Edit tour

Windows Analysis Report
QuickTextPaste.exe

Overview

General Information

Sample name:	QuickTextPaste.exe
Analysis ID:	1562564
MD5:	1fdc72504c644ec1fcc368c24f12d94d
SHA1:	fb77c3f53398a7781de54ae0596fed19ed7524a4
SHA256:	07fdc5476b30c54df6fbb7991f855d6c9ee1d15e000e4966c06f8f2f3951b381
Tags:	Compilazioneprotetticopyrightexeuser-JAMESWT_MHT
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (creates a PE file in dynamic memory)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to register a low level keyboard hook

Drops large PE files

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to simulate keystroke presses

Contains long sleeps (>= 3 min)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

QuickTextPaste.exe (PID: 7320 cmdline: "C:\Users\user\Desktop\QuickTextPaste.exe" MD5: 1FDC72504C644EC1FCC368C24F12D94D)

csc.exe (PID: 7588 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["45.32.146.65"], "Port": 6868, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1626571461.0000000002182000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.1626571461.0000000002182000.00000040.00001000.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6f82:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x701f:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7134:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6df4:$cnc4: POST / HTTP/1.1
00000003.00000002.3849434803.0000000005002000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000003.00000002.3849434803.0000000005002000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6f82:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x701f:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7134:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6df4:$cnc4: POST / HTTP/1.1
00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7ca8:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7d45:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7e5a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7b1a:$cnc4: POST / HTTP/1.1
Process Memory Space: QuickTextPaste.exe PID: 7320	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: csc.exe PID: 7588	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.csc.exe.5000000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
3.2.csc.exe.5000000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7182:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x721f:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7334:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6ff4:$cnc4: POST / HTTP/1.1
0.2.QuickTextPaste.exe.49eb26.1.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.QuickTextPaste.exe.49eb26.1.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7182:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x721f:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7334:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6ff4:$cnc4: POST / HTTP/1.1
0.2.QuickTextPaste.exe.2180000.2.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.QuickTextPaste.exe.2180000.2.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7182:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x721f:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7334:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6ff4:$cnc4: POST / HTTP/1.1
0.2.QuickTextPaste.exe.49eb26.1.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.QuickTextPaste.exe.49eb26.1.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x5382:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x541f:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x5534:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x51f4:$cnc4: POST / HTTP/1.1
0.2.QuickTextPaste.exe.400000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.QuickTextPaste.exe.400000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x78ea8:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x78f45:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7905a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x78d1a:$cnc4: POST / HTTP/1.1
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Pictures\DesktopInfo\Bin\DesktopInfo.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\QuickTextPaste.exe, ProcessId: 7320, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DesktopInfo

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ProcessId: 7588, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Suricata Signatures

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T18:06:07.898238+0100	2853193	1	Malware Command and Control Activity Detected	192.168.2.9	49716	45.32.146.65	6868	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: QuickTextPaste.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\Pictures\DesktopInfo\Bin\DesktopInfo.exe

Avira: detection malicious, Label: TR/Crypt.XPACK.Gen2

Found malware configuration

Source: 00000003.00000002.3864228386.00000000070C1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Xworm {"C2 url": ["45.32.146.65"], "Port": 6868, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Multi AV Scanner detection for submitted file

Source: QuickTextPaste.exe

ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 3.2.csc.exe.5000000.0.unpack	String decryptor: 45.32.146.65
Source: 3.2.csc.exe.5000000.0.unpack	String decryptor: 6868
Source: 3.2.csc.exe.5000000.0.unpack	String decryptor: <123456789>
Source: 3.2.csc.exe.5000000.0.unpack	String decryptor: <Xwormmm>
Source: 3.2.csc.exe.5000000.0.unpack	String decryptor: XWorm V5.6
Source: 3.2.csc.exe.5000000.0.unpack	String decryptor: USB.exe
Source: 3.2.csc.exe.5000000.0.unpack	String decryptor: %AppData%
Source: 3.2.csc.exe.5000000.0.unpack	String decryptor: XClient.exe

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\QuickTextPaste.exe

Unpacked PE file: 0.2.QuickTextPaste.exe.2180000.2.unpack

Source: QuickTextPaste.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source:	Binary string: StrongNameFreeBufferStrongNameTokenFromPublicKeyStrongNameErrorInfo.PDBdiasymreader.dllDllGetClassObject%X%X%X%X%X%X%X%X%X%X%X.TMP0x%016I64xCSCalink.dll with IAlink3 source: csc.exe, 00000003.00000003.1625309005.00000000080E6000.00000004.00000800.00020000.00000000.sdmp, XClient.exe.3.dr
Source:	Binary string: csc.pdb source: csc.exe, 00000003.00000003.1625309005.00000000080E6000.00000004.00000800.00020000.00000000.sdmp, XClient.exe.3.dr
Source:	Binary string: csc.pdbF source: csc.exe, 00000003.00000003.1625309005.00000000080E6000.00000004.00000800.00020000.00000000.sdmp, XClient.exe.3.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.9:49709 -> 45.32.146.65:6868
Source: Network traffic	Suricata IDS: 2853193 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.9:49716 -> 45.32.146.65:6868

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 45.32.146.65

Source: global traffic

TCP traffic: 192.168.2.9:49709 -> 45.32.146.65:6868

Source: Joe Sandbox View

ASN Name: AS-CHOOPAUS AS-CHOOPAUS

Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65
Source: unknown	TCP traffic detected without corresponding DNS query: 45.32.146.65

Source: csc.exe, 00000003.00000002.3864228386.00000000070C1000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\Desktop\QuickTextPaste.exe

Code function: 0_2_00426601 SetWindowsHookExW 0000000D,0041ED8B,00000000,00000000

0_2_00426601

Source: C:\Users\user\Desktop\QuickTextPaste.exe

Code function: 0_2_00433F0D OpenClipboard,RegisterClipboardFormatW,GetClipboardData,GlobalLock,CloseClipboard,

0_2_00433F0D

Source: C:\Users\user\Desktop\QuickTextPaste.exe

Code function: 0_2_00433F0D OpenClipboard,RegisterClipboardFormatW,GetClipboardData,GlobalLock,CloseClipboard,

0_2_00433F0D

Source: C:\Users\user\Desktop\QuickTextPaste.exe

Code function: 0_2_004324DC IsWindow,GetKeyboardState,GetKeyboardState,keybd_event,keybd_event,SetForegroundWindow,GetKeyboardState,keybd_event,

0_2_004324DC

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.csc.exe.5000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.QuickTextPaste.exe.49eb26.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.QuickTextPaste.exe.2180000.2.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.QuickTextPaste.exe.49eb26.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.QuickTextPaste.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.1626571461.0000000002182000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000003.00000002.3849434803.0000000005002000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Drops large PE files

Source: C:\Users\user\Desktop\QuickTextPaste.exe

File dump: DesktopInfo.exe.0.dr 979567349

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\QuickTextPaste.exe	Code function: 0_2_00406EBE	0_2_00406EBE
Source: C:\Users\user\Desktop\QuickTextPaste.exe	Code function: 0_2_0040691A	0_2_0040691A
Source: C:\Users\user\Desktop\QuickTextPaste.exe	Code function: 0_2_00402A35	0_2_00402A35
Source: C:\Users\user\Desktop\QuickTextPaste.exe	Code function: 0_2_0040EB7D	0_2_0040EB7D
Source: C:\Users\user\Desktop\QuickTextPaste.exe	Code function: 0_2_0041E397	0_2_0041E397
Source: C:\Users\user\Desktop\QuickTextPaste.exe	Code function: 0_2_0040EBBA	0_2_0040EBBA
Source: C:\Users\user\Desktop\QuickTextPaste.exe	Code function: 0_2_0040747A	0_2_0040747A
Source: C:\Users\user\Desktop\QuickTextPaste.exe	Code function: 0_2_00402CBF	0_2_00402CBF
Source: C:\Users\user\Desktop\QuickTextPaste.exe	Code function: 0_2_0040759C	0_2_0040759C
Source: C:\Users\user\Desktop\QuickTextPaste.exe	Code function: 0_2_00402D9D	0_2_00402D9D
Source: C:\Users\user\Desktop\QuickTextPaste.exe	Code function: 0_2_0040EE30	0_2_0040EE30
Source: C:\Users\user\Desktop\QuickTextPaste.exe	Code function: 0_2_0041EF19	0_2_0041EF19
Source: C:\Users\user\Desktop\QuickTextPaste.exe	Code function: 0_2_0040EF2D	0_2_0040EF2D
Source: C:\Users\user\Desktop\QuickTextPaste.exe	Code function: 0_2_004067E0	0_2_004067E0
Source: C:\Users\user\Desktop\QuickTextPaste.exe	Code function: 0_2_00402FF2	0_2_00402FF2
Source: C:\Users\user\Desktop\QuickTextPaste.exe	Code function: 0_2_00402FF8	0_2_00402FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_0573B7F8	3_2_0573B7F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05738FD0	3_2_05738FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05734138	3_2_05734138
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05731030	3_2_05731030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_057398A0	3_2_057398A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05733B40	3_2_05733B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05738C88	3_2_05738C88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Code function: 3_2_05731610	3_2_05731610

Source: C:\Users\user\Desktop\QuickTextPaste.exe

Code function: String function: 00437C80 appears 38 times

Source: QuickTextPaste.exe	Binary or memory string: OriginalFilename vs QuickTextPaste.exe
Source: QuickTextPaste.exe, 00000000.00000002.1626571461.0000000002182000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs QuickTextPaste.exe
Source: QuickTextPaste.exe, 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs QuickTextPaste.exe

Source: QuickTextPaste.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 3.2.csc.exe.5000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.QuickTextPaste.exe.49eb26.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.QuickTextPaste.exe.2180000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.QuickTextPaste.exe.49eb26.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.QuickTextPaste.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.1626571461.0000000002182000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000003.00000002.3849434803.0000000005002000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: 0.2.QuickTextPaste.exe.49eb26.1.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QuickTextPaste.exe.49eb26.1.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QuickTextPaste.exe.49eb26.1.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/3@0/1

Source: C:\Users\user\Desktop\QuickTextPaste.exe

Code function: 0_2_00426601 GetModuleHandleW,SetWindowsHookExW,GetLastError,FormatMessageW,MessageBoxW,LocalFree,

0_2_00426601

Source: C:\Users\user\Desktop\QuickTextPaste.exe

File created: C:\Users\user\Pictures\DesktopInfo

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Mutant created: \Sessions\1\BaseNamedObjects\2IZ7P3Po0yEtvO09

Source: QuickTextPaste.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\QuickTextPaste.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: QuickTextPaste.exe

ReversingLabs: Detection: 60%

Source: QuickTextPaste.exe	String found in binary or memory: <!--StartFrag
Source: QuickTextPaste.exe	String found in binary or memory: <!--StartFragment-->
Source: QuickTextPaste.exe	String found in binary or memory: EndSelectionStartSelection<!--EndFragEndFragment<!--StartFragStartFragmentEndHTML%08u<html>StartHTML<!--EndFragment--></body>
Source: QuickTextPaste.exe	String found in binary or memory: <!--StartFragment-->HTML Format

Source: C:\Users\user\Desktop\QuickTextPaste.exe

File read: C:\Users\user\Desktop\QuickTextPaste.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\QuickTextPaste.exe "C:\Users\user\Desktop\QuickTextPaste.exe"
Source: C:\Users\user\Desktop\QuickTextPaste.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Users\user\Desktop\QuickTextPaste.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"	Jump to behavior

Source: C:\Users\user\Desktop\QuickTextPaste.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QuickTextPaste.exe	Section loaded: k7rn7l32.dll	Jump to behavior
Source: C:\Users\user\Desktop\QuickTextPaste.exe	Section loaded: ntd3ll.dll	Jump to behavior
Source: C:\Users\user\Desktop\QuickTextPaste.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\QuickTextPaste.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: winmm.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: XClient.lnk.3.dr

LNK file: ..\..\..\..\..\XClient.exe

Source:	Binary string: StrongNameFreeBufferStrongNameTokenFromPublicKeyStrongNameErrorInfo.PDBdiasymreader.dllDllGetClassObject%X%X%X%X%X%X%X%X%X%X%X.TMP0x%016I64xCSCalink.dll with IAlink3 source: csc.exe, 00000003.00000003.1625309005.00000000080E6000.00000004.00000800.00020000.00000000.sdmp, XClient.exe.3.dr
Source:	Binary string: csc.pdb source: csc.exe, 00000003.00000003.1625309005.00000000080E6000.00000004.00000800.00020000.00000000.sdmp, XClient.exe.3.dr
Source:	Binary string: csc.pdbF source: csc.exe, 00000003.00000003.1625309005.00000000080E6000.00000004.00000800.00020000.00000000.sdmp, XClient.exe.3.dr

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\QuickTextPaste.exe

Unpacked PE file: 0.2.QuickTextPaste.exe.2180000.2.unpack

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.QuickTextPaste.exe.49eb26.1.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.QuickTextPaste.exe.49eb26.1.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: 0.2.QuickTextPaste.exe.49eb26.1.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 0.2.QuickTextPaste.exe.49eb26.1.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 0.2.QuickTextPaste.exe.49eb26.1.raw.unpack, Messages.cs	.Net Code: Memory

Source: C:\Users\user\Desktop\QuickTextPaste.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Source: C:\Users\user\Desktop\QuickTextPaste.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"			Jump to behavior

Source: C:\Users\user\Desktop\QuickTextPaste.exe

Code function: 0_2_00434350 LoadLibraryW,GetProcAddress,

0_2_00434350

Source: QuickTextPaste.exe

Static PE information: real checksum: 0x844df should be: 0x10233d

Source: XClient.exe.3.dr

Static PE information: section name: .didat

Source: C:\Users\user\Desktop\QuickTextPaste.exe	Code function: 0_2_00437C80 push eax; ret		0_2_00437C9E
Source: C:\Users\user\Desktop\QuickTextPaste.exe	Code function: 0_2_00437CA0 push eax; ret		0_2_00437CCE

Source: QuickTextPaste.exe	Static PE information: section name: .text entropy: 6.817168827886
Source: DesktopInfo.exe.0.dr	Static PE information: section name: .text entropy: 6.817168827886

Source: C:\Users\user\Desktop\QuickTextPaste.exe	File created: C:\Users\user\Pictures\DesktopInfo\Bin\DesktopInfo.exe			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Roaming\XClient.exe			Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Jump to behavior

Source: C:\Users\user\Desktop\QuickTextPaste.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run DesktopInfo			Jump to behavior
Source: C:\Users\user\Desktop\QuickTextPaste.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run DesktopInfo			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 5730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 70C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 6DF0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Window / User API: threadDelayed 1433			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Window / User API: threadDelayed 8314			Jump to behavior

Source: C:\Users\user\Desktop\QuickTextPaste.exe

Dropped PE file which has not been started: C:\Users\user\Pictures\DesktopInfo\Bin\DesktopInfo.exe

Jump to dropped file

Source: C:\Users\user\Desktop\QuickTextPaste.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_0-9789

Source: C:\Users\user\Desktop\QuickTextPaste.exe

API coverage: 0.5 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7772	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7784	Thread sleep count: 1433 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe TID: 7784	Thread sleep count: 8314 > 30	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: csc.exe, 00000003.00000002.3853497945.00000000052F8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\QuickTextPaste.exe

Code function: 0_2_00434350 LoadLibraryW,GetProcAddress,

0_2_00434350

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\QuickTextPaste.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\QuickTextPaste.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 5000000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\QuickTextPaste.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 5000000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\QuickTextPaste.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 5000000			Jump to behavior
Source: C:\Users\user\Desktop\QuickTextPaste.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe base: 4C82008			Jump to behavior

Source: C:\Users\user\Desktop\QuickTextPaste.exe

Code function: 0_2_004324DC IsWindow,GetKeyboardState,GetKeyboardState,keybd_event,keybd_event,SetForegroundWindow,GetKeyboardState,keybd_event,

0_2_004324DC

Source: QuickTextPaste.exe	Binary or memory string: Shell_TrayWnd
Source: QuickTextPaste.exe, DesktopInfo.exe.0.dr	Binary or memory string: WidthBytes: %d bmWidth:%d bmBitsPixel:%d hb:%dNo-HBitmap<br>0};%d,UCHAR img_data[]={int ys=%d;int xs=%d;No HBITMAPShell_TrayWndTrayNotifyWndC:\shell32SetMenuInfoNULL
Source: QuickTextPaste.exe, DesktopInfo.exe.0.dr	Binary or memory string: GDtGDXGDHGDWorkerWSysListView32SHELLDLL_DefViewProgram ManagerUniformResourceLocatorToolbarWindow32SHAutoCompleteSHLWAPI.DLLBackInternet Explorer_Server

Source: C:\Users\user\Desktop\QuickTextPaste.exe	Code function: GetLocaleInfoW,		0_2_0043271F
Source: C:\Users\user\Desktop\QuickTextPaste.exe	Code function: GetLocaleInfoW,		0_2_004327AB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\QuickTextPaste.exe

Code function: 0_2_00421838 __EH_prolog,GetLocalTime,

0_2_00421838

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: csc.exe, 00000003.00000002.3865330103.000000000A4B0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3853497945.00000000053A5000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000003.00000002.3853497945.00000000052F8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 3.2.csc.exe.5000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QuickTextPaste.exe.49eb26.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QuickTextPaste.exe.2180000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QuickTextPaste.exe.49eb26.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QuickTextPaste.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1626571461.0000000002182000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3849434803.0000000005002000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QuickTextPaste.exe PID: 7320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: csc.exe PID: 7588, type: MEMORYSTR

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 3.2.csc.exe.5000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QuickTextPaste.exe.49eb26.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QuickTextPaste.exe.2180000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QuickTextPaste.exe.49eb26.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QuickTextPaste.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1626571461.0000000002182000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3849434803.0000000005002000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QuickTextPaste.exe PID: 7320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: csc.exe PID: 7588, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	21 Registry Run Keys / Startup Folder	32 Process Injection	1 Masquerading	111 Input Capture	1 System Time Discovery	Remote Services	111 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	21 Registry Run Keys / Startup Folder	11 Disable or Modify Tools	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Native API	Logon Script (Windows)	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	2 Clipboard Data	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	32 Process Injection	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Software Packing	DCSync	24 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
QuickTextPaste.exe	61%	ReversingLabs	Win32.Trojan.Leonem
QuickTextPaste.exe	100%	Avira	TR/Crypt.XPACK.Gen2

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\Pictures\DesktopInfo\Bin\DesktopInfo.exe	100%	Avira	TR/Crypt.XPACK.Gen2
C:\Users\user\AppData\Roaming\XClient.exe	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
45.32.146.65	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
45.32.146.65	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	csc.exe, 00000003.00000002.3864228386.00000000070C1000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.32.146.65	unknown	United States		20473	AS-CHOOPAUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562564
Start date and time:	2024-11-25 18:02:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	QuickTextPaste.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/3@0/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 71% Number of executed functions: 38 Number of non-executed functions: 87
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target csc.exe, PID 7588 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: QuickTextPaste.exe

Simulations

Behavior and APIs

Time	Type	Description
12:03:23	API Interceptor	6823129x Sleep call for process: csc.exe modified
17:03:24	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run DesktopInfo C:\Users\user\Pictures\DesktopInfo\Bin\DesktopInfo.exe
17:03:32	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run DesktopInfo C:\Users\user\Pictures\DesktopInfo\Bin\DesktopInfo.exe
17:03:41	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
45.32.146.65	03876399.exe	Get hash	malicious	Xmrig	Browse	accept-file.com/dashboard/para/un/api/endpoint.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-CHOOPAUS	WIN64BIT.exe	Get hash	malicious	MeshAgent	Browse	45.63.127.16
	WIN64BIT.exe	Get hash	malicious	MeshAgent	Browse	45.63.127.16
	ps1009.ps1	Get hash	malicious	Unknown	Browse	108.61.211.36
	dvLKUpkeV8.elf	Get hash	malicious	Unknown	Browse	45.77.39.16
	https://www.canva.com/design/DAGXCpgrUrs/iMtluWgvWDmsrSdUOsij5Q/view?utm_content=DAGXCpgrUrs&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	149.28.46.36
	arm.nn-20241120-0508.elf	Get hash	malicious	Mirai, Okiru	Browse	44.173.79.74
	Setup.exe	Get hash	malicious	Unknown	Browse	207.246.91.177
	owari.arm7.elf	Get hash	malicious	Mirai	Browse	45.32.45.196
	owari.ppc.elf	Get hash	malicious	Unknown	Browse	104.238.167.204
	0kToM9fVGQ.exe	Get hash	malicious	Xmrig	Browse	95.179.241.203

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Roaming\XClient.exe	res_out.exe	Get hash	malicious	XenoRAT	Browse

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Mon Nov 25 16:03:22 2024, mtime=Mon Nov 25 16:03:22 2024, atime=Mon Nov 25 16:03:22 2024, length=2141552, window=hide
Category:	dropped
Size (bytes):	763
Entropy (8bit):	5.062818943637931
Encrypted:	false
SSDEEP:	12:8/VN624oA/4f4tChSgedY//0tFctL2d8pVjAEqwNHkstmV:8/VN8TgsjgZN2dMhAEqwCstm
MD5:	6F6B57DDAF09191583BD5946E1998911
SHA1:	3FE4A82861D4BC05CFDE7475EED6074963B3060E
SHA-256:	8D7490D8038AF2DD8EF0455161CE117375A083EBA572B5867FA0F32487F4DB38
SHA-512:	D77E5FAF156E75C4C45C67C88070534D114E8F3D3B0506AB9DF1DE1085E7B54C0A15023F6FF086414E764894CF66323B9CAA74704895A4915F0046E39C1BD169
Malicious:	false
Reputation:	low
Preview:	L..................F.... .....@.[?....@.[?....@.[?..p. .....................v.:..DG..Yr?.D..U..k0.&...&.......bBDj...=#..[?....r.[?......t...CFSF..1.....EWsG..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EWsGyY\...........................=...A.p.p.D.a.t.a...B.V.1.....yY[...Roaming.@......EWsGyY[............................h..R.o.a.m.i.n.g.....b.2.p. .yYl. .XClient.exe.H......yYl.yYl......)....................}k..X.C.l.i.e.n.t...e.x.e.......X...............-.......W...........}.......C:\Users\user\AppData\Roaming\XClient.exe........\.....\.....\.....\.....\.X.C.l.i.e.n.t...e.x.e.`.......X.......849224...........hT..CrF.f4... ...E._c...,...E...hT..CrF.f4... ...E._c...,...E..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\XClient.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2141552
Entropy (8bit):	6.386741262990515
Encrypted:	false
SSDEEP:	49152:Mnqqr9wJI6S7RSSon9X6f4IeY0+h1s410I1xIdcxynt:Mnq29lFHon9X5Iddq41Lxry
MD5:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
SHA1:	DB402FB24B206C4A378A74FD649C60A413CE5A92
SHA-256:	38C407DBF41E99396B78D00DD796930D8838DCB4AF77C3F23BA0E800D1213EBE
SHA-512:	B7669D624366D1B2C0D162053DEE91AA2A319DEA90B32E314DD8C8ABC7306035C262454A500DEDA3EF9ED833D409E958CAD759D7925E8E352B499EB86A17E814
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: res_out.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c..'...'...'....).&....H..%.......%....H..%......#......(......)....(.)...........H..(...'...P............6.&.......&...Rich'...........PE..L...JC.].........."..........~....................@........................... ......T!...@... .. ...........................T..........L............l .pA.......C......T...........................H?..@............P......l...`....................text...`........................... ..`.data...tM..........................@....idata.......P......................@..@.didat..@....p......................@....tls................................@....rsrc...L............ ..............@..@.reloc...C.......D...(..............@..B........................................................................................................................................................................................................

