c89475b01b64ddc476ce1c76f1fb59001
Opcode Fuzzy Hash: b9f2c6f9603ab137a2768542ae578135d8851813560c9040ecc3c600a5dde130
Instruction Fuzzy Hash: 83216DB5600218AFDB14DF68ECC1EBB37EDEF5A7A4B040059FA149B691CB70ED51CA60

Function 00BF95AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00BF961D

Strings

#OnAutoItStartRegister, xrefs: 00BF95F3
#notrayicon, xrefs: 00BF95B7
#requireadmin, xrefs: 00BF95D9

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: c9fab2b43f7decc25caf37de9c1c40af510b8aad6c9c71752a646388ad4b0989
Instruction ID: 77d9a88962cfde614e1fe1d82324dec3f799a363f930a47df009346b4949eefc
Opcode Fuzzy Hash: c9fab2b43f7decc25caf37de9c1c40af510b8aad6c9c71752a646388ad4b0989
Instruction Fuzzy Hash: 1421087220462967D731AA249C42FB773D8EF61710F1440BAFA49D7141EBA1DD4AC295

Function 00C237B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00C23840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00C23850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00C23876

Strings

Listbox, xrefs: 00C2380F

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 0369cc1145228656bc4eeaeb63d7c569aa382bfe5f32eb9417dc6eb955c797bf
Instruction ID: 06ad21ddbd3d8b6af1a6229bf62723e6522711d0674c139041e3134ad48e7695
Opcode Fuzzy Hash: 0369cc1145228656bc4eeaeb63d7c569aa382bfe5f32eb9417dc6eb955c797bf
Instruction Fuzzy Hash: 1F21BE72610228BBEF218F54EC85FAB376AEF89B50F118125F9109B590CA75DD528BA0

Function 00C049F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00C04A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00C04A5C
SetErrorMode.KERNEL32(00000000,?,?,00C2CC08), ref: 00C04AD0

Strings

%lu, xrefs: 00C04A6F

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: b0db9a6f19cc78794a187852b7c3717819771333ba838ff1595f7d50110446b2
Instruction ID: 1f1979e3f9084d72f2e9d44188ba288d0ae149f8f6271243c73e045f081e856b
Opcode Fuzzy Hash: b0db9a6f19cc78794a187852b7c3717819771333ba838ff1595f7d50110446b2
Instruction Fuzzy Hash: 96315375A00109AFDB10DF54C885EAE7BF8EF04304F1480A9F905DB252DB71EE46CB61

Function 00C241EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00C2424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00C24264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00C24271

Strings

msctls_trackbar32, xrefs: 00C24226

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: ffe0f12f271cf4174c0fda7077527fbd4874da381ecb7f25ce097afc4426abe1
Instruction ID: 529b9f9d2bd22f574f0be1cc9771821a42a51dd9d4f10a172ff4339f5812ed59
Opcode Fuzzy Hash: ffe0f12f271cf4174c0fda7077527fbd4874da381ecb7f25ce097afc4426abe1
Instruction Fuzzy Hash: E111E331240218BFEF205E29DC46FAB3BACEF95B54F010124FA55E2090D2B1D8619B20

Function 00BF2F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B96B57: _wcslen.LIBCMT ref: 00B96B6A

Part of subcall function 00BF2DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00BF2DC5
Part of subcall function 00BF2DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00BF2DD6
Part of subcall function 00BF2DA7: GetCurrentThreadId.KERNEL32 ref: 00BF2DDD
Part of subcall function 00BF2DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00BF2DE4

GetFocus.USER32 ref: 00BF2F78

Part of subcall function 00BF2DEE: GetParent.USER32(00000000), ref: 00BF2DF9

GetClassNameW.USER32(?,?,00000100), ref: 00BF2FC3
EnumChildWindows.USER32(?,00BF303B), ref: 00BF2FEB

Strings

%s%d, xrefs: 00BF2FFF

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 309f144f1b5dc97c2ed3fee0613ca26fd99bfcc519a380759a42c5a580254c7c
Instruction ID: a21a880c61d9a1062612565240dcc9420c5c4a9417856ed085ee1e47b4bda560
Opcode Fuzzy Hash: 309f144f1b5dc97c2ed3fee0613ca26fd99bfcc519a380759a42c5a580254c7c
Instruction Fuzzy Hash: 2011AF756002096BDF157F708CC6FFE77EAAF84304F0480B5BA099B292DE70994E8B60

Function 00C25882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00C258C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00C258EE
DrawMenuBar.USER32(?), ref: 00C258FD

Strings

0, xrefs: 00C2588F

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 03691622dd1d12f6731758b3bef8bc6ba930ad5c4f216ce58f6a9634da634ca7
Instruction ID: 572b62ec84fbf95a032753a4e00448a8059a1be664725404d270a867b6e633fe
Opcode Fuzzy Hash: 03691622dd1d12f6731758b3bef8bc6ba930ad5c4f216ce58f6a9634da634ca7
Instruction Fuzzy Hash: 70018C31514228EFDB21AF51EC44BEFBBB4FF45360F1080AAE849D6151DB308A85EF21

Function 00BF007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35b918d2384d66ddf360cdafba14523846ab4eac1e9dd7c89de7fbce3d3e4b97
Instruction ID: 9a5ee2254eaaa2ffae47e7e929966c1e0e391225a9f4f833746aed5d9613513c
Opcode Fuzzy Hash: 35b918d2384d66ddf360cdafba14523846ab4eac1e9dd7c89de7fbce3d3e4b97
Instruction Fuzzy Hash: 9AC13975A1020AAFDB14DFA4C894ABEB7F5FF48704F108598E605EB262D731EE45CB90

Function 00BC3E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00BC3F0B
__alldvrm.LIBCMT ref: 00BC410C
__alldvrm.LIBCMT ref: 00BC412E

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: 59e67491aa03013542cf34ad6da1d518a9bfc78a7976e257fdb5715e4fe8a73f
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: 68A13571E003869FDB21CF18C8A1FAABFE5EF65350F1885EEE5959B281C3348A81C750

Function 00C1342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00C13459
CoUninitialize.OLE32 ref: 00C13463
VariantInit.OLEAUT32(?), ref: 00C1346E
VariantClear.OLEAUT32(?), ref: 00C1371B

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: 4827c7d134f7a352be19f4ae1e93969e966bed125cfe5654969d496132a8b82e
Instruction ID: b211b7de1b5eb41a59ae74fdedfb89a445bce3f738bbc55cb7d98b6d575a99dc
Opcode Fuzzy Hash: 4827c7d134f7a352be19f4ae1e93969e966bed125cfe5654969d496132a8b82e
Instruction Fuzzy Hash: A6A19E752183009FCB00DF24C495A6AB7E5FF89714F05889DF98A9B362DB30EE45DB91

Function 00BF0436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00C2FC08,?), ref: 00BF05F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00C2FC08,?), ref: 00BF0608
CLSIDFromProgID.OLE32(?,?,00000000,00C2CC40,000000FF,?,00000000,00000800,00000000,?,00C2FC08,?), ref: 00BF062D
_memcmp.LIBVCRUNTIME ref: 00BF064E

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 47a6be3ff3ef736d8d1fe202204e407550aee5aed94a6d384019e65097f53c8c
Instruction ID: cb87660c8f08a37b051d234229cce887fed06080bb7b890e505c4342cf3d3eae
Opcode Fuzzy Hash: 47a6be3ff3ef736d8d1fe202204e407550aee5aed94a6d384019e65097f53c8c
Instruction Fuzzy Hash: 95810C71910109EFCB04DF94C984EEEB7F9FF89315F104598E606AB261DB71AE0ACB60

Function 00BD1391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00BD14C0

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 84e17144be1c89b3d88510fd80161b6c7686d426f31d46324e1754d7693a4fc9
Instruction ID: 39c60ce0e7d8ea2ce55e51de54dcd808cd74dff938b61ce2ea26ae9ca5a1148a
Opcode Fuzzy Hash: 84e17144be1c89b3d88510fd80161b6c7686d426f31d46324e1754d7693a4fc9
Instruction Fuzzy Hash: 6F414935600501BBDB256FBD9C86BBEBAE4EF41330F144AEBF418D2392F6B448415E61

Function 00C26278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(017FE998,?), ref: 00C262E2
ScreenToClient.USER32(?,?), ref: 00C26315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00C26382

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 656b2f1ec8300de0b3646faf00244ff61b3de68b77182ee2581ba3a595cd2bc8
Instruction ID: 36ff27c22fc86120ea120fb418cb762b82604a95f365272b88ce2eccb16d375c
Opcode Fuzzy Hash: 656b2f1ec8300de0b3646faf00244ff61b3de68b77182ee2581ba3a595cd2bc8
Instruction Fuzzy Hash: 78513E74900219EFDF20DF68E880AAE7BB5FF45360F148169F925976A0D730EE41CBA0

Function 00C11AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00C11AFD
WSAGetLastError.WSOCK32 ref: 00C11B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00C11B8A
WSAGetLastError.WSOCK32 ref: 00C11B94

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 763fc02ef411bed7965cdce34fac5d22ee29847c4f9eaaff53c0ed5920c64b9a
Instruction ID: 098153d0d0df49dc2172a72353c6c9cd29cc76dca06f15adaedb0cda0ea1e1a5
Opcode Fuzzy Hash: 763fc02ef411bed7965cdce34fac5d22ee29847c4f9eaaff53c0ed5920c64b9a
Instruction Fuzzy Hash: F441E574600200AFDB20AF24C886F697BE5AB45718F54C498FA199F3D3D776ED818B90

Function 00BCB41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0baabd312509e4be4f4e7bfb9cae52e28de860b01cbf0e5f4144ce5de8a65c26
Instruction ID: db473704c02c605ae1e0d2e564b315ebb659ccb11adf864d530a61cde657a702
Opcode Fuzzy Hash: 0baabd312509e4be4f4e7bfb9cae52e28de860b01cbf0e5f4144ce5de8a65c26
Instruction Fuzzy Hash: BC41B075A04704AFD7289F78CC42FAEBBE9EB88710F1045AEF551DB382D77199018790

Function 00C056D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00C05783
GetLastError.KERNEL32(?,00000000), ref: 00C057A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00C057CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00C057FA

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 50b8fd7921556580260449359dac0743d16601e37ac3595a024f25f62eb190e7
Instruction ID: b697b5770d798dd125602f1a0ffb8643db4d163e26b69f65f9db805042e65451
Opcode Fuzzy Hash: 50b8fd7921556580260449359dac0743d16601e37ac3595a024f25f62eb190e7
Instruction Fuzzy Hash: 46412935214610DFCB10DF15C594A1EBBE2EF99720B19C498E85AAB3A2CB30FD01CB91

Function 00BCD8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,00BB6D71,00000000,00000000,00BB82D9,?,00BB82D9,?,00000001,00BB6D71,8BE85006,00000001,00BB82D9,00BB82D9), ref: 00BCD910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00BCD999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00BCD9AB
__freea.LIBCMT ref: 00BCD9B4

Part of subcall function 00BC3820: RtlAllocateHeap.NTDLL(00000000,?,00C61444,?,00BAFDF5,?,?,00B9A976,00000010,00C61440,00B913FC,?,00B913C6,?,00B91129), ref: 00BC3852

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 6c50932e719375932ceca5aaa058b88bb7e79643de9aa39044c9a73c185b49d9
Instruction ID: 701294212315e119b6262a08f0b42fad9d679e90ee751eafd7fab6cf93ddb05a
Opcode Fuzzy Hash: 6c50932e719375932ceca5aaa058b88bb7e79643de9aa39044c9a73c185b49d9
Instruction Fuzzy Hash: 97319A76A0020AABDF249F64DC85FEE7BE5EB41710B0542ACFC04D6291EB75CD51CBA0

Function 00C252C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00C25352
GetWindowLongW.USER32(?,000000F0), ref: 00C25375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00C25382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00C253A8

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: ee771b78d800c11df57dcdcebe929381cbd8d7155093888b66ade8c68124f6e1
Instruction ID: 54ce70d72f30ee0044b9d8d1f5294a7250b435f4ac03ff4a3ccd9ac2f5b3b603
Opcode Fuzzy Hash: ee771b78d800c11df57dcdcebe929381cbd8d7155093888b66ade8c68124f6e1
Instruction Fuzzy Hash: 2D31C534A55A28EFEB30DF14EC45BEA37A5AB04390F586101FA21969F1C7B09E409B51

Function 00BFAB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,7707C0D0,?,00008000), ref: 00BFABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 00BFAC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 00BFAC74
SendInput.USER32(00000001,?,0000001C,7707C0D0,?,00008000), ref: 00BFACC6

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 9d8b0856b340fc587a666881ba4a48b6d3710f4ed3826263651ced6013816b78
Instruction ID: ec59327b2ee3e01efed330ab6679bdb77365d5d81d67b5e620614aff42d85633
Opcode Fuzzy Hash: 9d8b0856b340fc587a666881ba4a48b6d3710f4ed3826263651ced6013816b78
Instruction Fuzzy Hash: BB3128B0A0071C6FEF38CB658C447FE7BE5EB49310F04429AE689531D0C375998D8752