C:\Users\user\Pictures\DesktopInfo\Bin\DesktopInfo.exe

Download File

Process:	C:\Users\user\Desktop\QuickTextPaste.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	979567349
Entropy (8bit):	0.018309622341759393
Encrypted:	false
SSDEEP:
MD5:	E501EFBC24F246944EE95644B388CF15
SHA1:	8870EA7C3D57A213A7962167450FAAC368561E65
SHA-256:	B28C5899FB149E638DB5634B08032C3DAFF4559113EF8F40BED2EC97722902C7
SHA-512:	3C0CB7A9AB7B14C435B695FC8FD01CA881EF45693975A1D1DF54ECF4AE2F21C050931715D93F6E04E2EB6FECAF2F5310A72AB9D1FF5CBDED77CB1CA57B104264
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........................................................9......._.....Rich...................PE..L.....7g.............................~............@..................................D...................................................i..........."...)..............................................................4............................text.............................. ..`.rdata...w.......x..................@..@.data........@..."... ..............@....rsrc....i.......j...B..............@..@................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.080290762638287
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	QuickTextPaste.exe
File size:	1'027'072 bytes
MD5:	1fdc72504c644ec1fcc368c24f12d94d
SHA1:	fb77c3f53398a7781de54ae0596fed19ed7524a4
SHA256:	07fdc5476b30c54df6fbb7991f855d6c9ee1d15e000e4966c06f8f2f3951b381
SHA512:	e214a4a09c6b8ad0526100d0d8e8bcfaf4b0844399e6b737d1740ac513eaf6e412d08e0ae74a1d69e5ee81f8d5ec35d16b3b937162eb8b5ae45ec275f300a88d
SSDEEP:	12288:H1JjmFIYq7Dmy8tTB8ELASLB71s9Nxr/3tgOTSGaOqlL9/d/Ce4+s6SeTEETRnLE:bye7etHLvLBhmZPtgtd4cLTEQNE
TLSH:	FD25AE007701852FD1AA78BA06ABA7F5AA691D761C334503725FBF2CEB38417E1117EE
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........................................................................9..........._.......Rich....................PE..L.....7g...

File Icon


Icon Hash:	0f2fcaabb0aaf830

Static PE Info

General

Entrypoint:	0x437ee0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x67371DD6 [Fri Nov 15 10:09:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e65d5d56989c1441945255d78668884e

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 0043D1E8h
push 00438066h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 68h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
xor ebx, ebx
mov dword ptr [ebp-04h], ebx
push 00000002h
pop edi
push edi
call 00007EFE14691DA1h
nop
pop ecx
or dword ptr [004808F4h], FFFFFFFFh
or dword ptr [004808F8h], FFFFFFFFh
call dword ptr [0043C330h]
mov ecx, dword ptr [004808C8h]
mov dword ptr [eax], ecx
call dword ptr [0043C2ACh]
mov ecx, dword ptr [004808C4h]
mov dword ptr [eax], ecx
mov eax, dword ptr [0043C234h]
mov eax, dword ptr [eax]
mov dword ptr [004808F0h], eax
call 00007EFE146C8DADh
cmp dword ptr [00456140h], ebx
jne 00007EFE146C8C6Eh
push 00438096h
call dword ptr [0043C238h]
pop ecx
call 00007EFE146C8D7Fh
push 004440ECh
push 004440E8h
call 00007EFE146C8D6Ah
mov eax, dword ptr [004808C0h]
mov dword ptr [ebp-6Ch], eax
lea eax, dword ptr [ebp-6Ch]
push eax
push dword ptr [004808BCh]
lea eax, dword ptr [ebp-64h]
push eax
lea eax, dword ptr [ebp-70h]
push eax
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [0043C240h]
push 004440E4h
push 00444000h

Rich Headers

Programming Language:

[C++] VS98 (6.0) SP6 build 8804
[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x418e8	0xdc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x81000	0xa6908	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x72200	0x2908	.data
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3c000	0x634	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3a2ea	0x3a400	556493db292203113e5324c6d7f95608	False	0.5195773538090128	data	6.817168827886	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x3c000	0x77cc	0x7800	91c6ff2fd3bb8dc0dd623e04098000ef	False	0.3382161458333333	data	4.707298007686286	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x44000	0x3c8fc	0x12200	044dced594e170048a01f833f33579cd	False	0.8952586206896552	data	7.634244653448693	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x81000	0xa6908	0xa6a00	e46c92bd2102032dc0d1beac94412508	False	0.5088044472055514	data	6.990670517689552	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x81f6c	0xefec	data			0.9566916313904266
TEXTINCLUDE	0x90f58	0x49	ASCII text, with CRLF line terminators			1.0136986301369864
RT_BITMAP	0x90fa4	0x3668	Device independent bitmap graphic, 512 x 54 x 4, image size 13824, 16 important colors	German	Germany	0.16082711085582999
RT_BITMAP	0x9460c	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128	German	Germany	0.3620689655172414
RT_BITMAP	0x946f4	0xd4	Device independent bitmap graphic, 18 x 9 x 4, image size 108	German	Germany	0.42924528301886794
RT_BITMAP	0x947c8	0x158	Device independent bitmap graphic, 32 x 15 x 4, image size 240	German	Germany	0.3081395348837209
RT_BITMAP	0x94920	0xd4	Device independent bitmap graphic, 18 x 9 x 4, image size 108, resolution 2867 x 2867 px/m, 16 important colors	German	Germany	0.6132075471698113
RT_BITMAP	0x949f4	0x3e8	Device independent bitmap graphic, 112 x 16 x 4, image size 896	German	Germany	0.303
RT_BITMAP	0x94ddc	0x4e8	Device independent bitmap graphic, 48 x 48 x 4, image size 1152	German	Germany	0.04856687898089172
RT_BITMAP	0x952c4	0x4e8	Device independent bitmap graphic, 48 x 48 x 4, image size 1152	German	Germany	0.04856687898089172
RT_BITMAP	0x957ac	0x4e8	Device independent bitmap graphic, 48 x 48 x 4, image size 1152	German	Germany	0.04856687898089172
RT_BITMAP	0x95c94	0x4e8	Device independent bitmap graphic, 48 x 48 x 4, image size 1152	German	Germany	0.04856687898089172
RT_BITMAP	0x9617c	0x1aa8	Device independent bitmap graphic, 128 x 105 x 4, image size 6720	German	Germany	0.011137162954279016
RT_BITMAP	0x97c24	0x4e8	Device independent bitmap graphic, 48 x 48 x 4, image size 1152	English	United States	0.04856687898089172
RT_BITMAP	0x9810c	0xd10	Device independent bitmap graphic, 144 x 45 x 4, image size 3240	German	Germany	0.0215311004784689
RT_BITMAP	0x98e1c	0x4e8	Device independent bitmap graphic, 48 x 48 x 4, image size 1152	German	Germany	0.04856687898089172
RT_ICON	0x99304	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	German	Germany	0.3398014440433213
RT_ICON	0x99bac	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	German	Germany	0.24783236994219654
RT_ICON	0x9a114	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	German	Germany	0.3783783783783784
RT_ICON	0x9a23c	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	German	Germany	0.1827956989247312
RT_ICON	0x9a524	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	German	Germany	0.2668918918918919
RT_ICON	0x9a64c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	German	Germany	0.7322695035460993
RT_ICON	0x9aab4	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	German	Germany	0.4294090056285178
RT_ICON	0x9bb5c	0x368	Device independent bitmap graphic, 16 x 32 x 24, image size 832	German	Germany	0.6353211009174312
RT_ICON	0x9bec4	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	German	Germany	0.5032833020637899
RT_ICON	0x9cf6c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	German	Germany	0.3432080924855491
RT_DIALOG	0x9d4d4	0xbc	data	German	Germany	0.7287234042553191
RT_DIALOG	0x9d590	0x98	data	German	Germany	0.7763157894736842
RT_DIALOG	0x9d628	0x5a	data	German	Germany	0.8111111111111111
RT_DIALOG	0x9d684	0xa4	data	German	Germany	0.7012195121951219
RT_DIALOG	0x9d728	0xa8	data	German	Germany	0.7797619047619048
RT_DIALOG	0x9d7d0	0x3b6	data	German	Germany	0.4610526315789474
RT_DIALOG	0x9db88	0x36	data	German	Germany	0.7962962962962963
RT_DIALOG	0x9dbc0	0xca	data	German	Liechtenstein	0.6782178217821783
RT_DIALOG	0x9dc8c	0xb6	data	German	Germany	0.6813186813186813
RT_DIALOG	0x9dd44	0x80	data	German	Germany	0.796875
RT_DIALOG	0x9ddc4	0x90	data	German	Germany	0.7361111111111112
RT_DIALOG	0x9de54	0x90	data	German	Germany	0.7361111111111112
RT_DIALOG	0x9dee4	0x90	data	German	Germany	0.7361111111111112
RT_DIALOG	0x9df74	0x90	data	German	Germany	0.7361111111111112
RT_DIALOG	0x9e004	0x90	data	German	Germany	0.7361111111111112
RT_DIALOG	0x9e094	0x90	data	German	Germany	0.7361111111111112
RT_DIALOG	0x9e124	0x90	data	German	Germany	0.7361111111111112
RT_DIALOG	0x9e1b4	0xa6	data	German	Germany	0.7469879518072289
RT_DIALOG	0x9e25c	0x90	data	German	Germany	0.7361111111111112
RT_DIALOG	0x9e2ec	0x90	data	German	Germany	0.7361111111111112
RT_DIALOG	0x9e37c	0x90	data	German	Germany	0.7361111111111112
RT_DIALOG	0x9e40c	0xf2	data			0.6776859504132231
RT_STRING	0x9e500	0x80	data	German	Germany	0.453125
RT_STRING	0x9e580	0x50	data	German	Germany	0.6625
RT_GROUP_ICON	0x9e5d0	0x22	data	German	Germany	0.9705882352941176
RT_GROUP_ICON	0x9e5f4	0x14	data	German	Germany	1.25
RT_GROUP_ICON	0x9e608	0x14	data	German	Germany	1.2
RT_GROUP_ICON	0x9e61c	0x14	data	German	Germany	1.2
RT_GROUP_ICON	0x9e630	0x14	data	German	Germany	1.25
RT_GROUP_ICON	0x9e644	0x14	data	German	Germany	1.25
RT_GROUP_ICON	0x9e658	0x14	data	German	Germany	1.2
RT_GROUP_ICON	0x9e66c	0x14	data	German	Germany	1.25
RT_GROUP_ICON	0x9e680	0x14	data	German	Germany	1.25
RT_VERSION	0x9e694	0x45c	data			0.3888888888888889
RT_VXD	0x9eaf0	0x8836	PC bitmap, Windows 3.x format, 5210 x 2 x 37, image size 35523, cbSize 34870, bits offset 54			0.7212503584743333
RT_ANIICON	0xa7328	0xcee3	PC bitmap, Windows 3.x format, 7149 x 2 x 42, image size 53618, cbSize 52963, bits offset 54			0.4219360685761758
RT_ANIICON	0xb420c	0x80d5	PC bitmap, Windows 3.x format, 4750 x 2 x 49, image size 32991, cbSize 32981, bits offset 54			0.4458324489857797
RT_ANIICON	0xbc2e4	0x9aea	PC bitmap, Windows 3.x format, 5872 x 2 x 46, image size 40456, cbSize 39658, bits offset 54			0.42732866004337083
RT_ANIICON	0xc5dd0	0x33edf	PC bitmap, Windows 3.x format, 27311 x 2 x 36, image size 213277, cbSize 212703, bits offset 54			0.4810510430036248
RT_ANIICON	0xf9cb0	0x2d78f	PC bitmap, Windows 3.x format, 23698 x 2 x 52, image size 186515, cbSize 186255, bits offset 54			0.4956591769348474
RT_MANIFEST	0x127440	0x334	XML 1.0 document, ASCII text, with CRLF line terminators			0.4975609756097561
None	0x127774	0xaa	data	German	Germany	0.40588235294117647
None	0x127820	0xaa	data	German	Germany	0.40588235294117647
None	0x1278cc	0xc	Windows metafile	German	Germany	1.5
None	0x1278d8	0xc	data	German	Germany	1.6666666666666667
None	0x1278e4	0x22	data	German	Germany	1.0

Imports

DLL	Import
KERNEL32.dll	GetStartupInfoW, CreateThread, TerminateThread, FindFirstFileW, FindClose, FormatMessageW, GetEnvironmentVariableW, GetComputerNameW, GetLocaleInfoW, Sleep, LocalFree, CreateMutexW, MulDiv, lstrcpynW, OutputDebugStringA, GetLocalTime, GetPrivateProfileStringW, WritePrivateProfileStringW, CreateDirectoryW, GetUserDefaultLangID, GetFileAttributesW, InitializeCriticalSection, DeleteCriticalSection, GlobalHandle, FreeResource, DeleteFileW, lstrcmpW, lstrcatW, CopyFileW, GetTempPathW, GetTimeZoneInformation, GetModuleFileNameW, GetModuleHandleW, GetCurrentThreadId, GetVersionExW, GlobalReAlloc, FindResourceW, LoadResource, LockResource, FreeLibrary, LoadLibraryW, GetProcAddress, lstrlenA, InterlockedDecrement, InterlockedIncrement, GetLastError, WriteFile, CreateFileW, GetFileSize, ReadFile, CloseHandle, OutputDebugStringW, lstrcmpiW, GlobalSize, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, GlobalLock, GlobalUnlock, GlobalFree, EnterCriticalSection, LeaveCriticalSection, lstrlenW, GetCurrentProcess, FlushInstructionCache, lstrcpyW, InterlockedExchange
USER32.dll	GetWindowRect, IsWindowVisible, FindWindowExW, PtInRect, GetCursorPos, ScreenToClient, GetWindowTextW, GetDlgCtrlID, GetScrollPos, SetWindowTextW, GetKeyState, SetFocus, LoadCursorW, SendMessageW, RegisterClassExW, CreateWindowExW, LoadImageW, GetWindowLongW, GetSysColor, DefWindowProcW, CallWindowProcW, SetMenuItemInfoW, EndDialog, SystemParametersInfoW, CharNextW, EnumClipboardFormats, GetClipboardFormatNameW, GetClipboardData, MessageBoxW, RegisterClipboardFormatW, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, SetWindowLongW, EnumChildWindows, CharLowerW, SetParent, CopyRect, DestroyWindow, PostQuitMessage, KillTimer, GetActiveWindow, SetTimer, DispatchMessageW, TranslateMessage, GetMessageW, PeekMessageW, CreateDialogParamW, GetSystemMetrics, MapWindowPoints, GetSysColorBrush, ReleaseDC, GetDC, GetClientRect, GetDlgItem, LoadBitmapW, SetWindowPos, ShowWindow, IsDialogMessageW, GetParent, IsChild, GetFocus, TrackPopupMenuEx, DestroyMenu, GetWindow, CreateDialogIndirectParamW, GetClassInfoExW, RegisterWindowMessageW, GetWindowTextLengthW, EndPaint, FillRect, BeginPaint, IsWindow, RedrawWindow, GetClassNameW, GetDesktopWindow, CreateAcceleratorTableW, wsprintfW, LoadStringW, ReleaseCapture, GetIconInfo, SetCapture, DrawAnimatedRects, DestroyIcon, CopyImage, GetKeyboardState, MessageBoxA, DrawEdge, GetCapture, SetCursor, GetMessagePos, GetSubMenu, SetRectEmpty, GetWindowPlacement, RegisterHotKey, UnregisterHotKey, UnhookWindowsHookEx, SetDlgItemTextW, GetDlgItemTextW, EnableWindow, IsCharLowerW, SendMessageA, EnableMenuItem, CheckMenuItem, GetForegroundWindow, GetWindowThreadProcessId, AttachThreadInput, GetCaretPos, SetRect, SetForegroundWindow, SetActiveWindow, GetMenuItemRect, GetMenuItemCount, GetMenuState, GetMenuItemID, CreatePopupMenu, CharUpperW, keybd_event, MapVirtualKeyW, DialogBoxParamW, GetDlgItemInt, UpdateWindow, LoadIconW, LoadAcceleratorsW, EnumWindows, SendMessageTimeoutW, AppendMenuW, DrawFocusRect, InflateRect, IntersectRect, IsRectEmpty, ClientToScreen, MoveWindow, PostMessageW, SetWindowsHookExW, CallNextHookEx, GetWindowDC, GetMenuItemInfoW, OffsetRect, SetPropW, InvalidateRgn, DrawTextW, InvalidateRect, CreateIconIndirect
GDI32.dll	LPtoDP, RestoreDC, LineTo, MoveToEx, CreatePen, SaveDC, DPtoLP, CreatePatternBrush, SetBitmapBits, GetBitmapBits, SetPixel, GetPixel, SetWindowOrgEx, GetBkColor, ExcludeClipRect, SetPixelV, GetTextExtentPoint32W, OffsetWindowOrgEx, GetClipBox, CreateSolidBrush, GetDeviceCaps, CreateDCW, CreateEnhMetaFileW, CloseEnhMetaFile, SelectPalette, RealizePalette, CreateCompatibleBitmap, GetCurrentObject, CreateBitmap, GetStockObject, SetBkMode, SetTextColor, GetDIBits, GetObjectW, CreateDIBSection, CreateCompatibleDC, SelectObject, SetBkColor, ExtTextOutW, CreateFontIndirectW, DeleteObject, BitBlt, DeleteDC, PatBlt
comdlg32.dll	GetOpenFileNameW
ADVAPI32.dll	CryptAcquireContextW, CryptDestroyHash, CryptReleaseContext, CryptHashData, CryptGetHashParam, RegDeleteValueW, RegSetValueExW, RegCloseKey, RegCreateKeyExW, RegQueryValueExW, RegOpenKeyW, GetUserNameW, CryptCreateHash, OpenProcessToken, GetTokenInformation, RegOpenKeyExW
SHELL32.dll	SHGetFileInfoW, SHAppBarMessage, Shell_NotifyIconW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, SHGetSpecialFolderPathW, ShellExecuteW, ShellExecuteExW
ole32.dll	RegisterDragDrop, CreateStreamOnHGlobal, CoInitialize, CoCreateInstance, OleInitialize, OleUninitialize, CLSIDFromProgID, CLSIDFromString, StringFromCLSID, OleLockRunning, CoTaskMemAlloc, DoDragDrop, CoTaskMemFree
OLEAUT32.dll	VariantTimeToSystemTime, OleCreateFontIndirect, SysAllocStringLen, SafeArrayDestroy, VariantInit, SafeArrayCreateVector, SafeArrayAccessData, SafeArrayUnaccessData, SysAllocString, SysStringLen, LoadRegTypeLib, DispCallFunc, VariantClear, SysFreeString, SystemTimeToVariantTime
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_GetIcon, ImageList_GetImageCount, ImageList_Create, ImageList_Add, ImageList_Draw, ImageList_LoadImageW, InitCommonControlsEx, ImageList_DrawEx

Possible Origin

Language of compilation system	Country where language is spoken	Map
German	Germany
English	United States
German	Liechtenstein

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-25T18:03:35.903281+0100	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.9	49709	45.32.146.65	6868	TCP
2024-11-25T18:06:07.898238+0100	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.9	49716	45.32.146.65	6868	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 18:03:23.869184017 CET	49709	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:03:23.990421057 CET	6868	49709	45.32.146.65	192.168.2.9
Nov 25, 2024 18:03:23.990551949 CET	49709	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:03:24.554229021 CET	49709	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:03:24.678538084 CET	6868	49709	45.32.146.65	192.168.2.9
Nov 25, 2024 18:03:35.903280973 CET	49709	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:03:36.024024010 CET	6868	49709	45.32.146.65	192.168.2.9
Nov 25, 2024 18:03:45.935614109 CET	6868	49709	45.32.146.65	192.168.2.9
Nov 25, 2024 18:03:45.938915968 CET	49709	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:03:49.540198088 CET	49709	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:03:49.541701078 CET	49710	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:03:49.660825014 CET	6868	49709	45.32.146.65	192.168.2.9
Nov 25, 2024 18:03:49.662334919 CET	6868	49710	45.32.146.65	192.168.2.9
Nov 25, 2024 18:03:49.662971020 CET	49710	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:03:50.353754044 CET	49710	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:03:50.475444078 CET	6868	49710	45.32.146.65	192.168.2.9
Nov 25, 2024 18:04:02.448378086 CET	49710	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:04:02.568770885 CET	6868	49710	45.32.146.65	192.168.2.9
Nov 25, 2024 18:04:11.608067036 CET	6868	49710	45.32.146.65	192.168.2.9
Nov 25, 2024 18:04:11.608145952 CET	49710	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:04:11.823463917 CET	49710	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:04:11.922255039 CET	49712	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:04:11.943888903 CET	6868	49710	45.32.146.65	192.168.2.9
Nov 25, 2024 18:04:12.212208033 CET	6868	49712	45.32.146.65	192.168.2.9
Nov 25, 2024 18:04:12.212291002 CET	49712	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:04:12.561500072 CET	49712	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:04:12.683285952 CET	6868	49712	45.32.146.65	192.168.2.9
Nov 25, 2024 18:04:26.991821051 CET	49712	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:04:27.112965107 CET	6868	49712	45.32.146.65	192.168.2.9
Nov 25, 2024 18:04:28.272924900 CET	49712	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:04:28.394092083 CET	6868	49712	45.32.146.65	192.168.2.9
Nov 25, 2024 18:04:28.394164085 CET	49712	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:04:28.515222073 CET	6868	49712	45.32.146.65	192.168.2.9
Nov 25, 2024 18:04:33.491642952 CET	49712	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:04:33.612240076 CET	6868	49712	45.32.146.65	192.168.2.9
Nov 25, 2024 18:04:34.170609951 CET	6868	49712	45.32.146.65	192.168.2.9
Nov 25, 2024 18:04:34.171183109 CET	49712	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:04:38.553982019 CET	49712	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:04:38.556436062 CET	49713	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:04:38.674442053 CET	6868	49712	45.32.146.65	192.168.2.9
Nov 25, 2024 18:04:38.676781893 CET	6868	49713	45.32.146.65	192.168.2.9
Nov 25, 2024 18:04:38.676845074 CET	49713	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:04:38.716262102 CET	49713	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:04:38.837819099 CET	6868	49713	45.32.146.65	192.168.2.9
Nov 25, 2024 18:04:38.851119041 CET	49713	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:04:38.972148895 CET	6868	49713	45.32.146.65	192.168.2.9
Nov 25, 2024 18:04:46.679233074 CET	49713	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:04:46.805741072 CET	6868	49713	45.32.146.65	192.168.2.9
Nov 25, 2024 18:04:49.023497105 CET	49713	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:04:49.143953085 CET	6868	49713	45.32.146.65	192.168.2.9
Nov 25, 2024 18:04:49.144007921 CET	49713	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:04:49.264439106 CET	6868	49713	45.32.146.65	192.168.2.9
Nov 25, 2024 18:04:49.264653921 CET	49713	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:04:49.385580063 CET	6868	49713	45.32.146.65	192.168.2.9
Nov 25, 2024 18:05:00.702300072 CET	6868	49713	45.32.146.65	192.168.2.9
Nov 25, 2024 18:05:00.702450991 CET	49713	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:05:05.146924019 CET	49713	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:05:05.147634983 CET	49714	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:05:05.267416954 CET	6868	49713	45.32.146.65	192.168.2.9
Nov 25, 2024 18:05:05.268047094 CET	6868	49714	45.32.146.65	192.168.2.9
Nov 25, 2024 18:05:05.268171072 CET	49714	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:05:05.554096937 CET	49714	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:05:05.675405025 CET	6868	49714	45.32.146.65	192.168.2.9
Nov 25, 2024 18:05:05.913738012 CET	49714	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:05:06.034167051 CET	6868	49714	45.32.146.65	192.168.2.9
Nov 25, 2024 18:05:06.820024967 CET	49714	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:05:06.941235065 CET	6868	49714	45.32.146.65	192.168.2.9
Nov 25, 2024 18:05:16.741787910 CET	49714	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:05:16.866660118 CET	6868	49714	45.32.146.65	192.168.2.9
Nov 25, 2024 18:05:27.209274054 CET	6868	49714	45.32.146.65	192.168.2.9
Nov 25, 2024 18:05:27.209341049 CET	49714	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:05:27.211047888 CET	49714	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:05:27.213447094 CET	49715	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:05:27.406553030 CET	6868	49714	45.32.146.65	192.168.2.9
Nov 25, 2024 18:05:27.406585932 CET	6868	49715	45.32.146.65	192.168.2.9
Nov 25, 2024 18:05:27.407341957 CET	49715	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:05:27.503576994 CET	49715	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:05:27.730982065 CET	6868	49715	45.32.146.65	192.168.2.9
Nov 25, 2024 18:05:27.773173094 CET	49715	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:05:27.897584915 CET	6868	49715	45.32.146.65	192.168.2.9
Nov 25, 2024 18:05:32.835948944 CET	49715	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:05:32.956799030 CET	6868	49715	45.32.146.65	192.168.2.9
Nov 25, 2024 18:05:38.789016008 CET	49715	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:05:38.909796000 CET	6868	49715	45.32.146.65	192.168.2.9
Nov 25, 2024 18:05:49.522412062 CET	6868	49715	45.32.146.65	192.168.2.9
Nov 25, 2024 18:05:49.522488117 CET	49715	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:05:49.527211905 CET	49715	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:05:49.531613111 CET	49716	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:05:49.647892952 CET	6868	49715	45.32.146.65	192.168.2.9
Nov 25, 2024 18:05:49.652046919 CET	6868	49716	45.32.146.65	192.168.2.9
Nov 25, 2024 18:05:49.652122021 CET	49716	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:05:50.231338978 CET	49716	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:05:50.351882935 CET	6868	49716	45.32.146.65	192.168.2.9
Nov 25, 2024 18:05:56.086155891 CET	49716	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:05:56.206588030 CET	6868	49716	45.32.146.65	192.168.2.9
Nov 25, 2024 18:05:56.206681013 CET	49716	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:05:56.327116966 CET	6868	49716	45.32.146.65	192.168.2.9
Nov 25, 2024 18:05:56.327156067 CET	49716	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:05:56.449925900 CET	6868	49716	45.32.146.65	192.168.2.9
Nov 25, 2024 18:05:59.241975069 CET	49716	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:05:59.362601042 CET	6868	49716	45.32.146.65	192.168.2.9
Nov 25, 2024 18:06:07.898237944 CET	49716	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:06:08.019362926 CET	6868	49716	45.32.146.65	192.168.2.9
Nov 25, 2024 18:06:11.688457966 CET	6868	49716	45.32.146.65	192.168.2.9
Nov 25, 2024 18:06:11.688544035 CET	49716	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:06:12.992331982 CET	49716	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:06:12.993706942 CET	49717	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:06:13.113686085 CET	6868	49716	45.32.146.65	192.168.2.9
Nov 25, 2024 18:06:13.114526033 CET	6868	49717	45.32.146.65	192.168.2.9
Nov 25, 2024 18:06:13.114666939 CET	49717	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:06:13.401531935 CET	49717	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:06:13.522897959 CET	6868	49717	45.32.146.65	192.168.2.9
Nov 25, 2024 18:06:14.243582964 CET	49717	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:06:14.364485025 CET	6868	49717	45.32.146.65	192.168.2.9
Nov 25, 2024 18:06:14.554737091 CET	49717	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:06:14.675409079 CET	6868	49717	45.32.146.65	192.168.2.9
Nov 25, 2024 18:06:14.675462961 CET	49717	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:06:14.796021938 CET	6868	49717	45.32.146.65	192.168.2.9
Nov 25, 2024 18:06:14.913954973 CET	49717	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:06:15.126004934 CET	6868	49717	45.32.146.65	192.168.2.9
Nov 25, 2024 18:06:15.126069069 CET	49717	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:06:15.248585939 CET	6868	49717	45.32.146.65	192.168.2.9
Nov 25, 2024 18:06:28.929629087 CET	49717	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:06:29.055922031 CET	6868	49717	45.32.146.65	192.168.2.9
Nov 25, 2024 18:06:35.054492950 CET	6868	49717	45.32.146.65	192.168.2.9
Nov 25, 2024 18:06:35.057905912 CET	49717	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:06:36.242028952 CET	49717	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:06:36.244512081 CET	49718	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:06:36.365820885 CET	6868	49717	45.32.146.65	192.168.2.9
Nov 25, 2024 18:06:36.367286921 CET	6868	49718	45.32.146.65	192.168.2.9
Nov 25, 2024 18:06:36.367367983 CET	49718	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:06:36.801811934 CET	49718	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:06:36.923224926 CET	6868	49718	45.32.146.65	192.168.2.9
Nov 25, 2024 18:06:36.960993052 CET	49718	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:06:37.082010984 CET	6868	49718	45.32.146.65	192.168.2.9
Nov 25, 2024 18:06:37.082200050 CET	49718	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:06:37.208972931 CET	6868	49718	45.32.146.65	192.168.2.9
Nov 25, 2024 18:06:51.711752892 CET	49718	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:06:51.832300901 CET	6868	49718	45.32.146.65	192.168.2.9
Nov 25, 2024 18:06:55.539432049 CET	49718	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:06:55.659934044 CET	6868	49718	45.32.146.65	192.168.2.9
Nov 25, 2024 18:06:57.726689100 CET	49718	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:06:57.847162008 CET	6868	49718	45.32.146.65	192.168.2.9
Nov 25, 2024 18:06:57.847234964 CET	49718	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:06:57.967724085 CET	6868	49718	45.32.146.65	192.168.2.9
Nov 25, 2024 18:06:58.361110926 CET	6868	49718	45.32.146.65	192.168.2.9
Nov 25, 2024 18:06:58.361170053 CET	49718	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:07:02.885019064 CET	49718	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:07:02.886802912 CET	49719	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:07:03.005667925 CET	6868	49718	45.32.146.65	192.168.2.9
Nov 25, 2024 18:07:03.007308006 CET	6868	49719	45.32.146.65	192.168.2.9
Nov 25, 2024 18:07:03.013866901 CET	49719	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:07:03.930949926 CET	49719	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:07:04.052056074 CET	6868	49719	45.32.146.65	192.168.2.9
Nov 25, 2024 18:07:07.835850954 CET	49719	6868	192.168.2.9	45.32.146.65
Nov 25, 2024 18:07:08.046456099 CET	6868	49719	45.32.146.65	192.168.2.9

Target ID:	0
Start time:	12:02:59
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\QuickTextPaste.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\QuickTextPaste.exe"
Imagebase:	0x400000
File size:	1'027'072 bytes
MD5 hash:	1FDC72504C644EC1FCC368C24F12D94D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.1626571461.0000000002182000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.1626571461.0000000002182000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:03:18
Start date:	25/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
Imagebase:	0x940000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000003.00000002.3849434803.0000000005002000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000003.00000002.3849434803.0000000005002000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.8%
Total number of Nodes:	1245
Total number of Limit Nodes:	0

Executed Functions

Function 004067E0 Relevance: 24.8, APIs: 1, Strings: 13, Instructions: 304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

W, xrefs: 00406B69
b, xrefs: 00406B46
y, xrefs: 00406B62
i, xrefs: 00406B3F
=<J=, xrefs: 00407A50
r, xrefs: 00406B4D
L, xrefs: 00406B38
a, xrefs: 00406B54
L, xrefs: 00406B1C
r, xrefs: 00406B5B
o, xrefs: 00406B23
d, xrefs: 00406B31
a, xrefs: 00406B2A

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID:
String ID: =<J=$L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4014269246
Opcode ID: 0411835356f1e99fe726466764d439a675ece6bae9d9b91ec0af716ad98a374d
Instruction ID: 2c68c16b3c9552cff33701e784215426489a4e626329e3ecda5d4fc364bf889c
Opcode Fuzzy Hash: 0411835356f1e99fe726466764d439a675ece6bae9d9b91ec0af716ad98a374d
Instruction Fuzzy Hash: E1B106B2D042649AE7208B24EC44BEA7B75FF94310F0481FAD44DA7281D67E1FC5CB96

Function 0040691A Relevance: 24.8, APIs: 1, Strings: 13, Instructions: 286
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

W, xrefs: 00406B69
b, xrefs: 00406B46
y, xrefs: 00406B62
i, xrefs: 00406B3F
=<J=, xrefs: 00407A50
r, xrefs: 00406B4D
L, xrefs: 00406B38
a, xrefs: 00406B54
L, xrefs: 00406B1C
r, xrefs: 00406B5B
o, xrefs: 00406B23
d, xrefs: 00406B31
a, xrefs: 00406B2A

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID:
String ID: =<J=$L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4014269246
Opcode ID: 421a658dd392df710e2980d55fc65b84dbf2d44b67ff5baaec0e926ea5b89acd
Instruction ID: 735344d9b9f8781e42937aab5551b62c973feb849933e8d3aadb6fb6529b90e1
Opcode Fuzzy Hash: 421a658dd392df710e2980d55fc65b84dbf2d44b67ff5baaec0e926ea5b89acd
Instruction Fuzzy Hash: 3AB107B1D042649AEB208B24DC44BEA7BB5FF94314F1441FAD44DA7281D67E1FC1CBA6

Function 0041E397 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

i, xrefs: 0041E569
y, xrefs: 0041E58C
a, xrefs: 0041E554
L, xrefs: 0041E562
d, xrefs: 0041E55B
W, xrefs: 0041E593
r, xrefs: 0041E577
b, xrefs: 0041E570
r, xrefs: 0041E585
a, xrefs: 0041E57E
o, xrefs: 0041E54D
L, xrefs: 0041E546

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 621844428-4069139063
Opcode ID: 6ef5ffdaa3d6d2533fac22b14bf18c693c50f9ae1fd002498bb8a7f5ee8dc040
Instruction ID: 7d649fead518623d42cc9d8e58729371736bb5d974bd47763e21c6028a608654
Opcode Fuzzy Hash: 6ef5ffdaa3d6d2533fac22b14bf18c693c50f9ae1fd002498bb8a7f5ee8dc040
Instruction Fuzzy Hash: 9371D0B1E096988EF7258B34CC147EA7BB5EF51304F0480FED4499B282DA7D4BC58B66

Function 00406EBE Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 402
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

=<J=, xrefs: 00407A50
=@32, xrefs: 00407192

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: =<J=$=@32
API String ID: 544645111-3383516053
Opcode ID: 9765fcfc9b84c1aa165d1d77c1f02148d68d484e8c8b9ad6771be5e7772f0d45
Instruction ID: e750c7f7439aadec8c6e5426c393129ed4d7152597e28964240f52a71426d38f
Opcode Fuzzy Hash: 9765fcfc9b84c1aa165d1d77c1f02148d68d484e8c8b9ad6771be5e7772f0d45
Instruction Fuzzy Hash: 8AF17FB1D092689BEB24CB14CC94BEA77B5EB85314F1441FAD80E67281D6386FC2CF56

Function 0040747A Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

=<J=, xrefs: 00407A50

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: =<J=
API String ID: 544645111-1552549898
Opcode ID: 305f7217f1711690d97eb67d90b78793daa302e6a78bc335abcf3a7dc55d5b47
Instruction ID: 738528193e964dbc0e6ed2d9b3dcf20250a3da32534f485b43496aaa868eadc8
Opcode Fuzzy Hash: 305f7217f1711690d97eb67d90b78793daa302e6a78bc335abcf3a7dc55d5b47
Instruction Fuzzy Hash: 6971E5B2D091659BEB248B24CC54BEA7775FF85310F1081FAD80DA7281D6396EC2CF56

Function 0040759C Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

=<J=, xrefs: 00407A50

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID:
String ID: =<J=
API String ID: 0-1552549898
Opcode ID: f9fabbd2a2a82941f7d205b077d745ca264b072a726e91973b0c42cbe854219f
Instruction ID: bb7503dfdbf1590933322bf86fe6dea4c03d3c49bdc58396b39e3ba034320f4b
Opcode Fuzzy Hash: f9fabbd2a2a82941f7d205b077d745ca264b072a726e91973b0c42cbe854219f
Instruction Fuzzy Hash: 4271D3B1D091659AEB248B24DC54BEA7B74FB85314F1081FAD80EA7281D63C6EC2CF56

Function 00406981 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

W, xrefs: 00406B69
b, xrefs: 00406B46
y, xrefs: 00406B62
i, xrefs: 00406B3F
=<J=, xrefs: 00407A50
r, xrefs: 00406B4D
L, xrefs: 00406B38
a, xrefs: 00406B54
L, xrefs: 00406B1C
r, xrefs: 00406B5B
o, xrefs: 00406B23
d, xrefs: 00406B31
a, xrefs: 00406B2A

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: =<J=$L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 544645111-4014269246
Opcode ID: 242b3a3814fc52744b42c5e6d3e8239d84c2fe5bc98553ddaeb97955af49eb4c
Instruction ID: 7dbc5dd6b3223fae26f022291965f43ab8c5a89abc06b9792139beda074362b3
Opcode Fuzzy Hash: 242b3a3814fc52744b42c5e6d3e8239d84c2fe5bc98553ddaeb97955af49eb4c
Instruction Fuzzy Hash: 18811872E082A49AF7208624EC44BDA7BB5EF95310F0441FAD44DA7281D67E1FC5CFA6

Function 0040675C Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

W, xrefs: 00406B69
b, xrefs: 00406B46
y, xrefs: 00406B62
i, xrefs: 00406B3F
=<J=, xrefs: 00407A50
r, xrefs: 00406B4D
L, xrefs: 00406B38
a, xrefs: 00406B54
L, xrefs: 00406B1C
r, xrefs: 00406B5B
o, xrefs: 00406B23
d, xrefs: 00406B31
a, xrefs: 00406B2A

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: =<J=$L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 544645111-4014269246
Opcode ID: 928647cb7d64a655767f8b135be432c456f8dcdf0d1ea92984ee5f9edfc46b03
Instruction ID: c5d18e3d2b37e6bb8494259fe987c37ee8e1f86bf4868dc0386e09816f38c9fa
Opcode Fuzzy Hash: 928647cb7d64a655767f8b135be432c456f8dcdf0d1ea92984ee5f9edfc46b03
Instruction Fuzzy Hash: 9071F772E042A49AF7208624DC44BDA7BB5FF95300F0441FAD44DA7281D67E1FC58FA6

Function 004067B8 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

W, xrefs: 00406B69
b, xrefs: 00406B46
y, xrefs: 00406B62
i, xrefs: 00406B3F
=<J=, xrefs: 00407A50
r, xrefs: 00406B4D
L, xrefs: 00406B38
a, xrefs: 00406B54
L, xrefs: 00406B1C
r, xrefs: 00406B5B
o, xrefs: 00406B23
d, xrefs: 00406B31
a, xrefs: 00406B2A

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: =<J=$L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 544645111-4014269246
Opcode ID: 928647cb7d64a655767f8b135be432c456f8dcdf0d1ea92984ee5f9edfc46b03
Instruction ID: c5d18e3d2b37e6bb8494259fe987c37ee8e1f86bf4868dc0386e09816f38c9fa
Opcode Fuzzy Hash: 928647cb7d64a655767f8b135be432c456f8dcdf0d1ea92984ee5f9edfc46b03
Instruction Fuzzy Hash: 9071F772E042A49AF7208624DC44BDA7BB5FF95300F0441FAD44DA7281D67E1FC58FA6

Function 00406A27 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

W, xrefs: 00406B69
b, xrefs: 00406B46
y, xrefs: 00406B62
i, xrefs: 00406B3F
=<J=, xrefs: 00407A50
r, xrefs: 00406B4D
L, xrefs: 00406B38
a, xrefs: 00406B54
L, xrefs: 00406B1C
r, xrefs: 00406B5B
o, xrefs: 00406B23
d, xrefs: 00406B31
a, xrefs: 00406B2A

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: =<J=$L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 544645111-4014269246
Opcode ID: f0b4ee9dc74c54352d7fbf9592ab55b13b16b4dc68492a8a082e016f0b446842
Instruction ID: 529cca8bfd9cca14e4241e86a83515072cc44c854048aa7e0b733c893ad00647
Opcode Fuzzy Hash: f0b4ee9dc74c54352d7fbf9592ab55b13b16b4dc68492a8a082e016f0b446842
Instruction Fuzzy Hash: 1871E872E082A49AF7208624DC44BDA7BB5FF95310F0441FAD44DA7281D67E1FC5CBA6

Function 0041E52E Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

i, xrefs: 0041E569
y, xrefs: 0041E58C
a, xrefs: 0041E554
L, xrefs: 0041E562
d, xrefs: 0041E55B
W, xrefs: 0041E593
r, xrefs: 0041E577
b, xrefs: 0041E570
r, xrefs: 0041E585
a, xrefs: 0041E57E
o, xrefs: 0041E54D
L, xrefs: 0041E546

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 621844428-4069139063
Opcode ID: 71440b70f4edf20ecdb93d61201ba1ece79b9c468442dfa396d4f51d04353414
Instruction ID: f581cbec88d1b9444b7ccb47932665f0f1bad622cbc066f17daeebda143b93a8
Opcode Fuzzy Hash: 71440b70f4edf20ecdb93d61201ba1ece79b9c468442dfa396d4f51d04353414
Instruction Fuzzy Hash: E031F7B1D092D9CEFB218635CC187D97FA59B52304F0840EAD48C57293C67E0BC9CB66

Function 0040711B Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 212COMMON

Download Yara Rule

Strings

=<J=, xrefs: 00407A50
=@32, xrefs: 00407192

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID:
String ID: =<J=$=@32
API String ID: 0-3383516053
Opcode ID: bd8c4b132eb592a88b41fbbafbf0e654a5a71060e52978c712f69aba5cdf5c29
Instruction ID: d0c78106edfe5be610d37db869c586dc4b67ebd2c97779dfa1e452e203716ee3
Opcode Fuzzy Hash: bd8c4b132eb592a88b41fbbafbf0e654a5a71060e52978c712f69aba5cdf5c29
Instruction Fuzzy Hash: 2771F571D092685BEB218A54CC94BEB7BB4EF81305F1481FAD409A62C1D6386FC2CF57

Function 0041F13C Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 0041F488

Strings

, xrefs: 0041F48F

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-399585960
Opcode ID: 044063f2aeab60ea10430bcb47f149e00def8fd11386184721a7628e1d0925b3
Instruction ID: 84cd4bb7ec62b5781d08c3df74a51c19c9ada23aec2cd92a84abac801a4fc0f9
Opcode Fuzzy Hash: 044063f2aeab60ea10430bcb47f149e00def8fd11386184721a7628e1d0925b3
Instruction Fuzzy Hash: C69149B4E042289FEB24CF14DC90BEAB7B6BB85305F1481EAD84D67350C635AED68F45

Function 00407801 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 189
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00000000,?,00000040,00000000,00000000,?,?,00407479,00407479,?,?,00407479,?,00407479,?,00000000), ref: 00407A89

Strings

=<J=, xrefs: 00407A50

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: =<J=
API String ID: 544645111-1552549898
Opcode ID: 5efcf1fceb7c5387daeaef62bad546a26c2015eac6028ea2f35559f23657da7d
Instruction ID: 86a58948c38a69e7730e2a614f35a2f25c32765f3b2afedfec0d8f613b0b926f
Opcode Fuzzy Hash: 5efcf1fceb7c5387daeaef62bad546a26c2015eac6028ea2f35559f23657da7d
Instruction Fuzzy Hash: D87192B1E091589BEB24CB14CC90AFE77B1EB85315F1481EAD409A7281D63D6FC2CF56

Function 00406D70 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00000000,?,00000040,00000000,00000000,?,?,00407479,00407479,?,?,00407479,?,00407479,?,00000000), ref: 00407A89

Strings

=<J=, xrefs: 00407A50

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: =<J=
API String ID: 544645111-1552549898
Opcode ID: b5d2192ee1f7aa5db4832eef668c349e35139c276e9f66c6ae00536205ef4696
Instruction ID: 76fa41f932c2448479985259eac421f02ebf6f015f52d69e987c15119e612cdd
Opcode Fuzzy Hash: b5d2192ee1f7aa5db4832eef668c349e35139c276e9f66c6ae00536205ef4696
Instruction Fuzzy Hash: 0951E9B6D052546FFB208A24DC84BEB7775FB80310F1541BBD80EA6681D63C6EC68A66

Function 004074D0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 173
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

=<J=, xrefs: 00407A50

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: =<J=
API String ID: 544645111-1552549898
Opcode ID: d8025b8d9e6413009d756c5fd0575cee9bd0d931732ce6450ccc7a76b4fd2ca0
Instruction ID: 08acc017aac2b6a84459e23c581b274abd0b1e8b774b2d6f77f64eb65f002ffb
Opcode Fuzzy Hash: d8025b8d9e6413009d756c5fd0575cee9bd0d931732ce6450ccc7a76b4fd2ca0
Instruction Fuzzy Hash: 8061E3B2D092659FEB248B24CC54BEA7B74FB85310F1081FAD50DA7281D6396EC2CF56

Function 00406D59 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(00000000,?,00000040,00000000,00000000,?,?,00407479,00407479,?,?,00407479,?,00407479,?,00000000), ref: 00407A89

Strings

=<J=, xrefs: 00407A50

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: =<J=
API String ID: 544645111-1552549898
Opcode ID: a8f4be29f8e4bb6e1804d70e2a4199b4c56be6986352142101ad7a9db7434997
Instruction ID: 99da276cbe10c8c172a1099cc2b2995619a78b6a26377a9e1573c4c3d8e4025b
Opcode Fuzzy Hash: a8f4be29f8e4bb6e1804d70e2a4199b4c56be6986352142101ad7a9db7434997
Instruction Fuzzy Hash: D15138B2D082649AEB208B11CC846FF7775EB80311F1541BBE44E661C1E63C5ED2CE63

Function 0040719C Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

=<J=, xrefs: 00407A50

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: =<J=
API String ID: 544645111-1552549898
Opcode ID: 2313dcce7889e4b09059aabfde96d64cf1344642ebdc8ea80dd7a994719826b0
Instruction ID: 848ca1905d64442369d98907fabba43311f14efd62ab1ee3e5ec888b9122e4dc
Opcode Fuzzy Hash: 2313dcce7889e4b09059aabfde96d64cf1344642ebdc8ea80dd7a994719826b0
Instruction Fuzzy Hash: 2D51F5B1E092585FFB208654CC94AEB7BB4EB85314F1441FAE40DA6181D6386FC2CF53