Function 00C27674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00C2769A
GetWindowRect.USER32(?,?), ref: 00C27710
PtInRect.USER32(?,?,00C28B89), ref: 00C27720
MessageBeep.USER32(00000000), ref: 00C2778C

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 6cbf68717c2afefc77b98f9a1f6ee0683ce90bad866ca025163462be045d6042
Instruction ID: aac94abe5d78166ce1cc349633c8197b4efb89868be423b7661b42dd48136f88
Opcode Fuzzy Hash: 6cbf68717c2afefc77b98f9a1f6ee0683ce90bad866ca025163462be045d6042
Instruction Fuzzy Hash: D0418D346052259FCB22CF59E8D4FAD77F4BB48B14F1842A8E8249B661C770AA41DF90

Function 00C216DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00C216EB

Part of subcall function 00BF3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00BF3A57
Part of subcall function 00BF3A3D: GetCurrentThreadId.KERNEL32 ref: 00BF3A5E
Part of subcall function 00BF3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00BF25B3), ref: 00BF3A65

GetCaretPos.USER32(?), ref: 00C216FF
ClientToScreen.USER32(00000000,?), ref: 00C2174C
GetForegroundWindow.USER32 ref: 00C21752

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: e7cfb55d237e615f9fd7b05f1f5ade9b61511e8167964f0bcca97701df8ef444
Instruction ID: 5c55676110ad08bd56ecd1d4a29e4247f4137099f3e72b10342aad9935962f22
Opcode Fuzzy Hash: e7cfb55d237e615f9fd7b05f1f5ade9b61511e8167964f0bcca97701df8ef444
Instruction Fuzzy Hash: 83315475D00149AFCB10DFAAC8C1DAEBBF9EF48304B5480A9E415E7611E731DE45CBA0

Function 00BFD4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00BFD501
Process32FirstW.KERNEL32(00000000,?), ref: 00BFD50F
Process32NextW.KERNEL32(00000000,?), ref: 00BFD52F
CloseHandle.KERNEL32(00000000), ref: 00BFD5DC

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: cb033c9e0770c2bae81dcb95fb25b410a1477bd0a5252ab82c54cd74713d6e9f
Instruction ID: bf7869d6de85c23b12a891924f6bfc37df1ea38a56fc453ebbe48da6ca209b43
Opcode Fuzzy Hash: cb033c9e0770c2bae81dcb95fb25b410a1477bd0a5252ab82c54cd74713d6e9f
Instruction Fuzzy Hash: 6231AD310083049FD710EF64C881BBFBBE8EF99354F10096DF581831A1EB719949CBA2

Function 00C28FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00BA9BB2

GetCursorPos.USER32(?), ref: 00C29001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00BE7711,?,?,?,?,?), ref: 00C29016
GetCursorPos.USER32(?), ref: 00C2905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00BE7711,?,?,?), ref: 00C29094

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: b2b967525c3c67944d639577177c2831193602de57b71052be0336271eda5ad8
Instruction ID: 070857a8237e0ccab6728f81046b50480f804db72a40a854aea555cc51ecd278
Opcode Fuzzy Hash: b2b967525c3c67944d639577177c2831193602de57b71052be0336271eda5ad8
Instruction Fuzzy Hash: 3B21BF31600028EFCB258F95D898FFE3BB9FF89360F044165F91587661C7319A50EB60

Function 00BFD2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00C2CB68), ref: 00BFD2FB
GetLastError.KERNEL32 ref: 00BFD30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 00BFD319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00C2CB68), ref: 00BFD376

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: d70eb67cb1961374943691b40f9b77b26ca750d8a7bfce87b7e4efc485273177
Instruction ID: 42c4af0dafeedc79db95f2ae525a605496bdfb8a5baea9702b5e989099d5a367
Opcode Fuzzy Hash: d70eb67cb1961374943691b40f9b77b26ca750d8a7bfce87b7e4efc485273177
Instruction Fuzzy Hash: 9D21D1705082059F8710DF28C88197E77E5EE5A364F104AADF699C32A1DB30D90ACB97

Function 00BF1571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00BF102A
Part of subcall function 00BF1014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00BF1036
Part of subcall function 00BF1014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00BF1045
Part of subcall function 00BF1014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00BF104C
Part of subcall function 00BF1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00BF1062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00BF15BE
_memcmp.LIBVCRUNTIME ref: 00BF15E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00BF1617
HeapFree.KERNEL32(00000000), ref: 00BF161E

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 025190ad1e9aa9a3ec5b18e89399e72081642779b2bd0a110def9e17b6500cb6
Instruction ID: d83a8b1e704f727af26c9983290790ff63cdd07c5553e5c584828daa957753b6
Opcode Fuzzy Hash: 025190ad1e9aa9a3ec5b18e89399e72081642779b2bd0a110def9e17b6500cb6
Instruction Fuzzy Hash: CE215731E00108EBDB10DFA8C945BFEB7F8EF54344F084899E541AB241E731AA09CBA0

Function 00C22782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00C2280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00C22824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00C22832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00C22840

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 9b2d4710b7493cda77f1bf1b26f98ac44a7eb464e4f49824ef0691969b4a9fd8
Instruction ID: 7b580f1041428e9b76bd12bf71fcdc600f29b64fae76e23e5a9989ddb1ade0ce
Opcode Fuzzy Hash: 9b2d4710b7493cda77f1bf1b26f98ac44a7eb464e4f49824ef0691969b4a9fd8
Instruction Fuzzy Hash: 1621D335208121BFD7249B24DC84FAA7B95EF45324F148258F4268BAE2CB75FD82CB90

Function 00BF78F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF8D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00BF790A,?,000000FF,?,00BF8754,00000000,?,0000001C,?,?), ref: 00BF8D8C
Part of subcall function 00BF8D7D: lstrcpyW.KERNEL32(00000000,?,?,00BF790A,?,000000FF,?,00BF8754,00000000,?,0000001C,?,?,00000000), ref: 00BF8DB2
Part of subcall function 00BF8D7D: lstrcmpiW.KERNEL32(00000000,?,00BF790A,?,000000FF,?,00BF8754,00000000,?,0000001C,?,?), ref: 00BF8DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00BF8754,00000000,?,0000001C,?,?,00000000), ref: 00BF7923
lstrcpyW.KERNEL32(00000000,?,?,00BF8754,00000000,?,0000001C,?,?,00000000), ref: 00BF7949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00BF8754,00000000,?,0000001C,?,?,00000000), ref: 00BF7984

Strings

cdecl, xrefs: 00BF797B

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 588baefed0a7391af89897c7822b6c873bb1a622dbe727196e9b741213fdb69e
Instruction ID: ab4e1d951d4b9eb9c009f472006b5134e514ce9aa2c35f350f22b0bff04e18da
Opcode Fuzzy Hash: 588baefed0a7391af89897c7822b6c873bb1a622dbe727196e9b741213fdb69e
Instruction Fuzzy Hash: 0211033A200206BBDB259F34CC45E7E77E9FF95350B4080AAFA02C72A4EF719815C7A1

Function 00C27CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00C27D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00C27D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00C27D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00C0B7AD,00000000), ref: 00C27D6B

Part of subcall function 00BA9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00BA9BB2

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 46bd4bfa5b22e35a6d5f2fecca9d6cccdf2e8ca2b52896285bc8a6aaff9d11da
Instruction ID: 88cb5d5b5c1e40bb104dec26143ca0ebfe2b784830b161148f69d874f6ee1a11
Opcode Fuzzy Hash: 46bd4bfa5b22e35a6d5f2fecca9d6cccdf2e8ca2b52896285bc8a6aaff9d11da
Instruction Fuzzy Hash: 0411DF31214625AFCB208F29EC84BAA3BA5AF45370F294724FC39C76F0D7309A11DB50

Function 00C25660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 00C256BB
_wcslen.LIBCMT ref: 00C256CD
_wcslen.LIBCMT ref: 00C256D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00C25816

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: 35450aefe4fbd968376f0bef4c900463fbc65c36b0142a0619bb0b3009584549
Instruction ID: b95fca6c36e301dd958870a2a27a70388b8fc15f8d85943f07a4b967dc232b69
Opcode Fuzzy Hash: 35450aefe4fbd968376f0bef4c900463fbc65c36b0142a0619bb0b3009584549
Instruction Fuzzy Hash: 3C11D3716006289ADF20EF66EC85BFF77ACEF10760B504066F925D6581E7B0CA80CB64

Function 00BC1D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28a2258fa1fa6c4d2b8646b9670439abbf4b5e16d1c2f52440622476c39abeb5
Instruction ID: 1adb16a0a71406f63db34150a7fc75d557d0b003396830f98cf22e7a698cff83
Opcode Fuzzy Hash: 28a2258fa1fa6c4d2b8646b9670439abbf4b5e16d1c2f52440622476c39abeb5
Instruction Fuzzy Hash: 9B012CB2205A167EF621167C6CC1F6B669DDF423B8B3507BDF532611D6DB708C5051B0

Function 00BF1A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00BF1A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00BF1A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00BF1A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00BF1A8A

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: fbae3920d7537b2684180f632b19728b0dfd54a4bb3c8c257d0f659b37ed19d2
Instruction ID: 9ceb8fae89df4f0cff6bc5f06d2f32659bfb3c2df21297e755142070fdc040f9
Opcode Fuzzy Hash: fbae3920d7537b2684180f632b19728b0dfd54a4bb3c8c257d0f659b37ed19d2
Instruction Fuzzy Hash: 4E11393AD01219FFEB10DFA9CD85FADBBB8EB08750F200491EA10B7290D6716E50DB94

Function 00BFE1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00BFE1FD
MessageBoxW.USER32(?,?,?,?), ref: 00BFE230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00BFE246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00BFE24D

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 4eb76c80bde85f0a219f57173fe3c3f8f313ac7f198739a8b0651269729f79f0
Instruction ID: f89fb722459058045167ad635ad287bc112d37e8b50080059acd23c08f04a7db
Opcode Fuzzy Hash: 4eb76c80bde85f0a219f57173fe3c3f8f313ac7f198739a8b0651269729f79f0
Instruction Fuzzy Hash: 74110872904258BBD7119BA9DC45BBE7FECEB45321F184665F925D33A0E6B0C90487A0

Function 00BBD1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,00BBCFF9,00000000,00000004,00000000), ref: 00BBD218
GetLastError.KERNEL32 ref: 00BBD224
__dosmaperr.LIBCMT ref: 00BBD22B
ResumeThread.KERNEL32(00000000), ref: 00BBD249

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 33305cd9056e9859503658d79dc11d15f3a349aee2929b7dd18cd364e9d5e3c7
Instruction ID: 9e32554524b0241fcfeb6409a66c03617625da72d9012c0f4bc2f5997eeac38f
Opcode Fuzzy Hash: 33305cd9056e9859503658d79dc11d15f3a349aee2929b7dd18cd364e9d5e3c7
Instruction Fuzzy Hash: AB01D6364052057BCB215BA5DC45BFE7AE9DF81330F100299F925921E0EBB58901C7A0

Function 00C29EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00BA9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00BA9BB2

GetClientRect.USER32(?,?), ref: 00C29F31
GetCursorPos.USER32(?), ref: 00C29F3B
ScreenToClient.USER32(?,?), ref: 00C29F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00C29F7A

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: b8add116e7b85ae823282f7f7d73080c2a95073148f42ac584df1ea93aef7911
Instruction ID: 0b28d71ac28376b0d3f05d04d396f9848e9975fdf0b4cc99100f02f62b25c8a0
Opcode Fuzzy Hash: b8add116e7b85ae823282f7f7d73080c2a95073148f42ac584df1ea93aef7911
Instruction Fuzzy Hash: 10115E3190012AABDB60DF98E985AEE77B8FF05311F000451F921E3950D734BB92DBA1

Function 00B9600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00B9604C
GetStockObject.GDI32(00000011), ref: 00B96060
SendMessageW.USER32(00000000,00000030,00000000), ref: 00B9606A

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 5f67a6c09e6f377080c4bea8a0681a0349bd81117a28c99a1d2a681d4f3958a8
Instruction ID: 0bc174717c794602be2f267b11eab5de0d211994264c96b6f04ee094f13870c2
Opcode Fuzzy Hash: 5f67a6c09e6f377080c4bea8a0681a0349bd81117a28c99a1d2a681d4f3958a8
Instruction Fuzzy Hash: 2E116172501508BFEF264F949CD4FEEBBA9EF18794F040155FA1452120D7329C60DB90

Function 00BB3B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00BB3B56

Part of subcall function 00BB3AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00BB3AD2
Part of subcall function 00BB3AA3: ___AdjustPointer.LIBCMT ref: 00BB3AED