Function 0040756A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

=<J=, xrefs: 00407A50

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: =<J=
API String ID: 544645111-1552549898
Opcode ID: e93f9cd55b5b48f49c75729672f3e6094a945fa0d953f8263ef85af264be1b1b
Instruction ID: 2a6212f3aae6c14ecad9d9d9a13a99a79a6de910924b350dd7a34e21516a51ae
Opcode Fuzzy Hash: e93f9cd55b5b48f49c75729672f3e6094a945fa0d953f8263ef85af264be1b1b
Instruction Fuzzy Hash: 525104B2E091659FEB248A24CC54BEA7B74EB85311F1081FBD50DA62C1D63C6EC2CE57

Function 00407418 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

=<J=, xrefs: 00407A50

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: =<J=
API String ID: 544645111-1552549898
Opcode ID: 0a1a96974c529427ad21bf6890ff641f723d5b8c582e41025654c76c0e5ab224
Instruction ID: 26f745d078dd577aebc1eef2656111b593e7088bdd826626645a953597fc8512
Opcode Fuzzy Hash: 0a1a96974c529427ad21bf6890ff641f723d5b8c582e41025654c76c0e5ab224
Instruction Fuzzy Hash: 8F41C3B2D092649FEB248A14CC54BAA7B74EB85314F1441FAD50E6B2C1C63C6FC1CF56

Function 00406C36 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

=<J=, xrefs: 00407A50

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: =<J=
API String ID: 544645111-1552549898
Opcode ID: a28104cb5b6e4896146c41cd4cefce28b6bd6a4d57f901a0df290aeca4214420
Instruction ID: bdbed5da399c6a38459e193f63b156c8b718e895b829d49a0ed295ab78c0c810
Opcode Fuzzy Hash: a28104cb5b6e4896146c41cd4cefce28b6bd6a4d57f901a0df290aeca4214420
Instruction Fuzzy Hash: A031F4B3E092646AFB108614CC54BEB3775FB80310F1441BAE90DB6580D23C6FC68EA7

Function 00407959 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(00000000,?,00000040,00000000,00000000,?,?,00407479,00407479,?,?,00407479,?,00407479,?,00000000), ref: 00407A89

Strings

=<J=, xrefs: 00407A50

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: =<J=
API String ID: 544645111-1552549898
Opcode ID: e63a35f5d76d61e3dc8519f1b76418b48d93d3d960529309f15af67a334b1f56
Instruction ID: 15646194b6118c571e19b72504f61c9361b70c54fdfa1c2d117bbd71720dbca0
Opcode Fuzzy Hash: e63a35f5d76d61e3dc8519f1b76418b48d93d3d960529309f15af67a334b1f56
Instruction Fuzzy Hash: 34319EB2E091599EEB24CA14CC90BEE77B1EB84305F1481EAD509B6281D6386FC2CF16

Function 004076FC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

=<J=, xrefs: 00407A50

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: =<J=
API String ID: 544645111-1552549898
Opcode ID: f8ba3c77f1519eba33b657af8550887a5f61b087a4f8e8f220b33ded038568e3
Instruction ID: c62d4aeb7f183ace03c0fbe117621d8bb6af6efbb8f39545cc0684f40efc8afd
Opcode Fuzzy Hash: f8ba3c77f1519eba33b657af8550887a5f61b087a4f8e8f220b33ded038568e3
Instruction Fuzzy Hash: 3021CEB2E09659ABEB208A14CC94BEE7774FB84301F0041FAE509B6280D7386FC1CF52

Function 00406EDA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

=<J=, xrefs: 00407A50

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: =<J=
API String ID: 544645111-1552549898
Opcode ID: ab1f3c9ddeec96c21bfc2465eb0ef328c277b5c9fcf07bfef2394151d7480918
Instruction ID: c360b31caec9741dd6596a3e14725d1f80ce29dd7a7bd6831b77f0a83b6c9aac
Opcode Fuzzy Hash: ab1f3c9ddeec96c21bfc2465eb0ef328c277b5c9fcf07bfef2394151d7480918
Instruction Fuzzy Hash: BC21C1B3E09554AAFB108A24CC95BEA7775EB85310F1441B6E90DB6180D23C6FC28E63

Function 0040774E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

=<J=, xrefs: 00407A50

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: =<J=
API String ID: 544645111-1552549898
Opcode ID: 34d81cf9bc4c1ca29a7625b4869528daa6f600a62596aec53683db146db035e7
Instruction ID: d20ef1d02864c3cd1a8dd42756d6800b121db6cb393a2dc1f1cf0d291cb5af5f
Opcode Fuzzy Hash: 34d81cf9bc4c1ca29a7625b4869528daa6f600a62596aec53683db146db035e7
Instruction Fuzzy Hash: 2921B0B2E09255ABEB248A14CC94AEE7775EB84311F1445EAE509A6280D6386FC28F17

Function 00407780 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

=<J=, xrefs: 00407A50

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: =<J=
API String ID: 544645111-1552549898
Opcode ID: 2376ed718335674000104594ffa531492d251406f2c6fc821499bdaa52bb59c6
Instruction ID: 2ed15739be1e08bd3344b42ea448d3b9b6fef528011d0ed2e0c495fb1f24f242
Opcode Fuzzy Hash: 2376ed718335674000104594ffa531492d251406f2c6fc821499bdaa52bb59c6
Instruction Fuzzy Hash: 9D21B0B2E09255ABEB208A14CC94AEE7775EB84311F1445EAE509A6280D6386FC28F17

Function 004077A5 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

=<J=, xrefs: 00407A50

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: =<J=
API String ID: 544645111-1552549898
Opcode ID: aba8315a0fcff4e954300462cf7bf140b7a4280a1aefaab93e69e707f5ada483
Instruction ID: 031850a18d50afdb2034fc53f0991b354779c05c29cf1d460981c6ed8707cb5e
Opcode Fuzzy Hash: aba8315a0fcff4e954300462cf7bf140b7a4280a1aefaab93e69e707f5ada483
Instruction Fuzzy Hash: D521B0B2E09255ABEB248A14CC94AEE7775FB84311F1445EAE509A6280D6386FC28F17

Function 0041E77F Relevance: 1.7, APIs: 1, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81f3a46e481a9001cd8d7df1cb19ad9384fbeaeb947b3088cea07aaf666bbda1
Instruction ID: 805f3272566bda3cc6e13b34d76a54ebf1e425d15819730356833e464192a04b
Opcode Fuzzy Hash: 81f3a46e481a9001cd8d7df1cb19ad9384fbeaeb947b3088cea07aaf666bbda1
Instruction Fuzzy Hash: 33611EB5C0426A8AEB309B22CC807FEB775EB51314F1440FAD84D97681E63D4EC6DB16

Function 0041F32D Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09b5330b24111d9fd33253ff9ee43d398974985ce982b99bc27fe2d294e082fc
Instruction ID: 9b4c68d9a6c1b3feff0fe73b279bb104b45c793c161d23dd99180bb06f8a0c42
Opcode Fuzzy Hash: 09b5330b24111d9fd33253ff9ee43d398974985ce982b99bc27fe2d294e082fc
Instruction Fuzzy Hash: 9931C1B09045688FEB24DB14CC94BFAB7B5AF8230AF1480FBD85996241D6395ECACE45

Function 0041E8FC Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000), ref: 0041F488

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: e17893aaa37c1aac255926972b71e710d378f5cef23699836b695d74e4c9959e
Instruction ID: 3d9aa7455e0593d2c84f24cc7eb80196f2b51176546916de75e3f2145be866ea
Opcode Fuzzy Hash: e17893aaa37c1aac255926972b71e710d378f5cef23699836b695d74e4c9959e
Instruction Fuzzy Hash: FF2190F5D05254ABE7608A11DC85BEF7778FB80320F1540B7E80D96640E63D5EC68A56

Function 0041E652 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 257ef34b65dbb1f01441ecc1a1da7d5c31d3b05d70e298f4ba3f3f8b8ab5d473
Instruction ID: 453379fced34fbf1c5b714f7bb3aa0ab99e369a9a315473a5ccfc5f1e927d020
Opcode Fuzzy Hash: 257ef34b65dbb1f01441ecc1a1da7d5c31d3b05d70e298f4ba3f3f8b8ab5d473
Instruction Fuzzy Hash: F9115CF58452889FE7218B22CC883FA7B64DB51311F5445FFD8494A5D2C67D09C7CA16

Function 0041ED04 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000), ref: 0041F488

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 69fca465b115e9de93662fe957af2e89e8367bb99e6633dbeca7c6c6ca949c85
Instruction ID: 6a054c30de5f04548f25e8dbaeb4a0bc8a9138bdee79ff11cd11d97d9ac3fde4
Opcode Fuzzy Hash: 69fca465b115e9de93662fe957af2e89e8367bb99e6633dbeca7c6c6ca949c85
Instruction Fuzzy Hash: EA11D2B6D005559BF3148A25EC85FFB7778EB44301F1441BBEC4E96280D63D5EC68E62

Function 0041E5EA Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 4c35ebf014580d023ce425432ee36ed3aee2e1ac2622ec0cdb7e0b0417b257c3
Instruction ID: f99f57352ff983d67101c280a8475f287b1e04f41c5ba5930e0569030e62504b
Opcode Fuzzy Hash: 4c35ebf014580d023ce425432ee36ed3aee2e1ac2622ec0cdb7e0b0417b257c3
Instruction Fuzzy Hash: 261126F1C042845FE7208B12CC49BEA7B65EB51314F1844FBDC4987592C67D4ACB8A17

Function 0041E84F Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 52f8ce0a5811021320afa8de58b4cf66ab4b9f6a618db5b01615b2be86767cf2
Instruction ID: 679f1e4a381523a7bb2f4b1938df693f00b4e7880132a823eebab4ed7d2209a0
Opcode Fuzzy Hash: 52f8ce0a5811021320afa8de58b4cf66ab4b9f6a618db5b01615b2be86767cf2
Instruction Fuzzy Hash: 760147F18092889FE7208B12DC853F97765EB91311F1880FFE88A87591D67D09CB8617

Function 0041F106 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 965fb0647620d38bc6789dfa69c6729f7df769bffd36aa689c68b1e7cd11d24e
Instruction ID: 028d492e493900e355de9f9771edfcbc94e052701ce48e8b092cf4c95405fc9d
Opcode Fuzzy Hash: 965fb0647620d38bc6789dfa69c6729f7df769bffd36aa689c68b1e7cd11d24e
Instruction Fuzzy Hash: 25017CB0D01228EFEB24CF10CD41BEA77B4EB85310F1481EAE5495A250D6359ECA8E56

Function 0041E8EA Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 375f193220ab479675139d303b5c77f2fdb54827b57555c0cbd7f0dc9a393c1e
Instruction ID: 420a628833cd9a6875d113add3499725125ee7556035095e5f86afdc11cf0918
Opcode Fuzzy Hash: 375f193220ab479675139d303b5c77f2fdb54827b57555c0cbd7f0dc9a393c1e
Instruction Fuzzy Hash: 45F0ECF5C551449FF7104641DC467FE3254E750321F1440BBDC4955551D57E0ED78917

Non-executed Functions

Function 00433F0D Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49clipboardregistryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00000000), ref: 00433F17
RegisterClipboardFormatW.USER32(Shell IDList Array), ref: 00433F36
GetClipboardData.USER32 ref: 00433F47
GlobalLock.KERNEL32(00000000), ref: 00433F52
CloseClipboard.USER32 ref: 00433F8B

Strings

Shell IDList Array, xrefs: 00433F31
4AD, xrefs: 00433F69

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseDataFormatGlobalLockOpenRegister
String ID: 4AD$Shell IDList Array
API String ID: 1151311956-2489082455
Opcode ID: 48519a98ff51355961bb7effbf8569a47d7a7025d9368877acad64ed744704c4
Instruction ID: 3f644c05e47439fdc23d2c824a1c84af3f17edb4169f705e82ac8151b23e47f1
Opcode Fuzzy Hash: 48519a98ff51355961bb7effbf8569a47d7a7025d9368877acad64ed744704c4
Instruction Fuzzy Hash: D2019231704204ABDB109F25EC49B6A3BA8EF0875AF04543DFC45EB2A0DB79DA40CB5C

Function 00426601 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 40windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042666F: UnhookWindowsHookEx.USER32(?), ref: 00426679

GetModuleHandleW.KERNEL32(00000000), ref: 00426616
SetWindowsHookExW.USER32(0000000D,0041ED8B,00000000,00000000), ref: 00426625
GetLastError.KERNEL32 ref: 00426634
FormatMessageW.KERNEL32(00001100,00000000,00000000,00000000,?,00000000,00000000), ref: 00426648
MessageBoxW.USER32(00000000,?,Error hooking keyboard,00000010), ref: 0042665D
LocalFree.KERNEL32(?), ref: 00426666

Strings

Error hooking keyboard, xrefs: 00426654

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: HookMessageWindows$ErrorFormatFreeHandleLastLocalModuleUnhook
String ID: Error hooking keyboard
API String ID: 3539256350-2780107085
Opcode ID: fba2087d46c83467c84a28cd1e6aaa1c58a2a6ec1ea7a2086610efa25594ff7a
Instruction ID: f5ea2c017abb1ba6b0e2630cac6da38f566bcf030e92f02af746c3b95a68221d
Opcode Fuzzy Hash: fba2087d46c83467c84a28cd1e6aaa1c58a2a6ec1ea7a2086610efa25594ff7a
Instruction Fuzzy Hash: AEF09672501130FBDB201BA1AC4DEEF3E6DEF09751F101026F506A0091DBB45940EBF8

Function 0043271F Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 33COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,7123456,00000000,000001F3), ref: 00432790

Strings

5, xrefs: 00432779
6, xrefs: 00432780
2, xrefs: 00432764
7123456, xrefs: 00432787
4, xrefs: 00432772
3, xrefs: 0043276B

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: 2$3$4$5$6$7123456
API String ID: 2299586839-3626163788
Opcode ID: 4da3740a6d9d69a3e11bd58766d14d6da9d5a0c6efc4164ef08d50fbd1901268
Instruction ID: df135c90cf4fd96ecc2958faa78990d9e9a54762d9a1c2938bb780a1a1e2f662
Opcode Fuzzy Hash: 4da3740a6d9d69a3e11bd58766d14d6da9d5a0c6efc4164ef08d50fbd1901268
Instruction Fuzzy Hash: 03014BB1800209EBEF11CF88C9497EEBBB8BB04348F504069A700BB2C0D7B95B4ACF54

Function 004327AB Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 33COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0*+,-./,00000000,000001F3), ref: 0043281C

Strings

/, xrefs: 0043280C
0*+,-./, xrefs: 00432813
,, xrefs: 004327F7
., xrefs: 00432805
-, xrefs: 004327FE
+, xrefs: 004327F0

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: +$,$-$.$/$0*+,-./
API String ID: 2299586839-396296672
Opcode ID: 5ca085d7eb37483b56b1ad4c0e2bd3df6a5eb46fe1b38734cf8d6047dd07eeff
Instruction ID: 182194e9b7aa74f1834d65153d6b30cc8a34f0bf16cbddff9d07cac1a8773447
Opcode Fuzzy Hash: 5ca085d7eb37483b56b1ad4c0e2bd3df6a5eb46fe1b38734cf8d6047dd07eeff
Instruction Fuzzy Hash: 06014BB5900209ABEF10DF98D9497EEBBB4BB04308F104069E700B72C0D7B95A4ACF58

Function 004324DC Relevance: 9.1, APIs: 6, Instructions: 52keyboardCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 004324EA
GetKeyboardState.USER32(?), ref: 0043251A
keybd_event.USER32(00000012,00000000,00000001,00000000), ref: 00432535
SetForegroundWindow.USER32(?), ref: 0043253A
GetKeyboardState.USER32(?), ref: 00432547
keybd_event.USER32(00000012,00000000,00000003,00000000), ref: 0043255D

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: KeyboardStateWindowkeybd_event$Foreground
String ID:
API String ID: 3738427976-0
Opcode ID: 2c72c861c302e1139b07c97f33455dde5ae2a2ab37e195d2adcee556ea12027a
Instruction ID: 94379a26eef160f79566083ef4e3578c49d00e1bcfa1839136e3bbe5105c761c
Opcode Fuzzy Hash: 2c72c861c302e1139b07c97f33455dde5ae2a2ab37e195d2adcee556ea12027a
Instruction Fuzzy Hash: 1E01B131A002AD7EEF219B74DD44BAB3B6CAB48754F0010B6EA44F21D1D7B09F418E68

Function 00434350 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(USER32.DLL), ref: 00434390
GetProcAddress.KERNEL32(?,VkKeyScanW), ref: 004343AD

Strings

VkKeyScanW, xrefs: 004343A8, 004343AB
yScanW, xrefs: 004343C1
USER32.DLL, xrefs: 0043438B

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: USER32.DLL$VkKeyScanW$yScanW
API String ID: 2574300362-2509131655
Opcode ID: f33a238c0a0008be8fa80d9092039b86b37356b8e18231454f539763cbe0bda6
Instruction ID: 00ef8408c9c2cd366938f6668c4c85d73a7131af4500c8c6c3acde0d2035717b
Opcode Fuzzy Hash: f33a238c0a0008be8fa80d9092039b86b37356b8e18231454f539763cbe0bda6
Instruction Fuzzy Hash: F3018030908388EEEB5197B4D80938E7FF19B15308F0480ECD44467292D3FA5658DF69

Function 00421838 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042183D
GetLocalTime.KERNEL32(00000002,?,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0042184E

Part of subcall function 00424156: __EH_prolog.LIBCMT ref: 0042415B
Part of subcall function 00424156: GetLocalTime.KERNEL32(?), ref: 0042416C
Part of subcall function 00424156: CopyFileW.KERNEL32(?,00000000,?,00000000,?,?,0048039C,00000000,00445508), ref: 00424207

Strings

last_backup, xrefs: 00421866

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: H_prologLocalTime$CopyFile
String ID: last_backup
API String ID: 2992466287-3052884854
Opcode ID: 4e366ab625fe2227e8f56ac358aab6d24cbada234cdc05f17cb09aebade897a5
Instruction ID: a8900d9fa8d7d7e32f2f801e5830e3db12106511594fc8e929056427879ad994
Opcode Fuzzy Hash: 4e366ab625fe2227e8f56ac358aab6d24cbada234cdc05f17cb09aebade897a5
Instruction Fuzzy Hash: 8A01C671E005289ACB24B774AD969BD7364EF94744B50043FE811F22D2E67C8908D69C

Function 0041EF19 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

7B6;, xrefs: 0041EF13

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID:
String ID: 7B6;
API String ID: 0-129056507
Opcode ID: 531e130ea9de573251cd9ef4a4f9255729852d6085132259d1acd95837e7a242
Instruction ID: a2e1ffb217dc37fb71030f9042c69854828b7e275fdaa14b5f4c44a4850284d7
Opcode Fuzzy Hash: 531e130ea9de573251cd9ef4a4f9255729852d6085132259d1acd95837e7a242
Instruction Fuzzy Hash: AC51EDB1D051298AEB248F25CD107FEBB76EF85300F0481FAD94D96682EA384EC69B15

Function 0040EBBA Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31a0024bab8b4bed6dbc98f51679fa80ffb451d64fd1dd4b800c11bfa53d05ab
Instruction ID: 23bda53a7b0612d3686cd6d251f64e5347905877a5adf01070cdb16cbc1802e2
Opcode Fuzzy Hash: 31a0024bab8b4bed6dbc98f51679fa80ffb451d64fd1dd4b800c11bfa53d05ab
Instruction Fuzzy Hash: 17C1AFB1D042688BEB28CB15CC94BEABBB5FF85304F1445FAD90966780D6795EC1CF82

Function 00402A35 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2def513f4ae14cae0b52af654849ade124da1b2e7b229a32dcac725956e8dcfe
Instruction ID: a68a93b1dfe12f691498afbb7b2c120d69af411b611a08db01963925a9bf58d2
Opcode Fuzzy Hash: 2def513f4ae14cae0b52af654849ade124da1b2e7b229a32dcac725956e8dcfe
Instruction Fuzzy Hash: 867104B2D002145FF768CA24DD9AAEEBB78EB90314F1581BFD80E66680D67C5FC68D41

Function 0040EE30 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98068914411b382e58d16850fb313262153f80aa3508047db4f35f45676c3df2
Instruction ID: 27887d31943956b31d3b47e0da6c9ad9fb80d555f4d8071838d31bc948632639
Opcode Fuzzy Hash: 98068914411b382e58d16850fb313262153f80aa3508047db4f35f45676c3df2
Instruction Fuzzy Hash: E66155B2D041185AF7248A65CC55BFF7B75EB81300F1440BFE90E666C0D67D5AC18B52

Function 00402FF8 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 026aa8db736053c1523893a85feb418ac5c12ec1a87ce9bb8aa84310bd574804
Instruction ID: f9795f540f2920e871af5529d029d1775dc9ad22479b0ed988c7490149d3ac04
Opcode Fuzzy Hash: 026aa8db736053c1523893a85feb418ac5c12ec1a87ce9bb8aa84310bd574804
Instruction Fuzzy Hash: B871E6B2D012655FE728CB24DD89AEEBB79EB84304F1481FBD80C66694D6781FC5CE41

Function 00402FF2 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24d5e67c7b97d2deedaa3df6a781ee32d5a52f2c08da68a1f03d436c7a9ae9ee
Instruction ID: 48b4fbfda18d80c775ce31c10e293a097a3a419f543e5167ef722263b6452a60
Opcode Fuzzy Hash: 24d5e67c7b97d2deedaa3df6a781ee32d5a52f2c08da68a1f03d436c7a9ae9ee
Instruction Fuzzy Hash: 3F71E5B2D012655FF728CA24DD89AEEBB79EB84304F1481FBD80C66684D6781FC5CE41

Function 00402D9D Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 197286419b8e5bb2b98c2be039d4f977a6adb3cd9235ab47d70405b3845b9aa4
Instruction ID: 67d647ed663b86686d8c74d0c2fe09d77287fc08c880a43af023074c8844f321
Opcode Fuzzy Hash: 197286419b8e5bb2b98c2be039d4f977a6adb3cd9235ab47d70405b3845b9aa4
Instruction Fuzzy Hash: 6461B5B2D042258BE728CF24CD959DABBB9EB94304F1481FFD80D67694D6385F86CE41

Function 00402CBF Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14afaf89f7cc845cf7d9756e5d78b963c7e050ce82adee17f136a369f24f781c
Instruction ID: 34b70eea6939b287f0a7c53db1cd64776a3b17daf5024cf46681b8987b9427b7
Opcode Fuzzy Hash: 14afaf89f7cc845cf7d9756e5d78b963c7e050ce82adee17f136a369f24f781c
Instruction Fuzzy Hash: A951C7B2C002299FE768DB24CD99AD9BB79EB90304F1181FF940E6A5D4DA385FC5CE41

Function 0040EF2D Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f7d85854d80ce778e19d60bf47bc0156e5c751d4398c197ea851de8eb3fe9de
Instruction ID: cd27f7706715f110c4abdf94d1d9e9c87089e2315294f9ead68aa5fbc7ad3193
Opcode Fuzzy Hash: 9f7d85854d80ce778e19d60bf47bc0156e5c751d4398c197ea851de8eb3fe9de
Instruction Fuzzy Hash: 165156B2D102115AF3248B69DC95AFFBB35EFC1300F1440BFE909A66C1E67D5AC68B52