_UnwindNestedFrames.LIBCMT ref: 00BB3B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00BB3B7C
CallCatchBlock.LIBVCRUNTIME ref: 00BB3BA4

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 00af5686bcfaf775c2a3ce53718c40c7171a09d2adea251486a865479ac2f2d0
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: E6012932100148BBDF126E95CC42EFB7BE9FF48B54F044094FE4856121C772E961EBA0

Function 00BC3073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00B913C6,00000000,00000000,?,00BC301A,00B913C6,00000000,00000000,00000000,?,00BC328B,00000006,FlsSetValue), ref: 00BC30A5
GetLastError.KERNEL32(?,00BC301A,00B913C6,00000000,00000000,00000000,?,00BC328B,00000006,FlsSetValue,00C32290,FlsSetValue,00000000,00000364,?,00BC2E46), ref: 00BC30B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00BC301A,00B913C6,00000000,00000000,00000000,?,00BC328B,00000006,FlsSetValue,00C32290,FlsSetValue,00000000), ref: 00BC30BF

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 22a98468e9ab2925c81d8351371185ceee32624f969214be949e7a737310b100
Instruction ID: d2e289c2ac9441fc4afa68e3f3ec735ea213aca0a43dbe63c4fcb2a1f9d016cf
Opcode Fuzzy Hash: 22a98468e9ab2925c81d8351371185ceee32624f969214be949e7a737310b100
Instruction Fuzzy Hash: C501FC33311622ABC7314B79AC84F6F77D8EF05F61B548668F956E3140C721D901C6D0

Function 00BF7464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 00BF747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00BF7497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00BF74AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00BF74CA

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: eea32a155257a2ca89f2e540ff1bd29426e1dacb2d1fa9189daad099271857e2
Instruction ID: 3a6bde8ad3336e1ad8fb118b8610ec3916a09a60257fd3e423a98597a810eb2d
Opcode Fuzzy Hash: eea32a155257a2ca89f2e540ff1bd29426e1dacb2d1fa9189daad099271857e2
Instruction Fuzzy Hash: 29118EB12453199BE7309F14EC49BAA7BFCEB00B00F1085E9A616D7691DB70E908DB90

Function 00BFB0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00BFACD3,?,00008000), ref: 00BFB0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00BFACD3,?,00008000), ref: 00BFB0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00BFACD3,?,00008000), ref: 00BFB0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00BFACD3,?,00008000), ref: 00BFB126

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: ccd563167d51f58107006604eafe5a8aecf9cc0c078c8723b50ab866e5d9d1b8
Instruction ID: abb5ba49c82264e6f54ad5baf78ebad9305b6fdd6d141a4dbd4dfa45545ed979
Opcode Fuzzy Hash: ccd563167d51f58107006604eafe5a8aecf9cc0c078c8723b50ab866e5d9d1b8
Instruction Fuzzy Hash: 0D113931C11A2CE7CF10AFA4E9A9BFEBBB8FF09711F104085DA41B3581CB3096698B51

Function 00BF2DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00BF2DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00BF2DD6
GetCurrentThreadId.KERNEL32 ref: 00BF2DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00BF2DE4

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 4e2201af38eae128f74cf6ff992467fffbc94ddc56686d6df44289c2dce44df0
Instruction ID: 9cfed1fb0c2625757101b28ebf80b1199216b94de2f92edd6ea85f217d3b508e
Opcode Fuzzy Hash: 4e2201af38eae128f74cf6ff992467fffbc94ddc56686d6df44289c2dce44df0
Instruction Fuzzy Hash: 1CE09271111628BBE7301B729C8EFFF7EACEF42BA1F400165F605D24809AA4C846C6F0

Function 00C28863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00BA9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00BA9693
Part of subcall function 00BA9639: SelectObject.GDI32(?,00000000), ref: 00BA96A2
Part of subcall function 00BA9639: BeginPath.GDI32(?), ref: 00BA96B9
Part of subcall function 00BA9639: SelectObject.GDI32(?,00000000), ref: 00BA96E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00C28887
LineTo.GDI32(?,?,?), ref: 00C28894
EndPath.GDI32(?), ref: 00C288A4
StrokePath.GDI32(?), ref: 00C288B2

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 7d13ad17a1e525de4dfa96f11872406eb02b1b95c5fa03e8a33989eaa877c22a
Instruction ID: 39c3afb5d22c765a0e4da14f979a2b446c5c0fca1c40f5612407468acf5122ee
Opcode Fuzzy Hash: 7d13ad17a1e525de4dfa96f11872406eb02b1b95c5fa03e8a33989eaa877c22a
Instruction Fuzzy Hash: 50F05E36046668FAEB225F94AC0AFCE3F59AF06711F088000FA11654E1C7B55622DFE5

Function 00BA98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00BA98CC
SetTextColor.GDI32(?,?), ref: 00BA98D6
SetBkMode.GDI32(?,00000001), ref: 00BA98E9
GetStockObject.GDI32(00000005), ref: 00BA98F1

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: dfc11b0847e847ced0fc1550c6358a81c112c382dca7ee9ee8b0037f6ba497d9
Instruction ID: 3206dd5ca1fb8cd4ddd87ab9e157be324eda02abeb7d88a999d4f09b38a0f536
Opcode Fuzzy Hash: dfc11b0847e847ced0fc1550c6358a81c112c382dca7ee9ee8b0037f6ba497d9
Instruction Fuzzy Hash: 13E09B31254680BEDB315B79FC49BDD3F60EB12336F048259F6F5544E1C7714651AB11

Function 00BF162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00BF1634
OpenThreadToken.ADVAPI32(00000000,?,?,?,00BF11D9), ref: 00BF163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00BF11D9), ref: 00BF1648
OpenProcessToken.ADVAPI32(00000000,?,?,?,00BF11D9), ref: 00BF164F

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: a72f42eb8d440480b87ac639136aab6008c2d45080fe11f7fea8915575122e33
Instruction ID: f96597f2fbed797ec6e0a7116386adee3547c758d388d69ae50bc1d98fb10b85
Opcode Fuzzy Hash: a72f42eb8d440480b87ac639136aab6008c2d45080fe11f7fea8915575122e33
Instruction Fuzzy Hash: B6E08631611211EBD7301FA49D4DB9E3BBCEF44791F144C48F345CA090D6344446C754

Function 00BED858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00BED858
GetDC.USER32(00000000), ref: 00BED862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00BED882
ReleaseDC.USER32(?), ref: 00BED8A3

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: ead80dc47653dd0f20bba9c9ef9ed3090db6ae6c720976978baa051314bc7371
Instruction ID: 00f4fde927e780548967ff18cd04085514e1aae76e4d94372d3862962fb4811e
Opcode Fuzzy Hash: ead80dc47653dd0f20bba9c9ef9ed3090db6ae6c720976978baa051314bc7371
Instruction Fuzzy Hash: 44E01AB5810204DFCF619FA0D88876DBBF1FB08710F108059F81AE7650C7384902AF40

Function 00BED86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00BED86C
GetDC.USER32(00000000), ref: 00BED876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00BED882
ReleaseDC.USER32(?), ref: 00BED8A3

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: c63b2c0fddd20979527a9f3fbae1fdbdbafdd12548a5ac2b0e8f7c82e556882d
Instruction ID: 1c30e495ad11ec13535eabedaa2edbf386000340c98aa7ea4748cb5a9bbf3906
Opcode Fuzzy Hash: c63b2c0fddd20979527a9f3fbae1fdbdbafdd12548a5ac2b0e8f7c82e556882d
Instruction Fuzzy Hash: C6E012B5C10200EFCF60AFA0D88876DBBF1FB08710B108049F81AE7A50CB385902AF80

Function 00C04D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00B97620: _wcslen.LIBCMT ref: 00B97625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00C04ED4

Strings

*, xrefs: 00C04E10
LPT, xrefs: 00C04DFB

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: cbaf63e1e084dae27bbbd5de8a96e4c4c0edac4f82bc141fd0a96473da9d0ba8
Instruction ID: a42d8ffe18f4e2ff9c53f9e8332980509c04c087694f31c2f34704cb7c58e84b
Opcode Fuzzy Hash: cbaf63e1e084dae27bbbd5de8a96e4c4c0edac4f82bc141fd0a96473da9d0ba8
Instruction Fuzzy Hash: 259182B5A042059FCB18DF98C484EAABBF1FF44304F158099E51A9F3A2C731EE85CB90

Function 00BBE27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00BBE30D

Strings

pow, xrefs: 00BBE2E5, 00BBE302

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: ebdab6ca711e2183ea04c92a23009ac4ad340a9d30f9c1481300689eff813a69
Instruction ID: f728110e329872580a9802bc3f9c6d63c8a49cc579c1c6c5dbfaaf55bb8c6ca6
Opcode Fuzzy Hash: ebdab6ca711e2183ea04c92a23009ac4ad340a9d30f9c1481300689eff813a69
Instruction Fuzzy Hash: 93514BB1A5C10297CB127714C941BFE2BE8EB40741F3489ECE4A6822B9DF74CC959E86

Function 00BAE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 00BAE1B1

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: dde52f816dbbeca0171a2184c69a757997b97943753ac4d2e91eb930ee5c01e9
Instruction ID: 326f62e52febf6ebc7863063281b53bc7030665f2a25bfed6c40919db8961454
Opcode Fuzzy Hash: dde52f816dbbeca0171a2184c69a757997b97943753ac4d2e91eb930ee5c01e9
Instruction Fuzzy Hash: 3A51EF755043869FDB25DF69C481ABE7BE4EF66310F244099ECA19B290DB34DD42CBA0

Function 00BAF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00BAF2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 00BAF2BB

Strings

@, xrefs: 00BAF2AF

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 14034d88396d86c4dc415a5d6e10d52b6a12363e151db0f27b2215d4a46fc2fb
Instruction ID: af403ac4e002d351b63519ca75f71c56f3e479a51a8bfe237977e4e12e474c95
Opcode Fuzzy Hash: 14034d88396d86c4dc415a5d6e10d52b6a12363e151db0f27b2215d4a46fc2fb
Instruction Fuzzy Hash: 035137724187449BD720AF21DC86BAFBBF8FB85300F81889DF1D941195EB708569CB66

Function 00C15745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 00C157E0
_wcslen.LIBCMT ref: 00C157EC

Strings

CALLARGARRAY, xrefs: 00C157E6, 00C157EB

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 88eee079cd43b4faefb55d078c969da7df89f8a2c462951f325d8ae02f47f8c2
Instruction ID: 002f1908e43e29954f39a908d599aa0ff559cc2e7224bb89c61e2ebf32dc4ffa
Opcode Fuzzy Hash: 88eee079cd43b4faefb55d078c969da7df89f8a2c462951f325d8ae02f47f8c2
Instruction Fuzzy Hash: 66418C71A40209DFDB14DFA9C8819FEBBF5FF9A324F104069E515A7291EB309E81DB90

Function 00C0D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00C0D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00C0D13A

Strings

|, xrefs: 00C0D10B

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: 96be5f2024dbdee6a12144ff8c2b84baef0d332ff13290d844a6a3ead53a7cf0
Instruction ID: 3d3b1de9259ba2a8b4e79f2c6952b4368db3d3d19bfbc272d2c098136fcc2cda
Opcode Fuzzy Hash: 96be5f2024dbdee6a12144ff8c2b84baef0d332ff13290d844a6a3ead53a7cf0
Instruction Fuzzy Hash: 74311D71D00219ABCF15EFA5CC85AEE7FB9FF04350F100069F815A6166DB31AA56DB50

Function 00C2356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00C23621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00C2365C

Strings

static, xrefs: 00C235BC

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: fa1d2c7b6ea2f8f18d98a71fbbe1150047cf159e2d1ccc5704e7eb0e2a031adb
Instruction ID: 51fc62df71d5106e049267137e8e85dfbd73eea927d5f82e817b54ed334e51d1
Opcode Fuzzy Hash: fa1d2c7b6ea2f8f18d98a71fbbe1150047cf159e2d1ccc5704e7eb0e2a031adb
Instruction Fuzzy Hash: 56319071110654AEDB20DF28EC80FFB73ADFF48720F108619F9A997290DA35AD91D760

Function 00C24537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00C2461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00C24634

Strings

', xrefs: 00C2458E

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 05b3da2e4537f0f3c8e75e0491fa6a397fe0d04cd120d1f84004e080e1c6be96
Instruction ID: afa0af8052c960a02420d673d60f4e05a9e97965203ca11f913a361674c40629
Opcode Fuzzy Hash: 05b3da2e4537f0f3c8e75e0491fa6a397fe0d04cd120d1f84004e080e1c6be96
Instruction Fuzzy Hash: B93139B4A003199FDF18CFA9D980BDA7BB5FF09300F14406AE904AB741D770AA41CF90

Function 00C231EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00C2327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00C23287