Function 0040EB7D Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9fe7862a14ea6da1c896ad4932d9b636bd3af04608814d76069af5044128d92
Instruction ID: 7a3c1f161eea97eec26771882a62063098ff4d64f2f5a9e7babd00570295a9fd
Opcode Fuzzy Hash: e9fe7862a14ea6da1c896ad4932d9b636bd3af04608814d76069af5044128d92
Instruction Fuzzy Hash: 3E3108A2D101145AF3248B55DC59BFF7A39EF80310F14807EE90A666C0E67D5AC58B92

Function 004210CC Relevance: 65.2, APIs: 25, Strings: 12, Instructions: 439windowstringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(?,00000000,?,0000014E,00000000,00000000,?,?,00000000,TAB,?,?,00000000,00454FB8), ref: 0042112E
lstrcatW.KERNEL32(?,00454FA0,?,0000014E,00000000,00000000,?,?,00000000,TAB,?,?,00000000,00454FB8), ref: 0042114B
wsprintfW.USER32 ref: 0042118C
SetWindowTextW.USER32(?,?), ref: 0042121B
GetSystemMetrics.USER32(00000032), ref: 004212A2
GetSystemMetrics.USER32(00000031), ref: 004212AB
ImageList_Create.COMCTL32(00000000,?,00000001), ref: 004212B2

Part of subcall function 004354E9: GetModuleHandleW.KERNEL32(shell32,004212C7,0000000E,?,00000001), ref: 004354F7
Part of subcall function 004354E9: LoadIconW.USER32(?,00000001), ref: 0043550D

ImageList_ReplaceIcon.COMCTL32(?,000000FF,00000000,0000000E,?,00000001), ref: 004212CD
ImageList_ReplaceIcon.COMCTL32(?,000000FF,00000000,00000098,?,00000001), ref: 004212E8
LoadImageW.USER32(000000D1,00000001,00000010,00000010), ref: 00421300
ImageList_ReplaceIcon.COMCTL32(?,000000FF,00000000,?,?,00000001), ref: 0042130C

Part of subcall function 004215AA: __EH_prolog.LIBCMT ref: 004215AF
Part of subcall function 004215AA: GetDlgItem.USER32(?,?), ref: 004215EB
Part of subcall function 004215AA: CreateWindowExW.USER32(00000000,tooltips_class32,00000000,80000001,80000000,80000000,80000000,80000000,?,00000000,00000000), ref: 00421614
Part of subcall function 004215AA: SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 0042165D
Part of subcall function 004215AA: SendMessageA.USER32(?,00000418,00000000,00000190), ref: 00421670

wsprintfW.USER32 ref: 00421397
wsprintfW.USER32 ref: 004213DC
GetDlgItem.USER32(00000003,0000040E), ref: 004214EB
SetWindowTextW.USER32(00000000), ref: 004214EE
GetDlgItem.USER32(00000003,00000410), ref: 00421505
SetWindowTextW.USER32(00000000), ref: 00421508
GetDlgItem.USER32(00000003,00000419), ref: 0042151F
SetWindowTextW.USER32(00000000), ref: 00421522
wsprintfW.USER32 ref: 00421543
GetDlgItem.USER32(00000003,0000040F), ref: 0042155B
SetWindowTextW.USER32(00000000), ref: 0042155E
RedrawWindow.USER32(00000003,?,?,?,?,?,?,?,?,0000807D,00000000,0000002E,00000431,00000000,0000008F,0000807B), ref: 00421570
RedrawWindow.USER32(?,?,00000105,?,?,?,?,?,?,?,?,0000807D,00000000,0000002E,00000431,00000000), ref: 00421580
RedrawWindow.USER32(?,?,00000105,?,?,00000105,?,?,?,?,?,?,?,?,0000807D,00000000), ref: 0042158B

Strings

Del, xrefs: 0042107D
Right, xrefs: 004210B9
TAB, xrefs: 004210D7
%d %s, xrefs: 0042153D
Left, xrefs: 004210AA
Down, xrefs: 0042109B
- Admin, xrefs: 004211E9
# LNG, xrefs: 00421255
com, xrefs: 00421138
%s - OS:%d.%d %d, xrefs: 00421186
Portable, xrefs: 004211AF
Space, xrefs: 0042106E

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: Window$ImageItemText$IconList_wsprintf$RedrawReplace$CreateLoadMessageMetricsSendSystemlstrcat$H_prologHandleModule
String ID: - Admin$ Portable$# LNG$%d %s$%s - OS:%d.%d %d$Del$Down$Left$Right$Space$TAB$com
API String ID: 3856370618-2312742896
Opcode ID: 71d12696850239c9f4cd78f3de9dd9938dd74680712ffcc0ab19ed0ec9b747e8
Instruction ID: 834a4a3f23aa5bb824b6522172261bea01426560a814b550b8ce3e832c96033d
Opcode Fuzzy Hash: 71d12696850239c9f4cd78f3de9dd9938dd74680712ffcc0ab19ed0ec9b747e8
Instruction Fuzzy Hash: 02E193B1A40209BFDF00ABA0ED4AEFE7B7DEB54714F10402BF601760D1DAB95D548B69

Function 004205F1 Relevance: 65.0, APIs: 43, Instructions: 488windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00420603
GetWindowRect.USER32(?,00480388), ref: 0042061B
GetSystemMetrics.USER32(00000032), ref: 00420636
SendMessageW.USER32(?,00000005,00000000,00000000), ref: 0042065A
GetSystemMetrics.USER32(00000031), ref: 00420662
SendMessageW.USER32(?,00000404,00000004,?), ref: 004206D7
SetWindowPos.USER32(?,00000000,00000004,00000004,00000000,?,00000000), ref: 004206FB
GetWindowRect.USER32(?,?), ref: 0042070B
GetDlgItem.USER32(?,00000BD7), ref: 0042071D
GetDlgItem.USER32(?,00000FBE), ref: 0042072E
GetWindowRect.USER32(?,?), ref: 0042075D
ScreenToClient.USER32(?,?), ref: 0042077A
ScreenToClient.USER32(?,?), ref: 00420785
CopyRect.USER32(?,?), ref: 00420792
SetWindowPos.USER32(?,00000000,?,?,?,?,00000000), ref: 004207BC
ShowWindow.USER32(?,00000000), ref: 004207C6
SetWindowPos.USER32(?,00000000,?,?,?,00000005,00000040), ref: 004207E8
CopyRect.USER32(?,?), ref: 004207F6
SetWindowPos.USER32(00000000,0000000E,?,0000000E,?,00000000), ref: 0042086D
SetWindowPos.USER32(?,00000000,0000000E,?,0000000E,?,00000200), ref: 004208A8
GetSystemMetrics.USER32(00000032), ref: 004208C3
GetDlgItem.USER32(?,00000414), ref: 004208EE
SetWindowPos.USER32(00000000,00000000,0000000E,?,0000000E,?,00000000), ref: 00420912
GetDlgItem.USER32(?,000003EC), ref: 0042091C
SetWindowPos.USER32(?,00000000,0000000E,?,0000000E,?,00000000), ref: 00420956
GetSystemMetrics.USER32(00000032), ref: 0042095A
GetSystemMetrics.USER32(00000032), ref: 00420979
GetDlgItem.USER32(?,00000419), ref: 004209B4
ShowWindow.USER32(00000000,00000000), ref: 004209BC
SetWindowPos.USER32(?,00000000,0000000E,?,0000000E,?,00000040), ref: 004209DD
GetDlgItem.USER32(?,00000410), ref: 004209E7
ShowWindow.USER32(00000000,00000000), ref: 00420A1A
SetWindowPos.USER32(00000000,00000000,0000000E,?,0000000E,?,00000040), ref: 00420A39
GetDlgItem.USER32(?,0000041A), ref: 00420A5B
SetWindowPos.USER32(00000000,00000000,-000000EA,?,00000000,?,00000000), ref: 00420A88
GetDlgItem.USER32(?,00000412), ref: 00420AA6
SetWindowPos.USER32(?,00000000,00000000,?,0000000E,?,00000000), ref: 00420AEA
GetDlgItem.USER32(?,0000041E), ref: 00420AF4
SetWindowPos.USER32(?,00000000,0000000E,?,0000000E,?,00000000), ref: 00420B30
GetDlgItem.USER32(?,00000411), ref: 00420B3A
SetWindowPos.USER32(?,00000000,00000000,?,0000000E,?,00000000), ref: 00420B70
GetSystemMetrics.USER32(00000032), ref: 00420B76
SetWindowPos.USER32(00000000,00000000,?,?,00000000), ref: 00420BA5

Part of subcall function 004362C5: GetWindowLongW.USER32(00000000,000000FC), ref: 004362F0
Part of subcall function 004362C5: SetWindowLongW.USER32(?,000000FC,0043622C), ref: 00436305
Part of subcall function 004362C5: GetClientRect.USER32(?,00000000), ref: 0043631D
Part of subcall function 004362C5: SendMessageW.USER32(?,00000418,00000000,00000000), ref: 0043634A
Part of subcall function 004362C5: SendMessageW.USER32(?,0000041D,-00000001,?), ref: 0043635A
Part of subcall function 004362C5: SetWindowPos.USER32(?,00000000,00420BC1,?,00420BC1,?,00000040,?,?,?,00420BC1,00000000,00000000), ref: 00436379

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: Window$Item$Rect$MetricsSystem$ClientMessageSend$Show$CopyLongScreen
String ID:
API String ID: 1244584264-0
Opcode ID: 6f05e2dde071d3fcd63e3bbacb5e932178fae21c99f71a767f67f7f002c632da
Instruction ID: 923e96935bc56571748812aacab09e6193dce8e74519d4da1ece88cee5b03f58
Opcode Fuzzy Hash: 6f05e2dde071d3fcd63e3bbacb5e932178fae21c99f71a767f67f7f002c632da
Instruction Fuzzy Hash: B912F472D01208EFDF01DFA5EE89AEEBBB9FF48300F259025F904BA165D7715A108B64

Function 004218E6 Relevance: 49.3, APIs: 11, Strings: 17, Instructions: 265stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004218EB
wsprintfW.USER32 ref: 0042192C

Part of subcall function 00425052: wsprintfW.USER32 ref: 00425084

lstrcatW.KERNEL32(?,L-Win), ref: 004219C6
lstrcatW.KERNEL32(?,004550D4), ref: 00421A01
lstrcatW.KERNEL32(?,?), ref: 00421A0E
lstrcatW.KERNEL32(?,004454A8), ref: 00421A1C
lstrcatW.KERNEL32(?,?), ref: 00421A26
lstrcatW.KERNEL32(?,<E<N<D|), ref: 00421A3F
lstrcmpW.KERNEL32(?,?), ref: 00421A70
lstrcmpW.KERNEL32(?,?), ref: 00421AD4
wsprintfW.USER32 ref: 00421B0D

Part of subcall function 00407418: VirtualProtect.KERNELBASE(00000000,?,00000040,00000000,00000000,?,?,00407479,00407479,?,?,00407479,?,00407479,?,00000000), ref: 00407A89

Strings

R-Ctrl, xrefs: 0042198F
<E<N<D|, xrefs: 00421A39
L-Mouse, xrefs: 0042199B
Ctrl, xrefs: 00421977
4AD, xrefs: 004219CC
L-Win, xrefs: 004219BA
list_label, xrefs: 00421AEC
R-Win, xrefs: 00421953
list_text, xrefs: 00421A84
R-Mouse, xrefs: 004219B3
Alt-Gr, xrefs: 0042196B
Alt, xrefs: 00421983
|PE, xrefs: 00421B12
list_order, xrefs: 00421AB5
text_%03d, xrefs: 00421926, 00421B07
Ctrl-Alt, xrefs: 0042195F
M-Mouse, xrefs: 004219A7

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: lstrcat$wsprintf$lstrcmp$H_prologProtectVirtual
String ID: 4AD$<E<N<D|$Alt$Alt-Gr$Ctrl$Ctrl-Alt$L-Mouse$L-Win$M-Mouse$R-Ctrl$R-Mouse$R-Win$list_label$list_order$list_text$text_%03d$|PE
API String ID: 766033901-727685743
Opcode ID: ab1ac7291321ffb8395d8699d02c5a76e2d7558d9e51e62a37283f900eb86194
Instruction ID: 305e11b582ee5674688aba6902b22d4fce04e225f30b5c17fe9feb6b59f3fa5b
Opcode Fuzzy Hash: ab1ac7291321ffb8395d8699d02c5a76e2d7558d9e51e62a37283f900eb86194
Instruction Fuzzy Hash: BAA1E971900658BACB10EB90DD95FEE776CAF24304F5480ABF905A3191DB7C9B48CB69

Function 00409767 Relevance: 42.3, APIs: 22, Strings: 2, Instructions: 281windowCOMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,?), ref: 0042121B
GetSystemMetrics.USER32(00000032), ref: 004212A2
GetSystemMetrics.USER32(00000031), ref: 004212AB
ImageList_Create.COMCTL32(00000000,?,00000001), ref: 004212B2

Part of subcall function 004354E9: GetModuleHandleW.KERNEL32(shell32,004212C7,0000000E,?,00000001), ref: 004354F7
Part of subcall function 004354E9: LoadIconW.USER32(?,00000001), ref: 0043550D

ImageList_ReplaceIcon.COMCTL32(?,000000FF,00000000,0000000E,?,00000001), ref: 004212CD
ImageList_ReplaceIcon.COMCTL32(?,000000FF,00000000,00000098,?,00000001), ref: 004212E8
LoadImageW.USER32(000000D1,00000001,00000010,00000010), ref: 00421300
ImageList_ReplaceIcon.COMCTL32(?,000000FF,00000000,?,?,00000001), ref: 0042130C

Part of subcall function 004215AA: __EH_prolog.LIBCMT ref: 004215AF
Part of subcall function 004215AA: GetDlgItem.USER32(?,?), ref: 004215EB
Part of subcall function 004215AA: CreateWindowExW.USER32(00000000,tooltips_class32,00000000,80000001,80000000,80000000,80000000,80000000,?,00000000,00000000), ref: 00421614
Part of subcall function 004215AA: SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 0042165D
Part of subcall function 004215AA: SendMessageA.USER32(?,00000418,00000000,00000190), ref: 00421670

wsprintfW.USER32 ref: 00421397
wsprintfW.USER32 ref: 004213DC
GetDlgItem.USER32(00000003,0000040E), ref: 004214EB
SetWindowTextW.USER32(00000000), ref: 004214EE
GetDlgItem.USER32(00000003,00000410), ref: 00421505
SetWindowTextW.USER32(00000000), ref: 00421508
GetDlgItem.USER32(00000003,00000419), ref: 0042151F
SetWindowTextW.USER32(00000000), ref: 00421522
wsprintfW.USER32 ref: 00421543
GetDlgItem.USER32(00000003,0000040F), ref: 0042155B
SetWindowTextW.USER32(00000000), ref: 0042155E
RedrawWindow.USER32(00000003,?,?,?,?,?,?,?,?,0000807D,00000000,0000002E,00000431,00000000,0000008F,0000807B), ref: 00421570
RedrawWindow.USER32(?,?,00000105,?,?,?,?,?,?,?,?,0000807D,00000000,0000002E,00000431,00000000), ref: 00421580
RedrawWindow.USER32(?,?,00000105,?,?,00000105,?,?,?,?,?,?,?,?,0000807D,00000000), ref: 0042158B

Strings

%d %s, xrefs: 0042153D
# LNG, xrefs: 00421255

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: Window$ImageItemText$IconList_$RedrawReplacewsprintf$CreateLoadMessageMetricsSendSystem$H_prologHandleModule
String ID: # LNG$%d %s
API String ID: 2992916764-2253586768
Opcode ID: da5983419a4559f1027f641c8114bd3c8033d44ed9d59f051ba94f4b05c2b61e
Instruction ID: f622741300ae0914b383a02ba4c5aafbd4e7ebbb19e4042cb346f14007db6421
Opcode Fuzzy Hash: da5983419a4559f1027f641c8114bd3c8033d44ed9d59f051ba94f4b05c2b61e
Instruction Fuzzy Hash: 4191B5B1A40208BFEF00ABA1DC5BEAE7B7DFB14714F10402AF215760D1CEB95D508BA8

Function 00427502 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 324stringwindowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00427507
InterlockedIncrement.KERNEL32(-000000F4), ref: 00427532
wsprintfW.USER32 ref: 004275DA
lstrlenW.KERNEL32(00000000,000000FF,?,?,?,00000010), ref: 00427676
lstrlenW.KERNEL32(?,?,?,?,?,00000010), ref: 004276A1
lstrlenW.KERNEL32(00000000,?,?,?,?,?,?,?,00000010), ref: 004276CB

Part of subcall function 00421ECF: __EH_prolog.LIBCMT ref: 00421ED4
Part of subcall function 00421ECF: lstrlenW.KERNEL32(00000000,00001000,?,76F8E0B0,?,00000000,?,?,0042787E,00000000,?,?,00000000,?,?,00000000), ref: 00421F07

lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,?,00000010), ref: 004276F7
MessageBoxW.USER32(0000000A,?,?,00000003), ref: 004277D0

Strings

list_text, xrefs: 0042762E
%s: %d, xrefs: 0042777F
0hE, xrefs: 00427742
0hE, xrefs: 0042754F
text_%03d, xrefs: 004275D4
list, xrefs: 004275F3
list_order, xrefs: 0042765E
4AD, xrefs: 0042753A, 0042763B, 00427761
list_label, xrefs: 00427610

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: lstrlen$H_prolog$IncrementInterlockedMessagewsprintf
String ID: %s: %d$0hE$0hE$4AD$list$list_label$list_order$list_text$text_%03d
API String ID: 101203759-2156759317
Opcode ID: 07366b17da1440b678b856b95635ee26cb46325f8c93f296d7edc59e315c434e
Instruction ID: dff87e9b3940e85c95b9824c9d0008bd55deb00be2d41abe113388fb65a849ab
Opcode Fuzzy Hash: 07366b17da1440b678b856b95635ee26cb46325f8c93f296d7edc59e315c434e
Instruction Fuzzy Hash: 24C16171D0424DAADF04EBE5C999EEEBBBCAF19308F10016EE115B31C1DB785A44CB69

Function 00425052 Relevance: 29.8, APIs: 2, Strings: 15, Instructions: 93COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00425084
wsprintfW.USER32 ref: 004250A1

Strings

Del, xrefs: 0042511F
F%d, xrefs: 00425067
Down, xrefs: 0042513D
NUM_-, xrefs: 004250E3
NUM_+, xrefs: 004250CB
ESC3, xrefs: 00425107
Right, xrefs: 0042515B
TAB, xrefs: 004250B3
NUM_%d, xrefs: 0042507C
NUM_/, xrefs: 004250FB
Left, xrefs: 0042514C
NUM_., xrefs: 004250EF
NUM_,, xrefs: 004250D7
NUM_*, xrefs: 004250BF
Space, xrefs: 00425113

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: Del$Down$ESC3$F%d$Left$NUM_%d$NUM_*$NUM_+$NUM_,$NUM_-$NUM_.$NUM_/$Right$Space$TAB
API String ID: 2111968516-1788754765
Opcode ID: f66a46fd12f69995153c1cae6e64894327a738403d8d8ec6a87eacb9d8e3ef1b
Instruction ID: fb27a073f83e29f15c1bda8b5e65fb32c354b5abc1bede79b60cea97612c775e
Opcode Fuzzy Hash: f66a46fd12f69995153c1cae6e64894327a738403d8d8ec6a87eacb9d8e3ef1b
Instruction Fuzzy Hash: E8218311B48F34B64E300524BE92B3E62525626F66BF08513F902D86EAD1FD8CD691CF

Function 00435209 Relevance: 28.6, APIs: 19, Instructions: 150windowCOMMON

Download Yara Rule

APIs

GetIconInfo.USER32(?,?), ref: 0043521B
GetDC.USER32(00000000), ref: 0043522A
CreateCompatibleDC.GDI32(00000000), ref: 0043523C
CreateCompatibleDC.GDI32(00000000), ref: 00435242
GetObjectW.GDI32(?,00000018,?), ref: 00435269
CreateBitmap.GDI32(?,?,?,?,00000000), ref: 0043529A
SelectObject.GDI32(?,?), ref: 004352B7
SelectObject.GDI32(?,?), ref: 004352C2
GetPixel.GDI32(00000000,00000000,?), ref: 004352E6
SetPixel.GDI32(?,00000000,?,?), ref: 0043534A
SelectObject.GDI32(?,?), ref: 00435370
SelectObject.GDI32(?,?), ref: 00435378
CreateIconIndirect.USER32(00000001), ref: 0043538B
DeleteObject.GDI32(?), ref: 00435396
DeleteObject.GDI32(?), ref: 0043539B
DeleteObject.GDI32(?), ref: 004353A0
DeleteDC.GDI32(?), ref: 004353AB
DeleteDC.GDI32(?), ref: 004353B0
ReleaseDC.USER32(00000000,?), ref: 004353B7

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: Object$Delete$CreateSelect$CompatibleIconPixel$BitmapIndirectInfoRelease
String ID:
API String ID: 4176011905-0
Opcode ID: eaea4ba6c47036ab21d483449654682ba20451ed1df99df75e39fb9125468f94
Instruction ID: 049c9c6863bca4da748134b191693f4b8ac029bc71d22b5e3f0e0cc1fe1b6ce3
Opcode Fuzzy Hash: eaea4ba6c47036ab21d483449654682ba20451ed1df99df75e39fb9125468f94
Instruction Fuzzy Hash: 70510271D00218EFDF109FA1DC849AEBFB5FF48351F10902AE911B2260DB759A50EFA4

Function 004360E5 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 122windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(p#>u,ToolbarWindow32,00000000,00000000,00000000,00000000,000000B4,00000014,00000000,00000000,00000000,00000000), ref: 00436113
GetStockObject.GDI32(00000011), ref: 00436127
GetObjectW.GDI32(00000000,0000005C,?), ref: 00436145
SystemParametersInfoW.USER32(00000029,000001F4,?,00000000), ref: 0043616E
CreateFontIndirectW.GDI32(?), ref: 0043618A
SendMessageW.USER32(?,00000030,?,00000000), ref: 004361A2
SendMessageW.USER32(?,0000041E,00000014,00000000), ref: 004361AF
SendMessageW.USER32(?,00000420,00000000,00100000), ref: 004361BF
GetDlgItem.USER32(?,?), ref: 004361CC
ShowWindow.USER32(00000000,00000000), ref: 004361E1
GetWindowRect.USER32(00000000,?), ref: 004361EC
ScreenToClient.USER32(?,?), ref: 004361FF
ScreenToClient.USER32(?,?), ref: 00436208
SetWindowPos.USER32(?,00000000,?,?,?,00000018,00000000), ref: 0043621E

Strings

ToolbarWindow32, xrefs: 0043610B
p#>u, xrefs: 00436110

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: Window$MessageSend$ClientCreateObjectScreen$FontIndirectInfoItemParametersRectShowStockSystem
String ID: ToolbarWindow32$p#>u
API String ID: 171734827-4017920843
Opcode ID: 872a04bb76daadf6eeb8962ea1ced062aef14eece72818880b888df5f63a513b
Instruction ID: 92c2e2c1fc3dde78d9c0d2bc275dc0a06e604331f58c1d2c7f24981343337753
Opcode Fuzzy Hash: 872a04bb76daadf6eeb8962ea1ced062aef14eece72818880b888df5f63a513b
Instruction Fuzzy Hash: D541097690021DBFEF119FA4DC84EEE7B7DEB08344F008426FA14A61A0D771AE149F64