Strings

Combobox, xrefs: 00C23249

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 22decc1cb3c33d4cacb2057db9014f57b046d676013e503a54c906f96b306872
Instruction ID: 3280ec928110c0edf743311519a15827876cc9e7ff13957699183402eea837bd
Opcode Fuzzy Hash: 22decc1cb3c33d4cacb2057db9014f57b046d676013e503a54c906f96b306872
Instruction Fuzzy Hash: 3211E271300258BFEF21DE54EC80FBB3B6AEB98364F100124F928A7692D6759E518760

Function 00C23710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00B9600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00B9604C
Part of subcall function 00B9600E: GetStockObject.GDI32(00000011), ref: 00B96060
Part of subcall function 00B9600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00B9606A

GetWindowRect.USER32(00000000,?), ref: 00C2377A
GetSysColor.USER32(00000012), ref: 00C23794

Strings

static, xrefs: 00C23757

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 218ea6a2b9cbb6e76d14557253d705e5e5c3f2bcdea5b14ae677ae5df15cee94
Instruction ID: 67cd85696d28256c7ffbc965580af5ed36e1d7609fa7c12085c0e03c73425735
Opcode Fuzzy Hash: 218ea6a2b9cbb6e76d14557253d705e5e5c3f2bcdea5b14ae677ae5df15cee94
Instruction Fuzzy Hash: 6B1159B2610219AFDF10DFA8DC85AEE7BB8FB08304F004524F965E2250D774E911DB50

Function 00C0CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00C0CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00C0CDA6

Strings

<local>, xrefs: 00C0CD66

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 1634ff44a925b87e20362cb41550769e171235ead0e82151bbded82bb03b1365
Instruction ID: 04e142739af7a517c72fd9b5a643e15817d5d0b0fbc16fda53c38c09efd69a66
Opcode Fuzzy Hash: 1634ff44a925b87e20362cb41550769e171235ead0e82151bbded82bb03b1365
Instruction Fuzzy Hash: 5611A071215731BAD7384B668CC9FE7BEA8EF127A4F00433AF119830C0E6609A55D6F0

Function 00C23429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00C234AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00C234BA

Strings

edit, xrefs: 00C2348F

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: f071982b5bae7ffa6f36ff98f851c913bc8622ddf25ab5a791b432cc92e827be
Instruction ID: 56ca97956b7a9eadcc2f6b2996c8ed04438f56e31601270c23a11646f48249b1
Opcode Fuzzy Hash: f071982b5bae7ffa6f36ff98f851c913bc8622ddf25ab5a791b432cc92e827be
Instruction Fuzzy Hash: 9D11BF71100168ABEB22AE64EC84BAB3B6AEB05374F504364FA70939D0C779DE519B60

Function 00BF6C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00B99CB3: _wcslen.LIBCMT ref: 00B99CBD

CharUpperBuffW.USER32(?,?,?), ref: 00BF6CB6
_wcslen.LIBCMT ref: 00BF6CC2

Strings

STOP, xrefs: 00BF6CBC, 00BF6CC1

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: d9b2ed6334da0453f0b828a3dce704074910f3e6f700ec9e83f2cca250411764
Instruction ID: c9499928a11322e2d635f27e474624c50f62a5a378ed6bb871ecf2fe7418b1d5
Opcode Fuzzy Hash: d9b2ed6334da0453f0b828a3dce704074910f3e6f700ec9e83f2cca250411764
Instruction Fuzzy Hash: AA01C032A1052E9BCB20AFFDDC809BF77F5EB6171071005B8EEA297195EB31D948C650

Function 00BF1CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B99CB3: _wcslen.LIBCMT ref: 00B99CBD

Part of subcall function 00BF3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00BF3CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00BF1D4C

Strings

ComboBox, xrefs: 00BF1CEB
ListBox, xrefs: 00BF1D16

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 38d782c1cd24dabc3b326b2fdd44058b7cc28a6bfe8f3ba6c2381b1a013cbb83
Instruction ID: 2dfddc53e1bb51c5941ba75fc556bd721d4dfe4e1f8a09400e8c0811d3aea4ee
Opcode Fuzzy Hash: 38d782c1cd24dabc3b326b2fdd44058b7cc28a6bfe8f3ba6c2381b1a013cbb83
Instruction Fuzzy Hash: 0B01B579601218EB8F14EBA8CC559FE73F8EB46350B040DAEF932672D1EA31590C8660

Function 00BF1BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B99CB3: _wcslen.LIBCMT ref: 00B99CBD

Part of subcall function 00BF3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00BF3CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00BF1C46

Strings

ComboBox, xrefs: 00BF1BE5
ListBox, xrefs: 00BF1C10

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: ffd32d69bd5eb9cf4618eab1cc6a0d925d9397b5325b20220d285fd1caf2deeb
Instruction ID: 7e59dc17675602b2d6b1f99f13bb401ffccc3689e84b30571fbc6aba0dae0c8a
Opcode Fuzzy Hash: ffd32d69bd5eb9cf4618eab1cc6a0d925d9397b5325b20220d285fd1caf2deeb
Instruction Fuzzy Hash: 9201A77568110CA7CF14EBA8CDA5AFF77E8DB11340F1408ADFA1677281EA209E0CC6B5

Function 00BF1C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B99CB3: _wcslen.LIBCMT ref: 00B99CBD

Part of subcall function 00BF3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00BF3CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00BF1CC8

Strings

ComboBox, xrefs: 00BF1C69
ListBox, xrefs: 00BF1C94

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: dd24dbf0023b2999f14706b9e24e9822cf7286e29fddf7ba59efdf3f863184e1
Instruction ID: e4e860d0983ea4c10384477770542fcd55d6e519de0a66c8f77827c541215fd2
Opcode Fuzzy Hash: dd24dbf0023b2999f14706b9e24e9822cf7286e29fddf7ba59efdf3f863184e1
Instruction Fuzzy Hash: 1601D675A8021CA7CF14EBA9CE51AFE77E8DB11380F1408A9F91277281EA219F0CC671

Function 00BF1D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B99CB3: _wcslen.LIBCMT ref: 00B99CBD

Part of subcall function 00BF3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00BF3CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00BF1DD3

Strings

ComboBox, xrefs: 00BF1D75
ListBox, xrefs: 00BF1DA0

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 7917c97284b75356a009f4bc493c59e26ee64e954d4c20bebdcc0e8f0eb8fa1d
Instruction ID: 80ac9e43064924393e39c5db345fb2ab46e8403ba6a0417ac077aea9f0e4713f
Opcode Fuzzy Hash: 7917c97284b75356a009f4bc493c59e26ee64e954d4c20bebdcc0e8f0eb8fa1d
Instruction Fuzzy Hash: 5DF0A975A51218A7DF14E7A9CC95BFE77F8EB01750F040D79F922632C1DA60590C8264