Function 004355CC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 129windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,ToolbarWindow32,00000000,5600994C,00000000,00000000,000000B4,?,?,00000000,00000000), ref: 00435601
GetStockObject.GDI32(00000011), ref: 00435615
GetObjectW.GDI32(00000000,0000005C,?), ref: 00435633
SystemParametersInfoW.USER32(00000029,000001F4,?,00000000), ref: 0043565C
CreateFontIndirectW.GDI32(?), ref: 0043567A
SendMessageW.USER32(?,00000030,?,00000000), ref: 00435692
SendMessageW.USER32(?,0000041E,00000014,00000000), ref: 0043569F
SendMessageW.USER32(?,00000420,00000000,00100001), ref: 004356AF
GetClientRect.USER32(?,?), ref: 004356C3
SetWindowPos.USER32(?,00000000,00000000,?,?,00000000,00000040), ref: 004356E9
GetWindowLongW.USER32(?,000000FC), ref: 00435700
SetWindowLongW.USER32(?,000000FC,00435849), ref: 00435717
GetWindowLongW.USER32(?,000000FC), ref: 0043571E
SetWindowLongW.USER32(?,000000FC,0043580B), ref: 0043572F

Strings

ToolbarWindow32, xrefs: 004355FB

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: Window$Long$MessageSend$CreateObject$ClientFontIndirectInfoParametersRectStockSystem
String ID: ToolbarWindow32
API String ID: 2936060913-4104838417
Opcode ID: 3f51542d2a0b2004c8526f9ef05dbcaebad891402990623c3b930f2bb6b1b828
Instruction ID: f76f25e1fa694d056b7f7f73ac2d24a184e6b0527aa05ac2f277c84c8476ae4a
Opcode Fuzzy Hash: 3f51542d2a0b2004c8526f9ef05dbcaebad891402990623c3b930f2bb6b1b828
Instruction Fuzzy Hash: 5D418172900224BFDB509FA5EC89EEB7F78EF48760F115125FA08E61A1D7709904CF94

Function 00432160 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 105windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,ToolbarWindow32,00000000,?,00000000,00000000,000000B4,00000014,?,00000000,00000000), ref: 0043218B
GetStockObject.GDI32(00000011), ref: 0043219E
GetObjectW.GDI32(00000000,0000005C,?), ref: 004321BC
CreateFontIndirectW.GDI32(?), ref: 004321D1
SendMessageW.USER32(00000000,00000030,?,00000000), ref: 004321E7
SendMessageW.USER32(00000000,0000041E,00000014,00000000), ref: 004321F2
SendMessageW.USER32(00000000,00000420,00000000,00100000), ref: 00432200
GetDlgItem.USER32(?,?), ref: 0043220D
ShowWindow.USER32(?,00000000), ref: 00432225
GetWindowRect.USER32(?,?), ref: 00432232
ScreenToClient.USER32(?,?), ref: 00432245
ScreenToClient.USER32(?,?), ref: 0043224E
SetWindowPos.USER32(00000000,00000000,?,?,?,00000018,00000000), ref: 00432262

Strings

ToolbarWindow32, xrefs: 00432183

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: Window$MessageSend$ClientCreateObjectScreen$FontIndirectItemRectShowStock
String ID: ToolbarWindow32
API String ID: 1801995013-4104838417
Opcode ID: 75dccdb2353e919780bed2b11c83ca037eab2203106cc7818d96142dd42cfe0a
Instruction ID: cc59631b687ed46b3897f8ef20cc18819bfc4e5e2055f90e08ac7289b8131753
Opcode Fuzzy Hash: 75dccdb2353e919780bed2b11c83ca037eab2203106cc7818d96142dd42cfe0a
Instruction Fuzzy Hash: E83129B690025DBFEB019FA4EC85EEF7BBDFB48749F004025FA00A61A1D3719D149BA5

Function 00421ECF Relevance: 21.2, APIs: 2, Strings: 10, Instructions: 190stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00421ED4
lstrlenW.KERNEL32(00000000,00001000,?,76F8E0B0,?,00000000,?,?,0042787E,00000000,?,?,00000000,?,?,00000000), ref: 00421F07

Strings

R-Ctrl, xrefs: 00421FD5
Alt-Gr, xrefs: 00421F84
Alt, xrefs: 00421FBC
R-Mouse, xrefs: 00422018
L-Mouse, xrefs: 00421FEA
Ctrl, xrefs: 00421FA0
Ctrl-Alt, xrefs: 00421F6B
M-Mouse, xrefs: 00422003
L-Win, xrefs: 0042202D
R-Win, xrefs: 00421F52

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: H_prologlstrlen
String ID: Alt$Alt-Gr$Ctrl$Ctrl-Alt$L-Mouse$L-Win$M-Mouse$R-Ctrl$R-Mouse$R-Win
API String ID: 2133942097-684211483
Opcode ID: f3bd2888a5d8743ae5920ba6bac0428a4c442ee898a2ef51e22436192443f3a1
Instruction ID: e34d6a5a56890267d0a77cb0a0af09d494010216408d4ade35e7860ad381712d
Opcode Fuzzy Hash: f3bd2888a5d8743ae5920ba6bac0428a4c442ee898a2ef51e22436192443f3a1
Instruction Fuzzy Hash: 6F512522B44A30B5CB31A750F941FBF6364AF2176AF60802FF511E61D2EBEC5A45C29D

Function 0042A30D Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 53stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(?,R-Mouse), ref: 0042A381
lstrcatW.KERNEL32(?,L-Win), ref: 0042A395

Strings

R-Ctrl, xrefs: 0042A355
Alt-Gr, xrefs: 0042A331
Alt, xrefs: 0042A349
R-Mouse, xrefs: 0042A379
L-Mouse, xrefs: 0042A361
Ctrl, xrefs: 0042A33D
Ctrl-Alt, xrefs: 0042A325
M-Mouse, xrefs: 0042A36D
L-Win, xrefs: 0042A38D
R-Win, xrefs: 0042A319

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: Alt$Alt-Gr$Ctrl$Ctrl-Alt$L-Mouse$L-Win$M-Mouse$R-Ctrl$R-Mouse$R-Win
API String ID: 4038537762-684211483
Opcode ID: 0196e6e6f9712b71f51dbd6c5d103967daff606a101654226cc2a381356c9e14
Instruction ID: a020f727c1a1fbe9591c624d4daefe5a6311d8d08f741b389f1f89b872b333bc
Opcode Fuzzy Hash: 0196e6e6f9712b71f51dbd6c5d103967daff606a101654226cc2a381356c9e14
Instruction Fuzzy Hash: 2101D432FC4A30F74E30A4487C51BBA6A401326B22BF14163FD5ABA5A6419D0CB5598F

Function 00430481 Relevance: 19.6, APIs: 13, Instructions: 112COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00430486
OffsetRect.USER32(?,?,?), ref: 004304D0
OffsetRect.USER32(00000001,00000001,00000001), ref: 004304EB
GetSysColor.USER32(00000014), ref: 004304F9
GetSysColor.USER32(00000010), ref: 00430521
CreatePen.GDI32(00000000,00000000,00000000), ref: 00430526
DeleteObject.GDI32(00000000), ref: 00430548
DeleteObject.GDI32(?), ref: 00430552
CreatePen.GDI32(00000000,00000000,00000000), ref: 00430506

Part of subcall function 00431AAD: SelectObject.GDI32(0043058E,753DA5C0), ref: 00431ABA
Part of subcall function 00431AAD: MoveToEx.GDI32(0043058E,0043058E,1015FF56,00000000), ref: 00431AD6
Part of subcall function 00431AAD: LineTo.GDI32(0043058E,8B0043C1,5E5FF44D), ref: 00431AE5
Part of subcall function 00431AAD: MoveToEx.GDI32(0043058E,00000001,1015FF56,00000000), ref: 00431AF1
Part of subcall function 00431AAD: LineTo.GDI32(0043058E,8B0043C2,5E5FF44D), ref: 00431AFC
Part of subcall function 00431AAD: MoveToEx.GDI32(0043058E,0043058E,5E5FF44C,00000000), ref: 00431B08
Part of subcall function 00431AAD: LineTo.GDI32(0043058E,8B0043C1,1015FF55), ref: 00431B13
Part of subcall function 00431AAD: MoveToEx.GDI32(0043058E,5E5FF44D,5E5FF44C,00000000), ref: 00431B21
Part of subcall function 00431AAD: LineTo.GDI32(0043058E,8B0043C2,1015FF55), ref: 00431B2E
Part of subcall function 00431AAD: SelectObject.GDI32(0043058E,753DA5C0), ref: 00431B35

OffsetRect.USER32(00000006,00000001,00000001), ref: 00430562
GetSysColor.USER32(00000012), ref: 0043056A
CreatePen.GDI32(00000000,00000000,00000000), ref: 00430575
DeleteObject.GDI32(00000000), ref: 00430593

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: Object$LineMove$ColorCreateDeleteOffsetRect$Select$H_prolog
String ID:
API String ID: 132611724-0
Opcode ID: 138b57e503952e2e3ef7f0f16d7fd84a21ad59701c9fec39699694140e1e4f3a
Instruction ID: 46e6b0f7213544dc18f5c4da83762ef9c03a1ef126acf789cfd90c33d762b217
Opcode Fuzzy Hash: 138b57e503952e2e3ef7f0f16d7fd84a21ad59701c9fec39699694140e1e4f3a
Instruction Fuzzy Hash: 80411AB1D00218AFDB11DFA5CC85BEEBBB9EF48314F00951AF915B7250C7B59A048FA5

Function 00429893 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 112filestringCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,?,?,?,?,?,?,?,004125B6,?,0000006C), ref: 004298BC
DeleteFileW.KERNEL32(?,?,?,?,?,?,?,?,?,004125B6,?,0000006C), ref: 004298DC
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,004125B6), ref: 004298F8
lstrlenW.KERNEL32(?,###,00445324,?,?,?,?,?,?,?,?,?,?,?,?,004125B6), ref: 00429959
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000002,00000000,00000000), ref: 0042997F
WriteFile.KERNEL32(?,?,?,?,00000000,?,00000002,00000000,00000000), ref: 00429994
CloseHandle.KERNEL32(?,?,?,?,00000000,?,00000002,00000000,00000000), ref: 0042999D
ShellExecuteW.SHELL32(00000000,open,?,00000000,?,00000000), ref: 004299B9

Strings

open, xrefs: 004299B3
4AD, xrefs: 0042990A
###, xrefs: 00429940

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: File$ByteCharCloseCreateDeleteExecuteHandleModuleMulusermeShellWideWritelstrlen
String ID: ###$4AD$open
API String ID: 1606040545-3056923521
Opcode ID: efe5b113935c41e16996ba03ce4bbef9e4ee182b36a0f832c85522ae5f0f1a04
Instruction ID: b97f26abca5239a11c7f3b777444ca19ae663cfffff06a9f8f6e3006e6f88426
Opcode Fuzzy Hash: efe5b113935c41e16996ba03ce4bbef9e4ee182b36a0f832c85522ae5f0f1a04
Instruction Fuzzy Hash: C9414D7280112AABCF10EBA1DC89EDFBB78FF05354F1044AAF115B3191DB785A45CB64

Function 00436F70 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00000000,?,?,?,?,?,00436B7E,?,?), ref: 00436F89
lstrlenW.KERNEL32(?,?,?,?,?,00436B7E,?,?), ref: 00436FA6
SetTextColor.GDI32(0000FFFF,~kC), ref: 00436FB7
OutputDebugStringW.KERNEL32(NULL,?,?,?,?,00436B7E,?,?), ref: 00436FC8
GetCurrentObject.GDI32(0000FFFF,00000006), ref: 00436FD3
GetObjectW.GDI32(00000000,0000005C,?), ref: 00436FE4
CreateFontIndirectW.GDI32(?), ref: 00436FEB
DrawTextW.USER32(0000FFFF,?,0000FFFF,00000000,?), ref: 0043701F
DrawTextW.USER32(0000FFFF,?,000000FF,00000000,?), ref: 0043704F

Strings

NULL, xrefs: 00436FC3
~kC, xrefs: 00436FB1

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: Text$DrawObjectlstrlen$ColorCreateCurrentDebugFontIndirectOutputString
String ID: NULL$~kC
API String ID: 2332924160-1157440343
Opcode ID: 4ae050228ae3f762b57b8d527a585c44ffd6c7374dfb5799d373051af9ff40f5
Instruction ID: 32513ef4225b7dbf12b6419026106d66b39d41e6418e96635585d9dc61f34225
Opcode Fuzzy Hash: 4ae050228ae3f762b57b8d527a585c44ffd6c7374dfb5799d373051af9ff40f5
Instruction Fuzzy Hash: 64318D7150020AFFCB149FA8DC85AAA7BB9EF08314F119129F916E22A0C735D9519B18

Function 00435BFC Relevance: 18.2, APIs: 12, Instructions: 175windowCOMMON

Download Yara Rule

APIs

ScreenToClient.USER32(?,?), ref: 00435C44

Part of subcall function 00435BAB: SendMessageW.USER32(?,00000445,00000000,?), ref: 00435BB9

ScreenToClient.USER32(?,?), ref: 00435C91

Part of subcall function 00435DFE: GetMessagePos.USER32 ref: 00435DFE

PostMessageW.USER32(?,0000084D,00000000,00000000), ref: 00435D01
SendMessageW.USER32(?,0000011F,?,?), ref: 00435D1A
PostMessageW.USER32(?,0000001F,00000000,00000000), ref: 00435D65
PostMessageW.USER32(?,0000084D,00000000,00000000), ref: 00435D71
PostMessageW.USER32(?,00000100,00000028,00000000), ref: 00435D7E

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: Message$Post$ClientScreenSend
String ID:
API String ID: 438416525-0
Opcode ID: 60a7e8d324673432992717aaadcd6ff05456399c72d3870ab3bd338f88e9b8a5
Instruction ID: 2a1818dc928b07f8f12ddde4aa5868b3ec20cef3fe632689e787451c26aeece7
Opcode Fuzzy Hash: 60a7e8d324673432992717aaadcd6ff05456399c72d3870ab3bd338f88e9b8a5
Instruction Fuzzy Hash: 8051B231500B04AFCB319F16CC88E9BBBF9EF8CB04F10952EF58696661C774A941DB18

Function 0042D4F4 Relevance: 18.1, APIs: 12, Instructions: 87COMMON

Download Yara Rule

APIs

GetClientRect.USER32(00000000,00000000), ref: 0042D511
DrawEdge.USER32(?,00000000,00000006,0000200B), ref: 0042D53A
FillRect.USER32(?,00000000,00000010), ref: 0042D549
DrawEdge.USER32(?,00000000,00000006,00002007), ref: 0042D56D
FillRect.USER32(?,00000000,00000010), ref: 0042D57A
GetSysColor.USER32(00000008), ref: 0042D582
SetTextColor.GDI32(?,00000000), ref: 0042D58A
SetBkMode.GDI32(?,00000001), ref: 0042D593
GetStockObject.GDI32(00000011), ref: 0042D59B
SelectObject.GDI32(?,00000000), ref: 0042D5A9
DrawTextW.USER32(?,?,000000FF,00000004,00008024), ref: 0042D5D0
SelectObject.GDI32(?,00000004), ref: 0042D5DA

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: DrawObjectRect$ColorEdgeFillSelectText$ClientModeStock
String ID:
API String ID: 303100802-0
Opcode ID: be91fde70604ba309ba84b06fb5e41ceb87a93f3c22d6c4ac74820cc584e0c58
Instruction ID: d2e2adb73274232bb2aef0161fc503774a35fff9785f72c0be1fa87e41e1273c
Opcode Fuzzy Hash: be91fde70604ba309ba84b06fb5e41ceb87a93f3c22d6c4ac74820cc584e0c58
Instruction Fuzzy Hash: F2316B32900218BFEB018FA4DC88EFFBBB8FB08714F004529FA16E6190C771A945CB65

Function 0043680E Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 358COMMON

Download Yara Rule

APIs

Part of subcall function 0043672E: GetSysColor.USER32(?), ref: 0043673B

CopyRect.USER32(?,?), ref: 00436943

Strings

, xrefs: 00436863

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ColorCopyRect
String ID:
API String ID: 3794717969-1776720792
Opcode ID: 5c9772dec5d805dd6dfde49b813ff185bcd6ae061b483e24b21aff21b6c50cda
Instruction ID: bab850502f826ae16235fee4ad5b7b1deb26fd9a43b8bc222d4fcaf7f1f5b6e4
Opcode Fuzzy Hash: 5c9772dec5d805dd6dfde49b813ff185bcd6ae061b483e24b21aff21b6c50cda
Instruction Fuzzy Hash: DCD16C71E00209EFCF14DFA8C885BEEBBB6AF48304F15806AE905BB291D775A945CF54

Function 00434F5D Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 106windowCOMMON

Download Yara Rule

APIs

FindWindowExW.USER32(00000000,00000000,Shell_TrayWnd,00000000), ref: 00434F77
FindWindowExW.USER32(00000000,00000000,TrayNotifyWnd,00000000), ref: 00434F85
GetWindowRect.USER32(00000000,?), ref: 00434F8F
SHAppBarMessage.SHELL32(00000005,?), ref: 00434FA7
FindWindowExW.USER32(00000000,00000000,Shell_TrayWnd,00000000), ref: 00435004
GetWindowRect.USER32(00000000,?), ref: 0043500F

Strings

TrayNotifyWnd, xrefs: 00434F7E
Shell_TrayWnd, xrefs: 00434F6E, 00434F74, 00435001
$, xrefs: 00434F9D

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: Window$Find$Rect$Message
String ID: $$Shell_TrayWnd$TrayNotifyWnd
API String ID: 805496052-1160186678
Opcode ID: aca470a4a86d356b83a37e2c4104057e75468c51ea3e762e57e9c2cb622da7ca
Instruction ID: 2c9f2e3420141922909e519893d12b107e4d3a1898551895d3851cf8cf98412b
Opcode Fuzzy Hash: aca470a4a86d356b83a37e2c4104057e75468c51ea3e762e57e9c2cb622da7ca
Instruction Fuzzy Hash: 8231A170900605AFC728CF69C888DABBBF8EF89714F14855EF85AD7390D635AC40CB68

Function 00435F35 Relevance: 15.1, APIs: 10, Instructions: 111windowthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00435E57: GetSysColor.USER32(00000004), ref: 00435E70
Part of subcall function 00435E57: CreateSolidBrush.GDI32(00202020), ref: 00435E79

IsWindowVisible.USER32(?), ref: 00435F4B
GetActiveWindow.USER32 ref: 00435F59
GetSubMenu.USER32(?,?), ref: 00435F6E

Part of subcall function 00435BC2: SendMessageW.USER32(?,00000403,?,?), ref: 00435BDA

Part of subcall function 00435B92: SendMessageW.USER32(?,0000041D,?,?), ref: 00435BA2

MapWindowPoints.USER32(?,00000000,?,00000001), ref: 00435FC8
MapWindowPoints.USER32(?,00000000,?,00000002), ref: 00435FD4
GetCurrentThreadId.KERNEL32 ref: 00435FF6
SetWindowsHookExW.USER32(000000FF,0043607A,00000000,00000000), ref: 00436007
TrackPopupMenuEx.USER32(?,00000140,?,?,?,00000014), ref: 0043602D
SendMessageW.USER32(?,00000111,00000000,AFFE0000), ref: 00436045
UnhookWindowsHookEx.USER32(?), ref: 00436060

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: Window$MessageSend$HookMenuPointsWindows$ActiveBrushColorCreateCurrentPopupSolidThreadTrackUnhookVisible
String ID:
API String ID: 3555522823-0
Opcode ID: d5e96c71b40245e8c850c57e5173b7712c3bfd98b42217a16c0dcc6eb81ae308
Instruction ID: af8b7d620b30591a07dcb7c5db87775e86cc94bb11aca02fd2cfae0a4338fb78
Opcode Fuzzy Hash: d5e96c71b40245e8c850c57e5173b7712c3bfd98b42217a16c0dcc6eb81ae308
Instruction Fuzzy Hash: 6541BCB2900214BFDF519FA5DC858AFBFB9FF48310B10956AF915E6265C370A900CF94

Function 004365CD Relevance: 15.1, APIs: 10, Instructions: 104COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000F), ref: 004365F3
GetDC.USER32(00000000), ref: 0043660F
CreateFontIndirectW.GDI32(?), ref: 00436637
SelectObject.GDI32(?,00000000), ref: 00436643
DrawTextW.USER32(?,?,000000FF,?,00000424), ref: 0043667D
SelectObject.GDI32(?,?), ref: 0043668F
DeleteObject.GDI32(?), ref: 0043669A
GetSystemMetrics.USER32(00000047), ref: 004366D8
ReleaseDC.USER32(00000000,?), ref: 004366E9

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: Object$MetricsSelectSystem$CreateDeleteDrawFontIndirectReleaseText
String ID:
API String ID: 2845678740-0
Opcode ID: 0dd1cdc975fa90c191e1b3f6d902dcce56dbf230f0a94245f5353f29224a4e99
Instruction ID: eefc56dc4ba074cc05ed8a12dcb2865e0cc639ee1b886fa549392c0575cec96a
Opcode Fuzzy Hash: 0dd1cdc975fa90c191e1b3f6d902dcce56dbf230f0a94245f5353f29224a4e99
Instruction Fuzzy Hash: FE419F31900629EFCF11CFA8C889AEEBBB5FF48740F15816AE915B7251C774A901DF98

Function 00425CDF Relevance: 15.1, APIs: 10, Instructions: 92windowtimeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00425CE4
SendMessageW.USER32(00001042,00000000,00000000,00000000), ref: 00425D02

Part of subcall function 00425C5D: SendMessageW.USER32(?,00000401,0000807B), ref: 00425C86
Part of subcall function 00425C5D: SendMessageW.USER32(?,00000401,0000807D), ref: 00425C90
Part of subcall function 00425C5D: SendMessageW.USER32(?,00000401,00008019), ref: 00425C9B
Part of subcall function 00425C5D: SendMessageW.USER32(?,00000401,0000807B,00000000), ref: 00425CB7
Part of subcall function 00425C5D: SendMessageW.USER32(?,00000401,0000807D,00000000), ref: 00425CC2
Part of subcall function 00425C5D: SendMessageW.USER32(?,00000401,00008019,00000000), ref: 00425CD6

SetWindowTextW.USER32(?,004547B4), ref: 00425D53
SetWindowTextW.USER32(?,?), ref: 00425D62
KillTimer.USER32(000007E8), ref: 00425D70
SetTimer.USER32(000007E8,000000C8,00000000), ref: 00425D84
SetDlgItemTextW.USER32(00000000,000003EC,00002010), ref: 00425D99
SetWindowTextW.USER32(?,00002010), ref: 00425DAA
SendMessageW.USER32(?,0000014D,00000000,?), ref: 00425DF3
SendMessageW.USER32(?,0000014E,?,00000000), ref: 00425E05

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: MessageSend$Text$Window$Timer$H_prologItemKill
String ID:
API String ID: 82283145-0
Opcode ID: 83940ea356a066c9a797e54e52d9d700b06477df8abd2e1b2e9692bab9a6a61c
Instruction ID: 5f8deb670cbed0adec7b50a07d3aa2b4b88e6be29a6496bd3395f5a303cc45d5
Opcode Fuzzy Hash: 83940ea356a066c9a797e54e52d9d700b06477df8abd2e1b2e9692bab9a6a61c
Instruction Fuzzy Hash: 2C31AD71640208FBDB11AB60ECC9EEEB7B9FB08744F00442DF515A21E1DB74AD54CB18

Function 00428264 Relevance: 15.1, APIs: 10, Instructions: 92COMMON

Download Yara Rule

APIs

GetWindowPlacement.USER32(?,?), ref: 00428275
GetSystemMetrics.USER32(0000004F), ref: 004282AE
GetSystemMetrics.USER32(0000004D), ref: 004282B4
GetSystemMetrics.USER32(0000004E), ref: 004282BB
GetSystemMetrics.USER32(0000004C), ref: 004282C1
GetSystemMetrics.USER32(0000004D), ref: 004282C8
GetSystemMetrics.USER32(0000004C), ref: 004282CD
SetRect.USER32(?,00000000), ref: 004282D4
GetWindowRect.USER32(?,?), ref: 004282E1
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00428336

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: MetricsSystem$Window$Rect$MovePlacement
String ID:
API String ID: 3067230557-0
Opcode ID: 870f133595a486a6bf26aa3be2a5cb3c4c7eade40f216451adebc92329adc0dc
Instruction ID: 8bd225a0a0a47aa8a0b0c8ad36270c41b07badd969337c926225b95b87dd0b4f
Opcode Fuzzy Hash: 870f133595a486a6bf26aa3be2a5cb3c4c7eade40f216451adebc92329adc0dc
Instruction Fuzzy Hash: 4731EC71F00229AFDF04DBA8DD85AEEBBF9EF48710F10412AE605A7250DB75AD41CB94

Function 00431AAD Relevance: 15.1, APIs: 10, Instructions: 72COMMON

Download Yara Rule

APIs

SelectObject.GDI32(0043058E,753DA5C0), ref: 00431ABA
MoveToEx.GDI32(0043058E,0043058E,1015FF56,00000000), ref: 00431AD6
LineTo.GDI32(0043058E,8B0043C1,5E5FF44D), ref: 00431AE5
MoveToEx.GDI32(0043058E,00000001,1015FF56,00000000), ref: 00431AF1
LineTo.GDI32(0043058E,8B0043C2,5E5FF44D), ref: 00431AFC
MoveToEx.GDI32(0043058E,0043058E,5E5FF44C,00000000), ref: 00431B08
LineTo.GDI32(0043058E,8B0043C1,1015FF55), ref: 00431B13
MoveToEx.GDI32(0043058E,5E5FF44D,5E5FF44C,00000000), ref: 00431B21
LineTo.GDI32(0043058E,8B0043C2,1015FF55), ref: 00431B2E
SelectObject.GDI32(0043058E,753DA5C0), ref: 00431B35

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: LineMove$ObjectSelect
String ID:
API String ID: 796595582-0
Opcode ID: 6aed04852779ff3942b37f3775a677f39a3531c3661310badc0ad0f59d01eb94
Instruction ID: 43eb38f613f85a163b313d79e2c63de9559be0ea8cdf3e02458cd8719bfd43f5
Opcode Fuzzy Hash: 6aed04852779ff3942b37f3775a677f39a3531c3661310badc0ad0f59d01eb94
Instruction Fuzzy Hash: 70117A75200604BFE6129B55DCC0E7BF7F9EF89B10F108819F9A9D2510C725E852AB25

Function 00437058 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 122windowstringCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 004370A1
GetMenuItemInfoW.USER32(00000064,?,00000001,?), ref: 004370ED
lstrlenW.KERNEL32(?), ref: 00437179
lstrcpyW.KERNEL32(00000000,?), ref: 00437199
SetMenuItemInfoW.USER32(00000064,?,00000001,?), ref: 004371AE
GetMenuItemCount.USER32(00000064), ref: 004371BA

Strings

1, xrefs: 004370FE
d, xrefs: 004370DC

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ItemMenu$CountInfo$lstrcpylstrlen
String ID: 1$d
API String ID: 1621444650-1642009170
Opcode ID: ae4c2c2dfed70d91c995b68a4d3dcd87616bf17e0b87870d315791c588e9eb51
Instruction ID: ab7f1e7837498ced5c99314300850d25f9edd8aff39392c0aee1037423d7d266
Opcode Fuzzy Hash: ae4c2c2dfed70d91c995b68a4d3dcd87616bf17e0b87870d315791c588e9eb51
Instruction Fuzzy Hash: 5E419DB290420AEFDF30DF94D985AAEBBB4FB08354F10952AE845A7350D7349944CF64

Function 00435886 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 100windowCOMMON

Download Yara Rule

APIs

DestroyMenu.USER32(?), ref: 004358A9
SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 004358C3
SendMessageW.USER32(?,00000418,00000000,00000000), ref: 004358CF
SendMessageW.USER32(?,00000416,00000000,00000000), ref: 004358E2
GetMenuItemCount.USER32(?), ref: 00435903
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0043594A
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 0043597F

Strings

d, xrefs: 00435925

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: MessageSend$Menu$Item$CountDestroyInfo
String ID: d
API String ID: 4101362009-2564639436
Opcode ID: 34ee46e3f99a2cd70cd31549637652a982901960939b6ab3df41581c115caaa0
Instruction ID: 67dbf8287af0168786e3cb0bfa77e2e4c122d9a401f88475f16c37208581ae31
Opcode Fuzzy Hash: 34ee46e3f99a2cd70cd31549637652a982901960939b6ab3df41581c115caaa0
Instruction Fuzzy Hash: E1317CB1900208BFDB219F65DC81E9FBBB8EF08354F10542AF645E6690D374AD858F64

Function 004215AA Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 81windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004215AF
GetDlgItem.USER32(?,?), ref: 004215EB
CreateWindowExW.USER32(00000000,tooltips_class32,00000000,80000001,80000000,80000000,80000000,80000000,?,00000000,00000000), ref: 00421614
SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 0042165D
SendMessageA.USER32(?,00000418,00000000,00000190), ref: 00421670

Strings

,, xrefs: 00421635
Test, xrefs: 004215D8
tooltips_class32, xrefs: 0042160E

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: MessageSend$CreateH_prologItemWindow
String ID: ,$Test$tooltips_class32
API String ID: 4127292747-3622912971
Opcode ID: f8674888962ce4a140350cb7c02e21500a5a8d2e049f66933eb3e064291a758e
Instruction ID: 4a65af810be17d5466e0fa3a19395ecaa88b91b0f0ad7673a24ad41d318fb192
Opcode Fuzzy Hash: f8674888962ce4a140350cb7c02e21500a5a8d2e049f66933eb3e064291a758e
Instruction Fuzzy Hash: 7F216072A00218FFDB10CF64DC84AEEBBB9FB18750F11813AF905A6290C7754D44CB68

Function 00435A19 Relevance: 13.6, APIs: 9, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000045A,?,00000000), ref: 00435A62
GetClientRect.USER32(?,00000000), ref: 00435A88
PostMessageW.USER32(?,0000084D,00000000,00000000), ref: 00435ADE
PostMessageW.USER32(?,00000100,00000028,00000000), ref: 00435AEB
SendMessageW.USER32(?,0000045A,?,?), ref: 00435B0A
GetClientRect.USER32(?,00000000), ref: 00435B2C
SendMessageW.USER32(?,0000130A,00000000,00000000), ref: 00435B4D
SendMessageW.USER32(?,00000417,00000000,00000000), ref: 00435B6B
PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00435B7C

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: Message$Send$Post$ClientRect
String ID:
API String ID: 2800339571-0
Opcode ID: 02e0a1ac313f76683fc824ef5578c044bd7c86950fdc723cdfe1c487a2cdf429
Instruction ID: 8b76a7bbb7dd5651a2b8aff8d266f85c98f0d81b6d8569f3e9fc264057a03356
Opcode Fuzzy Hash: 02e0a1ac313f76683fc824ef5578c044bd7c86950fdc723cdfe1c487a2cdf429
Instruction Fuzzy Hash: B7414C72900A08BFEB119FA8DD85BEEF7F9EB4C311F105425F601E61A0D7B4AD049B65

Function 00436419 Relevance: 13.6, APIs: 9, Instructions: 81COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000011), ref: 0043642D
GetObjectW.GDI32(00000000,0000005C,?), ref: 0043643A
SystemParametersInfoW.USER32(00000029,000001F4,?,00000000), ref: 00436464
CreateFontIndirectW.GDI32(?), ref: 00436491
CreateFontIndirectW.GDI32(?), ref: 004364A9
GetSystemMetrics.USER32(00000032), ref: 004364B9
GetSystemMetrics.USER32(00000031), ref: 004364C5
GetSystemMetrics.USER32(00000031), ref: 004364D2
GetSystemMetrics.USER32(00000032), ref: 004364DC

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: System$Metrics$CreateFontIndirectObject$InfoParametersStock
String ID:
API String ID: 4204584070-0
Opcode ID: ab5df36e46a9c33517faad016574ca79f5ca83dd5ec28b48bc76654b598bc8f7
Instruction ID: 8b5ddb9cb34b4abd4672a7546851bcf7586be4e33035710cce3a73d3990b9d3d
Opcode Fuzzy Hash: ab5df36e46a9c33517faad016574ca79f5ca83dd5ec28b48bc76654b598bc8f7
Instruction Fuzzy Hash: 86312B72D443149FEF548FA48C89BDA7BB8FB04304F0400AAEA08AF186E7B46505CF65

Function 0043754D Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 92registrystringCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0043755B

Part of subcall function 00437536: GetModuleFileNameW.KERNEL32(?,?,?,00437425,?,?,00000208), ref: 00437542

RegOpenKeyW.ADVAPI32(-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,?), ref: 004375F7
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?), ref: 00437620
lstrlenW.KERNEL32(?), ref: 0043764A
RegSetValueExW.ADVAPI32(?,?,00000000,00000001,?,00000000), ref: 00437662

Strings

" -bg, xrefs: 004375B7
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 004375F1

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ModuleValue$FileHandleNameOpenQuerylstrlen
String ID: " -bg$SOFTWARE\Microsoft\Windows\CurrentVersion\Run
API String ID: 3684264954-3110968143
Opcode ID: 66ab3222d0c0240831c30e7605ffc9ee20574bf8d73156f420feff6f773cae43
Instruction ID: c29cf95cee922bc5516625886b548d78ba82a48099b151cd577d435e0fbe8af1
Opcode Fuzzy Hash: 66ab3222d0c0240831c30e7605ffc9ee20574bf8d73156f420feff6f773cae43
Instruction Fuzzy Hash: AA3164B294011CABDF20DBA5DD89EDFB7BCEF48310F0045A6B509E2151DA749B85CF64

Function 00428E73 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 79windowCOMMON

Download Yara Rule

APIs

InitCommonControlsEx.COMCTL32(?), ref: 00428E8F
CreateWindowExW.USER32(00000000,tooltips_class32,00456168,?,80000000,80000000,80000000,80000000,00000000,00000000,?,00000000), ref: 00428ECA
SendMessageW.USER32(00000004,00000432,00000000,0000002C), ref: 00428F31
SendMessageW.USER32(00000004,00000421,00000001,?), ref: 00428F46

Strings

,, xrefs: 00428ED9
tooltips_class32, xrefs: 00428EC4
No Text associated, xrefs: 00428EFE

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: MessageSend$CommonControlsCreateInitWindow
String ID: ,$No Text associated$tooltips_class32
API String ID: 3342334947-1383969392
Opcode ID: c1e45a4e3f247445cfc8ed18c1330415fc3ecb413c95c108c4e7451c0e230ecf
Instruction ID: 8e3712aa7acb00232c6ec16f81002e9e2d711b15805aa15c19c7bcd2e4cca355
Opcode Fuzzy Hash: c1e45a4e3f247445cfc8ed18c1330415fc3ecb413c95c108c4e7451c0e230ecf
Instruction Fuzzy Hash: E42171B1A01309AFDB10CF95DD85AAFBBF9FB48314F50402EF615E3290C7B499048B64

Function 00427C1A Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 55registryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00427C1F
RegSetValueExW.ADVAPI32(?,_________ADMIN_TEST_SoftwareOK_DOK,00000000,00000004,00000000,00000004,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020006,?,?,?,?,004211E5,?), ref: 00427C75
RegCloseKey.ADVAPI32(?,?,?,?,004211E5,?), ref: 00427C8D
RegDeleteValueW.ADVAPI32(?,_________ADMIN_TEST_SoftwareOK_DOK,?,?,?,004211E5,?), ref: 00427C9B
RegCloseKey.ADVAPI32(?,?,?,?,004211E5,?), ref: 00427CB2

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion, xrefs: 00427C46
_________ADMIN_TEST_SoftwareOK_DOK, xrefs: 00427C6B, 00427C71, 00427C97

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: CloseValue$DeleteH_prolog
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion$_________ADMIN_TEST_SoftwareOK_DOK
API String ID: 2485495262-3000701925
Opcode ID: 9bd88f4235432e50c426d5700a8792d4f1201c1e48b424f363935baa0b819853
Instruction ID: b68bf3dc38133edbe771ec151f4e5719081e62b5f70673435e2283974a714e34
Opcode Fuzzy Hash: 9bd88f4235432e50c426d5700a8792d4f1201c1e48b424f363935baa0b819853
Instruction Fuzzy Hash: 511194B0A00225EBCB219FA6EC45BAFBBB9FB84701F00062BF111B51A1C7784940DB68

Function 00436D29 Relevance: 10.6, APIs: 7, Instructions: 140COMMON

Download Yara Rule

APIs

SetBkColor.GDI32(?,00000000), ref: 00436DB1
ExtTextOutW.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 00436DD3
SetBkColor.GDI32(?,00000000), ref: 00436DDF
SetPixel.GDI32(?,?,00000000,00000000), ref: 00436E0C
SetPixel.GDI32(?,00000000,00000000,00000000), ref: 00436E1D
SetPixel.GDI32(?,?,00000000,00000000), ref: 00436E55
SetPixel.GDI32(?,00000000,00000000,00000000), ref: 00436E66

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: Pixel$Color$Text
String ID:
API String ID: 98714010-0
Opcode ID: 823f748bbc1fa12dc0c71d92b990de8f11a86ca1ce6d5b11bbc1689569002d4a
Instruction ID: d099eac011f95741b9d61141177dafcc1c442d3a7173c642c8adaa2b6a63c7a4
Opcode Fuzzy Hash: 823f748bbc1fa12dc0c71d92b990de8f11a86ca1ce6d5b11bbc1689569002d4a
Instruction Fuzzy Hash: DF510572A0011EAFCF01CFA8CD859EE7BB5FF08348F02812AFD54A6250C3759D259B94

Function 00424930 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 110stringwindowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00424935
SendMessageW.USER32(?,00001073,?,?), ref: 004249B2
lstrlenW.KERNEL32(00000000), ref: 004249C1
lstrcpynW.KERNEL32(?,?,?,?,No-Edit,?,?,00000001), ref: 00424A5B

Strings

4AD, xrefs: 00424970
No-Edit, xrefs: 00424943

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: H_prologMessageSendlstrcpynlstrlen
String ID: 4AD$No-Edit
API String ID: 1355327639-2827627885
Opcode ID: ca2140508e88d2823e51b227dfb65c55b94b4dd3de4d7bb3ec7bc2a5443e0de2
Instruction ID: 525aca3b652f3ad0fd2ff23f3a39ad9f164bad48392fc2ea544207c4399d0d49
Opcode Fuzzy Hash: ca2140508e88d2823e51b227dfb65c55b94b4dd3de4d7bb3ec7bc2a5443e0de2
Instruction Fuzzy Hash: 3941C4B2A10219DFDB10DFA4D885AEF77B4EF54314F10452FE401A72C0DB785A44CBA8

Function 0042BE3E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 85windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042C5A9: CreateWindowExW.USER32(00000000,ToolbarWindow32,00000000,?,?,00000000,?,00000000,?,00000000,00000000,5600094E), ref: 0042C5ED

SendMessageW.USER32(00000000,0000041E,00000014,00000000), ref: 0042BE92
SendMessageW.USER32(?,00000444,00000001,?), ref: 0042BEBC
SendMessageW.USER32(?,00000420,00000000,000B000D), ref: 0042BECD
SendMessageW.USER32(?,0000041F,00000000,00120014), ref: 0042BEDC
SetWindowPos.USER32(?,00000000,00000000,00000000,00000014,00000012,00000016,?,00000000,5600094E,00000000,00000000,?,00000000,?), ref: 0042BF04

Strings

R, xrefs: 0042BEAF

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: MessageSend$Window$Create
String ID: R
API String ID: 363225742-880014062
Opcode ID: 44d74488b458383f830a37710df3e5c9157c40167d0e38d6889842612e2d3058
Instruction ID: 4f984f6de87d68ed15a3930f1a19e0a1d8b0ccabfa63d346ffacca1ab36ff6cb
Opcode Fuzzy Hash: 44d74488b458383f830a37710df3e5c9157c40167d0e38d6889842612e2d3058
Instruction Fuzzy Hash: 4421A431740268BAEB205B5ADC46FDB7FB9EBC9B04F40005AB700FA1E6C6F05904DAE5

Function 00425931 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 79stringwindowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001042,00000000,00000000), ref: 0042595E
lstrcpyW.KERNEL32(?,MenuBreak:,00000000,00000000,00000000), ref: 004259DD
lstrcpyW.KERNEL32(?,MenuBreak:), ref: 004259E7

Strings

E54453, xrefs: 00425992
E54455, xrefs: 004259A3
MenuBreak:, xrefs: 004259D0, 004259DB, 004259E5

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: lstrcpy$MessageSend
String ID: E54453$E54455$MenuBreak:
API String ID: 749160242-3811496160
Opcode ID: d847fb029aeb95c1808352b37276a7629e34667e6f5bf58758126a7060354814
Instruction ID: ae8bf0fb2b8ac56c75039195bb49617105d3e424e9a1fa973d64a3bfbcaa12ab
Opcode Fuzzy Hash: d847fb029aeb95c1808352b37276a7629e34667e6f5bf58758126a7060354814
Instruction Fuzzy Hash: D9210B71B11218B7CF14A7A59C56AEE77AD9BC8320F10406FF901F7381DAB85E418798

Function 00423C17 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 71stringwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00424245: lstrcpyW.KERNEL32(?), ref: 0042425B
Part of subcall function 00424245: lstrcatW.KERNEL32(?,00000000,\Backup), ref: 0042428F
Part of subcall function 00424245: CreateDirectoryW.KERNEL32(?,00000000), ref: 004242A6
Part of subcall function 00424245: lstrlenW.KERNEL32(?), ref: 004242BD

MessageBoxW.USER32(?,00000000,00000000,00000000), ref: 00423C42
lstrcpyW.KERNEL32(?), ref: 00423C62

Strings

open, xrefs: 00423CDB
use_backup_d, xrefs: 00423CB5
Error 321, xrefs: 00423C2C
use_backup_h, xrefs: 00423C91

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: lstrcpy$CreateDirectoryMessagelstrcatlstrlen
String ID: Error 321$open$use_backup_d$use_backup_h
API String ID: 2723441971-4221616228
Opcode ID: 4c4bb09373d20a6c2803dccd173523e41e1d200dbffac5f50e3391eb70922121
Instruction ID: 5a414714267ca566798a7933c35b8ce7628397c0567d460f9e152fcddd83709a
Opcode Fuzzy Hash: 4c4bb09373d20a6c2803dccd173523e41e1d200dbffac5f50e3391eb70922121
Instruction Fuzzy Hash: B811E772620220AEDB246F31FC0AA7E3768EB00306F50487FF901F2191F97D9A55975D

Function 00424156 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 71filetimeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042415B

Part of subcall function 00424245: lstrcpyW.KERNEL32(?), ref: 0042425B
Part of subcall function 00424245: lstrcatW.KERNEL32(?,00000000,\Backup), ref: 0042428F
Part of subcall function 00424245: CreateDirectoryW.KERNEL32(?,00000000), ref: 004242A6
Part of subcall function 00424245: lstrlenW.KERNEL32(?), ref: 004242BD

GetLocalTime.KERNEL32(?), ref: 0042416C

Part of subcall function 00407418: VirtualProtect.KERNELBASE(00000000,?,00000040,00000000,00000000,?,?,00407479,00407479,?,?,00407479,?,00407479,?,00000000), ref: 00407A89

CopyFileW.KERNEL32(?,00000000,?,00000000,?,?,0048039C,00000000,00445508), ref: 00424207

Strings

last_backup, xrefs: 0042417C
4AD, xrefs: 00424186
%02d-%02d-%02d_%02d-%02d-%02d_%s.ini, xrefs: 004241BC

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: CopyCreateDirectoryFileH_prologLocalProtectTimeVirtuallstrcatlstrcpylstrlen
String ID: %02d-%02d-%02d_%02d-%02d-%02d_%s.ini$4AD$last_backup
API String ID: 1991952598-3850644810
Opcode ID: 9e552855b8de75b9d4827896550e001c5279c362eb6a3d3a5da95fbda08a0535
Instruction ID: 8c1af6343298e20960110cf1ab86fd2bd36cdd14f9dc99471fedbc98cf0c5e88
Opcode Fuzzy Hash: 9e552855b8de75b9d4827896550e001c5279c362eb6a3d3a5da95fbda08a0535
Instruction Fuzzy Hash: 74214BB1C00249AADB00EBE5C946BFEBBB8AF08705F10406AF551B31C2D77C9A44D779

Function 0043622C Relevance: 10.6, APIs: 7, Instructions: 61windowCOMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,00000014,?,?), ref: 0043624A
GetParent.USER32(?), ref: 0043625E
GetParent.USER32(00000000), ref: 00436261
MapWindowPoints.USER32(?,00000000,?,00000001), ref: 0043627D
OffsetWindowOrgEx.GDI32(?,?,?,?), ref: 00436296
SendMessageW.USER32(00000000,00000014,?,00000000), ref: 0043629F
OffsetWindowOrgEx.GDI32(?,?,?,?), ref: 004362BA

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: Window$OffsetParent$CallMessagePointsProcSend
String ID:
API String ID: 593092700-0
Opcode ID: 626aed2c86cc15b35851dd1dd7cd3fbf682c3f01cfdcc080fc99eecc66589346
Instruction ID: 1b369d1bca0969bd8b2634237acd7de0d378513594854ca44be8d192bcae6432
Opcode Fuzzy Hash: 626aed2c86cc15b35851dd1dd7cd3fbf682c3f01cfdcc080fc99eecc66589346
Instruction Fuzzy Hash: 6D11A77690025DBFDF119F95DC84CEEBFBEFB48350F018466FA15A2160C6719A10AF64

Function 00424245 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(?), ref: 0042425B
lstrcatW.KERNEL32(?,00000000,\Backup), ref: 0042428F
CreateDirectoryW.KERNEL32(?,00000000), ref: 004242A6
lstrlenW.KERNEL32(?), ref: 004242BD

Strings

hAB, xrefs: 0042427E, 00424295
\Backup, xrefs: 00424279

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: CreateDirectorylstrcatlstrcpylstrlen
String ID: \Backup$hAB
API String ID: 291623610-2780332934
Opcode ID: df9651015e083aa5677f6518775e4b3ace0f5f424d346ddda6fe4bd26c0da0b8
Instruction ID: 5d9425836112100eaf2b6b8e5aeeddb2b8b346ef44fab14ca78b7b7aa9d58edc
Opcode Fuzzy Hash: df9651015e083aa5677f6518775e4b3ace0f5f424d346ddda6fe4bd26c0da0b8
Instruction Fuzzy Hash: 180156F59101099BDF10EBA1DD59F9A777CAB44304F0004E5A705F20D2DB749A458F5C

Function 0042D41B Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

SetRect.USER32(0042BD45,00000000,00000000,00000000,?), ref: 0042D44B
SetWindowPos.USER32(?,00000000,00000002,00000003,00000000,00000000,00000015,?,?,0042BD45,?,00000000), ref: 0042D468
SetWindowPos.USER32(?,00000000,00000000,?,00000000,?,00000004,?,?,0042BD45,?,00000000), ref: 0042D483
SetRect.USER32(0042BD45,00000000,00000000,00000000,00000000), ref: 0042D49B
SetWindowPos.USER32(?,00000000,-000000E9,00000003,00000000,00000000,00000015,?,?,0042BD45,?,00000000), ref: 0042D4BD
InvalidateRect.USER32(00000000,0042BD45,00000001,?,?,0042BD45,?,00000000), ref: 0042D4E7

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: RectWindow$Invalidate
String ID:
API String ID: 1056487977-0
Opcode ID: 5afb842bdec1a3cce351e7e9e9114239a5e0f35c927c0db12be784a85ca540a9
Instruction ID: 9a7c52b52044f0b9150fede3bba70a30080b0dbe8a6437ef3e0f636978d02bb5
Opcode Fuzzy Hash: 5afb842bdec1a3cce351e7e9e9114239a5e0f35c927c0db12be784a85ca540a9
Instruction Fuzzy Hash: 1F3143B2600618BFEB119FA4DCC4EBBB7ADEB48754F408529FA46E7650C670FD018B64

Function 004362C5 Relevance: 9.1, APIs: 6, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000000,000000FC), ref: 004362F0
SetWindowLongW.USER32(?,000000FC,0043622C), ref: 00436305
GetClientRect.USER32(?,00000000), ref: 0043631D
SendMessageW.USER32(?,00000418,00000000,00000000), ref: 0043634A
SendMessageW.USER32(?,0000041D,-00000001,?), ref: 0043635A
SetWindowPos.USER32(?,00000000,00420BC1,?,00420BC1,?,00000040,?,?,?,00420BC1,00000000,00000000), ref: 00436379

Part of subcall function 004360E5: CreateWindowExW.USER32(p#>u,ToolbarWindow32,00000000,00000000,00000000,00000000,000000B4,00000014,00000000,00000000,00000000,00000000), ref: 00436113
Part of subcall function 004360E5: GetStockObject.GDI32(00000011), ref: 00436127
Part of subcall function 004360E5: GetObjectW.GDI32(00000000,0000005C,?), ref: 00436145
Part of subcall function 004360E5: SystemParametersInfoW.USER32(00000029,000001F4,?,00000000), ref: 0043616E
Part of subcall function 004360E5: CreateFontIndirectW.GDI32(?), ref: 0043618A
Part of subcall function 004360E5: SendMessageW.USER32(?,00000030,?,00000000), ref: 004361A2
Part of subcall function 004360E5: SendMessageW.USER32(?,0000041E,00000014,00000000), ref: 004361AF
Part of subcall function 004360E5: SendMessageW.USER32(?,00000420,00000000,00100000), ref: 004361BF
Part of subcall function 004360E5: GetDlgItem.USER32(?,?), ref: 004361CC
Part of subcall function 004360E5: ShowWindow.USER32(00000000,00000000), ref: 004361E1
Part of subcall function 004360E5: GetWindowRect.USER32(00000000,?), ref: 004361EC

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: Window$MessageSend$CreateLongObjectRect$ClientFontIndirectInfoItemParametersShowStockSystem
String ID:
API String ID: 3062793459-0
Opcode ID: cdd7510cf0f21a5f206af28a3c6f98eba230aeda3fa79f76c1b1993af790ee0a
Instruction ID: 6fa5585dfdfa755437bdcf99a996e14e6fb65e5566723ec97538393471b35915
Opcode Fuzzy Hash: cdd7510cf0f21a5f206af28a3c6f98eba230aeda3fa79f76c1b1993af790ee0a
Instruction Fuzzy Hash: 882162B2900619BFEB11AFA4DC85CBFBBB9FB08754F004529F612A11A0C772AD10CB54

Function 00430273 Relevance: 9.1, APIs: 6, Instructions: 66windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00430278
GetWindowDC.USER32(?,?,?,?,00000001), ref: 004302B5

Part of subcall function 004318E0: CreateBitmap.GDI32(00000008,00000008,00000001,00000001,?), ref: 00431915
Part of subcall function 004318E0: CreatePatternBrush.GDI32(00000000), ref: 00431922
Part of subcall function 004318E0: DeleteObject.GDI32(00000000), ref: 0043192B

SelectObject.GDI32(?,?), ref: 004302DA
PatBlt.GDI32(?,?,?,?,?,005A0049), ref: 004302FA
SelectObject.GDI32(?,00000000), ref: 00430304
DeleteObject.GDI32(?), ref: 00430307

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: Object$CreateDeleteSelect$BitmapBrushH_prologPatternWindow
String ID:
API String ID: 3230913206-0
Opcode ID: f6250e884e8d8b66865a145d47d1cc8868aca51843dab574d2639dc39cc198a2
Instruction ID: c11674e792ad895603e7ae83b2f7238172a1f69c4ea2e823c6e8fab6d9ad6268
Opcode Fuzzy Hash: f6250e884e8d8b66865a145d47d1cc8868aca51843dab574d2639dc39cc198a2
Instruction Fuzzy Hash: 5F21E572D00219AFCB00EFE9CD869EEBBB9FB08350F04516AE515B3291D7399941CBA4

Function 00425C5D Relevance: 9.1, APIs: 6, Instructions: 55windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000401,0000807B), ref: 00425C86
SendMessageW.USER32(?,00000401,0000807D), ref: 00425C90
SendMessageW.USER32(?,00000401,00008019), ref: 00425C9B
SendMessageW.USER32(?,00000401,0000807B,00000000), ref: 00425CB7
SendMessageW.USER32(?,00000401,0000807D,00000000), ref: 00425CC2
SendMessageW.USER32(?,00000401,00008019,00000000), ref: 00425CD6

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 76cfa821a99e5cd8c24453d739d7a6786c4f021e617c5beb8bf8cb98bf5a9bfa
Instruction ID: ca941d673646c457d2aca30d321aa660bec5691bca5c67db969b8d8c9d1bec7e
Opcode Fuzzy Hash: 76cfa821a99e5cd8c24453d739d7a6786c4f021e617c5beb8bf8cb98bf5a9bfa
Instruction Fuzzy Hash: 0701D171B4432876D23096379C88F277EACEBC2F61F15442AB644E60C1CA79A804C774

Function 00433D4C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00433D51
SHGetDesktopFolder.SHELL32(?), ref: 00433D76
ILCombine.SHELL32(?,?), ref: 00433DEB
ILFree.SHELL32(?), ref: 00433EB8

Strings

4AD, xrefs: 00433DD6

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: CombineDesktopFolderFreeH_prolog
String ID: 4AD
API String ID: 2472301591-1156607891
Opcode ID: e1c6b5c3396b9a74d4f7803e7b67e7efc60ef74d1efc0caebdd765398830d3df
Instruction ID: c43f26274bbcab29b743a3eba8f8bc5ae05b5634fbb95af1ae08d608ebfbef1e
Opcode Fuzzy Hash: e1c6b5c3396b9a74d4f7803e7b67e7efc60ef74d1efc0caebdd765398830d3df
Instruction Fuzzy Hash: 10516071904259EFDF10DFA4C989ADEBBB8EF48314F1040AAF505B7281C778AE04CBA5

Function 0043748C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,?), ref: 004374AB
lstrlenW.KERNEL32(?,?,?,00437486,?,?,?,?," -bg,?,?,?,00454984), ref: 004374BA
RegSetValueExW.ADVAPI32(00000000,00000208,00000000,00000001,?,00000000,?,?,00437486,?,?,?,?," -bg,?,?), ref: 004374CF
RegCloseKey.ADVAPI32(00000000,?,?,00437486,?,?,?,?," -bg,?,?,?,00454984), ref: 004374DA

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 00437499

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: CloseOpenValuelstrlen
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
API String ID: 2964171075-3913687870
Opcode ID: 30a21f67d9d09dc05d4b23aefdb543e1f9a85324633e6cdcfef0dd8a64dfa347
Instruction ID: 2ceedae9dc0c1995bab63891bbcd1d91b5384f924f370bdbf12778e3a071c21b
Opcode Fuzzy Hash: 30a21f67d9d09dc05d4b23aefdb543e1f9a85324633e6cdcfef0dd8a64dfa347
Instruction Fuzzy Hash: 94F09A3781036AEBDF210FA0DC4ABEB3B69FF043A1F018620FC28A5160D775C9609B94

Function 0042BBBE Relevance: 7.6, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(753D4920,?,00000001,?,753D4920,?,00000001), ref: 0042BC10
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004,?,?,?,753D4920,?,00000001), ref: 0042BC4F
InvalidateRect.USER32(753D4920,?,00000001,?,?,?,753D4920,?,00000001), ref: 0042BC60
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004,?,?,753D4920,?,00000001), ref: 0042BCA7
InvalidateRect.USER32(753D4920,?,00000001,?,?,753D4920,?,00000001), ref: 0042BCB8

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: InvalidateRect$Window
String ID:
API String ID: 2579585970-0
Opcode ID: d25773a06468afcf545132c1d8922e7dc084e531c35e1c88104e25638d9c6b93
Instruction ID: 19135094c6df45e34b20abd5c0d7e70cbf642a7af8c4ebe2beb88d05cbd2d263
Opcode Fuzzy Hash: d25773a06468afcf545132c1d8922e7dc084e531c35e1c88104e25638d9c6b93
Instruction Fuzzy Hash: F6311BB2A0011AEFCF10DF99D9869FFBB79EB44314F50016AE611A3290CB356941DB95

Function 004264D2 Relevance: 7.6, APIs: 5, Instructions: 86stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000), ref: 004264F0
GetEnvironmentVariableW.KERNEL32(?,?,00000208), ref: 00426567
lstrcatW.KERNEL32(?,?), ref: 00426595
lstrlenW.KERNEL32(?), ref: 004265B0
lstrcpyW.KERNEL32(00000000,?), ref: 004265E5

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: lstrlen$EnvironmentVariablelstrcatlstrcpy
String ID:
API String ID: 4067718196-0
Opcode ID: 689eb6f683813cff23308c80fd02acc3e2134cfa9f3102650246d9308dc47932
Instruction ID: a93edea7da4d4899329c06e4eb84b9fb86500c73c2a2d66807996ec3ed989cbd
Opcode Fuzzy Hash: 689eb6f683813cff23308c80fd02acc3e2134cfa9f3102650246d9308dc47932
Instruction Fuzzy Hash: 8431B072910228ABCF21DF48EC846DEB3F4FF18300F5045A6D945E3220E7749AD58BD8

Function 004323BC Relevance: 7.6, APIs: 5, Instructions: 64fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004323C1
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000004,00000080,00000000,00000000,?,?,?,0042181D,00456830,?,00000000,00000000), ref: 004323E2
WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000,00456830,?,?,0042181D,00456830,?,00000000,00000000,?), ref: 0043240B
WriteFile.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,0042181D,00456830,?,00000000,00000000,?), ref: 00432428
CloseHandle.KERNEL32(00000000,?,?,0042181D,00456830,?,00000000,00000000,?,?,?,00421E9B,?,?,?,?), ref: 0043242B

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: File$Write$CloseCreateH_prologHandle
String ID:
API String ID: 2041372692-0
Opcode ID: 1d0891a27ab082212569f6b6c974edbf0ce1f31d20da91cb306e8ec8960a8337
Instruction ID: e0cf3023d2533926c737bf7126066b7ab1a7276685e7b990d7760ebfb0582e74
Opcode Fuzzy Hash: 1d0891a27ab082212569f6b6c974edbf0ce1f31d20da91cb306e8ec8960a8337
Instruction Fuzzy Hash: 0A118E70500208BEDB10DB65DD89EAF7B7CEB88724F10421AF551E72E1D7B45A01CB64

Function 00430328 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(?), ref: 0043033D
GetWindowLongW.USER32(?,000000EC), ref: 0043035C
GetSystemMetrics.USER32(?), ref: 00430372
GetSystemMetrics.USER32(?), ref: 0043038E
SystemParametersInfoW.USER32(00000026,00000000,?,00000000), ref: 0043039F

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: System$Metrics$InfoLongParametersWindow
String ID:
API String ID: 72108969-0
Opcode ID: 1cc4a1359398968863d07bd687d5fdc9b902957087c532c0d436a0cca70025cd
Instruction ID: e0a1c76b84bf8acbd95bf98adef0aa024b93c271ea1de0d9e930c4df4dd8b195
Opcode Fuzzy Hash: 1cc4a1359398968863d07bd687d5fdc9b902957087c532c0d436a0cca70025cd
Instruction Fuzzy Hash: FC11AC722507109FE7209F39CD4AB6AB3E4EBA8710F001B2EE482C76D0D778E845CB48

Function 0041F600 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 0041F60F
GetDlgItem.USER32(?,000003F7), ref: 0041F642
SetWindowPos.USER32(00000000), ref: 0041F64B
GetDlgItem.USER32(?,0000041D), ref: 0041F655
SetWindowPos.USER32(00000000,00000000,?,?,?,00000014,00000000), ref: 0041F66F

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: ItemWindow$ClientRect
String ID:
API String ID: 3857652467-0
Opcode ID: 2ec0658b5d4e4b8b45ed11b5361e37e669d432922f7a65f0b14cab60ca4adec7
Instruction ID: 39b0bc59052787c31fa0be47496c43408b3b1618e3587cfc5ac7796f203d5fa7
Opcode Fuzzy Hash: 2ec0658b5d4e4b8b45ed11b5361e37e669d432922f7a65f0b14cab60ca4adec7
Instruction Fuzzy Hash: 1B010476A00219BBDF00EBE8DC55FBE7B7DEB88700F040158F611B61A2C671AA10DBA4

Function 00426DE8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(?,00456168), ref: 00426E3B
GetModuleHandleW.KERNEL32(00000000), ref: 00426E4E
GetOpenFileNameW.COMDLG32(0000004C), ref: 00426E7C

Part of subcall function 00427502: __EH_prolog.LIBCMT ref: 00427507
Part of subcall function 00427502: InterlockedIncrement.KERNEL32(-000000F4), ref: 00427532
Part of subcall function 00427502: wsprintfW.USER32 ref: 004275DA

Strings

L, xrefs: 00426E47

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: FileH_prologHandleIncrementInterlockedModuleNameOpenlstrcatwsprintf
String ID: L
API String ID: 998826993-2909332022
Opcode ID: 56594663d0703831b2f3f0b6afeaadba6e808f07715dbfa4f927eebb35addb0f
Instruction ID: 5d8469f7ef1b97ed5ccfa38109bf4958b2e7bba871ead841c3b78ac34a2f7ac0
Opcode Fuzzy Hash: 56594663d0703831b2f3f0b6afeaadba6e808f07715dbfa4f927eebb35addb0f
Instruction Fuzzy Hash: 76116A71E003589BDF54CF94CC457DEB7B9BF48302F00406AD105B7280DBB95A898F59

Function 0043598B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000444,00000001,?), ref: 004359F6
SendMessageW.USER32(00000000,00000440,?,00000020), ref: 00435A0E

Strings

:cC, xrefs: 004359B2
, xrefs: 004359C3

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: MessageSend
String ID: $:cC
API String ID: 3850602802-2689247352
Opcode ID: b6be724ffc89ea9c68968f2ea9316348c7c60fb0f0a11f3cf0fab30b33a0f5c2
Instruction ID: c420a73713401dbab9f0e02ccf6eaa8cd534b2db7598aba9dc244a5b4b478a92
Opcode Fuzzy Hash: b6be724ffc89ea9c68968f2ea9316348c7c60fb0f0a11f3cf0fab30b33a0f5c2
Instruction Fuzzy Hash: 03113071A0028CEFDF00CFD9D844BDEBBB4EF44314F048016E914AA295D3B59515DF65

Function 0042169F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 004216B1
SendMessageW.USER32(?,00000433,00000000,?), ref: 004216EC
SendMessageW.USER32(?,00000432,00000000,0000002C), ref: 00421717

Strings

,, xrefs: 004216F1

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: MessageSend$Item
String ID: ,
API String ID: 3888421826-3772416878
Opcode ID: 54e00455506e2c76601c277b6ec646d38a313d747a679faeb7b5c55891d413a2
Instruction ID: e5665baada64295f7c02611f98c27c35f43ebbc44d05b6f3011a9d3297f79af1
Opcode Fuzzy Hash: 54e00455506e2c76601c277b6ec646d38a313d747a679faeb7b5c55891d413a2
Instruction Fuzzy Hash: BE11AF76E00218AFDB00DFA9DC55ADDBBB4FF4C710F109026EA14BB290D6B59A45CF68

Function 004374EA Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,?), ref: 00437509
RegDeleteValueW.ADVAPI32(?,?), ref: 0043751B
RegCloseKey.ADVAPI32(?), ref: 00437526

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 004374F7

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
API String ID: 849931509-3913687870
Opcode ID: 0220bb65a57990b1609bbb8ec334c0a7c02d6554820eec917214b62211459a15
Instruction ID: 59c5435105357cda73140981fc49627d41e5a9f77ffab6543ae7563a6603dc63
Opcode Fuzzy Hash: 0220bb65a57990b1609bbb8ec334c0a7c02d6554820eec917214b62211459a15
Instruction Fuzzy Hash: 5DE03037810229EBCF251FB0DC4969A7BA5EB08371F01C125FD18AA210D739C9409F94

Function 0043551A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(USER32.DLL,00435EA8,?,?,?,?), ref: 00435528
GetProcAddress.KERNEL32(?,SetMenuInfo), ref: 00435546

Strings

SetMenuInfo, xrefs: 00435540
USER32.DLL, xrefs: 00435523

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SetMenuInfo$USER32.DLL
API String ID: 2574300362-3329878150
Opcode ID: 98adff75472883bb36f32fb166f88d904f831f7eadf3cd23d295b96331bbcdeb
Instruction ID: 5916e2fc36fe8bba6e0fc43ecc7b0183c6b496dbd579211a3983e5e27e86c943
Opcode Fuzzy Hash: 98adff75472883bb36f32fb166f88d904f831f7eadf3cd23d295b96331bbcdeb
Instruction Fuzzy Hash: FAE0C271620600AFDF619F24EC0971A3AA5F728742F00683AB40A922A4D778A448EF4C

Function 00436C21 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

SetPixel.GDI32(?,?,00000000,?), ref: 00436C99
SetPixel.GDI32(?,?,00000000,?), ref: 00436CA7
SetPixel.GDI32(?,?,00000000,?), ref: 00436CB5
SetPixel.GDI32(?,?,00000000,?), ref: 00436CC3

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: Pixel
String ID:
API String ID: 3195210534-0
Opcode ID: f5ac0db82702d0b4e9d5f0b973c34283a37342df7875bbe1c37e92ff6137fece
Instruction ID: db52c432db6c09696b0e690863e35eee4e14e024e0a01d6cddf26fbad3f81550
Opcode Fuzzy Hash: f5ac0db82702d0b4e9d5f0b973c34283a37342df7875bbe1c37e92ff6137fece
Instruction Fuzzy Hash: 0421F33290011EEFCF019FA9DD458DEBFB2FF48350F158166EA14A2260C7359A61EB90

Function 00429B7C Relevance: 6.1, APIs: 4, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00429B97
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?,00000000,00000000), ref: 00429BCF
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00429BE3
CloseHandle.KERNEL32(?), ref: 00429BEC

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: File$ByteCharCloseCreateHandleMultiWideWrite
String ID:
API String ID: 1078690013-0
Opcode ID: fcd345e099a6bf93a850157cf3f6ac57d52df9ba181830237b478ca082b12d32
Instruction ID: 82ed86162d68cebab0e1acd3225a60407c9899cbbfb5fde9063b479654f97b37
Opcode Fuzzy Hash: fcd345e099a6bf93a850157cf3f6ac57d52df9ba181830237b478ca082b12d32
Instruction Fuzzy Hash: 1E113A71100008BFEB209F55DC89EAABBBDEB89754F10416AF511E71E0DB70AE41DB64

Function 0042D279 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,00000005,?), ref: 0042D29E
GetMessagePos.USER32 ref: 0042D2B0
ScreenToClient.USER32(?,?), ref: 0042D2CC
PtInRect.USER32(?,?,?), ref: 0042D2EE

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: CallClientMessageProcRectScreenWindow
String ID:
API String ID: 2980354656-0
Opcode ID: 7a72edbe208eb9f7f80a718336dc999f757fa1644bf2837c0e2e88546a471468
Instruction ID: 2b02a2273540d2a3acd45090b37fce7c15d31cc95de6c475789917453dd6b7b5
Opcode Fuzzy Hash: 7a72edbe208eb9f7f80a718336dc999f757fa1644bf2837c0e2e88546a471468
Instruction Fuzzy Hash: 0D11A372E00229AF8F219F94DC898AFBFB9FB04315B504166EC45E2210D7359911D794

Function 004254DA Relevance: 6.0, APIs: 4, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000419,?,00000000), ref: 004254F9
SendMessageW.USER32(?,0000041D,00000000,?), ref: 00425506
ClientToScreen.USER32(?), ref: 00425527
SendMessageW.USER32(?,00000403,?,00000001), ref: 00425538

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: MessageSend$ClientScreen
String ID:
API String ID: 1264711397-0
Opcode ID: 21e99f49a25e7fbfcdc5034213d00d10bced2840db0a81dce533fe62294a2d52
Instruction ID: 10029316b969c1ebf7fa3ffa1d4ece043839d52826b7b2918982b16436b64cd7
Opcode Fuzzy Hash: 21e99f49a25e7fbfcdc5034213d00d10bced2840db0a81dce533fe62294a2d52
Instruction Fuzzy Hash: BA01EDB6600308BFD714DF59DC85E9ABBE8EF48710F00841DFA5AA7291D6B0A940CF64

Function 0042D5E3 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetClientRect.USER32(00000000,00000000), ref: 0042D600
GetWindowLongW.USER32(00000000,000000EC), ref: 0042D622
DrawEdge.USER32(?,0000200F,0000000A,0000200F), ref: 0042D63D
FillRect.USER32(?,?,0000000D), ref: 0042D64C

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: Rect$ClientDrawEdgeFillLongWindow
String ID:
API String ID: 3481374107-0
Opcode ID: e8cfec484e0ef5a0949931e2ad442549fda3965c659d69b96471c2229f3c6ed5
Instruction ID: 96f4ce3220ef17525b354dea075bca18e00ecb8dabc2a2a3ce0780306437d17c
Opcode Fuzzy Hash: e8cfec484e0ef5a0949931e2ad442549fda3965c659d69b96471c2229f3c6ed5
Instruction Fuzzy Hash: 05012132900219BFDB109F64DC49FAABBB8FB54750F004926F955F2160D770A9058B95

Function 004380A0 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(004808E8,00000001), ref: 004380C8
InitializeCriticalSection.KERNEL32(004808D0,?,?,?,00422D81), ref: 004380D3
EnterCriticalSection.KERNEL32(004808D0,?,?,?,0042CB90,?,?,00470638,?,?,?,00422D81), ref: 00438112

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterExchangeInitializeInterlocked
String ID:
API String ID: 3643093385-