Function 00C1747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00C17493
_wcslen.LIBCMT ref: 00C174B9

Strings

3, 3, 16, 1, xrefs: 00C17483

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 1375b39b22bdec248a1c4b957e36e3343c2dbcd0adc872878baa784d47491807
Instruction ID: cab303f2035e217cd962494cbd8f998e50cf2444d8e3b93aa6945b80ba5e8337
Opcode Fuzzy Hash: 1375b39b22bdec248a1c4b957e36e3343c2dbcd0adc872878baa784d47491807
Instruction Fuzzy Hash: 6CE02B062042201593311279ACC19FF56D9DFCA7A0714192BF9C1C2267EBD4CED1A3A0

Function 00BF0B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00BF0B23

Strings

AutoIt, xrefs: 00BF0B17
Error allocating memory., xrefs: 00BF0B1C

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 0688441605a829ce69f30fe975b52d2b8b6b672dec6f44055b7fff9141a89796
Instruction ID: 4d6d70bcbdcd8250cab4dc47c07fedfaaf40a9ef8921f9a5d7b495cc3b287f29
Opcode Fuzzy Hash: 0688441605a829ce69f30fe975b52d2b8b6b672dec6f44055b7fff9141a89796
Instruction Fuzzy Hash: AEE0D83124831826D22436947C43FDD7BC49F05F61F1004B6FB98558D38AE1649006EE

Function 00BB0D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00BAF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00BB0D71,?,?,?,00B9100A), ref: 00BAF7CE

IsDebuggerPresent.KERNEL32(?,?,?,00B9100A), ref: 00BB0D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00B9100A), ref: 00BB0D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00BB0D7F

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 6dfaa1e5bcd4f2d4ce912f5979158ef7877fdc641848f9b1c964d8fee9d78d28
Instruction ID: f813a1e12caf5e04cfa49a8f53a30bc69f30864ead289743b41c7e47e483a219
Opcode Fuzzy Hash: 6dfaa1e5bcd4f2d4ce912f5979158ef7877fdc641848f9b1c964d8fee9d78d28
Instruction Fuzzy Hash: 82E06DB02103118BD731AFBDE4483AA7BF0AF00740F0489BDE882C6AA1DBF4E4458B91

Function 00C03017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00C0302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00C03044

Strings

aut, xrefs: 00C03038

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 316009f0687996d1eaaa3122172d073d2b05d97ef0b6364fec598dabbcdac24a
Instruction ID: 72a62bacf676a461cae11c837dd2ddb8de865da31a3f721c76d58b4d254fa783
Opcode Fuzzy Hash: 316009f0687996d1eaaa3122172d073d2b05d97ef0b6364fec598dabbcdac24a
Instruction Fuzzy Hash: EFD05EB6500328A7DB30A7A4AC4EFCF3A6CDB04751F4002A1BA55E2091DEF49985CAD0

Function 00BED21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00BED220

Strings

%.3d, xrefs: 00BED22B
X64, xrefs: 00BED2A8

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: e2f0fd0c66f8c4c93fd4534dafd90ae8b1ddedc613a544d9db4658556fc0dd00
Instruction ID: 5e048cfea8ebc7b5b4ef3dad613fc5c12fe48cec8db01fcb1ac93ed61fe7156c
Opcode Fuzzy Hash: e2f0fd0c66f8c4c93fd4534dafd90ae8b1ddedc613a544d9db4658556fc0dd00
Instruction Fuzzy Hash: 88D01261808149E9CB5097E1DCC59BDB3FCAB09341F5084E2FA16A1050D764C5496B61

Function 00C22356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00C2236C
PostMessageW.USER32(00000000), ref: 00C22373

Part of subcall function 00BFE97B: Sleep.KERNEL32 ref: 00BFE9F3

Strings

Shell_TrayWnd, xrefs: 00C22365

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 6f701eb6cf2ea569ade8376a01ab9a21000bf174dfaab981c4e209fd98a0667f
Instruction ID: 4117a9a3b70484d2f0e5413ab31277d1b8a433de02fd0876abdbbd589b0e3019
Opcode Fuzzy Hash: 6f701eb6cf2ea569ade8376a01ab9a21000bf174dfaab981c4e209fd98a0667f
Instruction Fuzzy Hash: B9D0A932390300BAE274A7309C4FFCE66049B04B00F404A22B701AB0E0C8F0A8468A18

Function 00C22322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00C2232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00C2233F

Part of subcall function 00BFE97B: Sleep.KERNEL32 ref: 00BFE9F3

Strings

Shell_TrayWnd, xrefs: 00C22325

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 6a4175071132f1e55c7af80b9a394f460c97026c0e1493000545d6b95df69d89
Instruction ID: c17b67f9324a31c3b68c5b32287e7a1b9a65b61e5bc44fae4f0576ae09cc5984
Opcode Fuzzy Hash: 6a4175071132f1e55c7af80b9a394f460c97026c0e1493000545d6b95df69d89
Instruction Fuzzy Hash: C9D022363A4300B7E274B730DC4FFDE7A049B00B00F004A22B705AB0E0C8F0E846CA14

Function 00BCBDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00BCBE93
GetLastError.KERNEL32 ref: 00BCBEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00BCBEFC

Memory Dump Source

Source File: 00000000.00000002.1278100223.0000000000B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.1278024595.0000000000B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C2C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278228768.0000000000C52000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278293519.0000000000C5C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1278327041.0000000000C64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_rOrderRequest09-24.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 87b7f035214cbd65d79b4eed41a9d97658311e100f62d1efe69b96098876017b
Instruction ID: 0d878cc2ab85293b481917ac5ff10d92b313b2a0def41edb3acda32fe28610fc
Opcode Fuzzy Hash: 87b7f035214cbd65d79b4eed41a9d97658311e100f62d1efe69b96098876017b
Instruction Fuzzy Hash: 0C41AE35600216ABDF218FA4CC86FBE7BE5EF41720F1441ADF9599B2A1DB308D05CB61

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report rOrderRequest09-24.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\wherefore

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

Windows Analysis Report
rOrderRequest09-24.exe

Function 00B942DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Function 00B942A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Function 00BD2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Function 00B92CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Function 00BD065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Function 00B9344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00B92B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Function 00B93170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Function 03F74650 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 00B92C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 03F74400 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 151
fileCOMMON

Function 00B93B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Function 03F732F0 Relevance: 6.7, APIs: 4, Instructions: 720
processthreadCOMMON

Function 00B93923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94
windowCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre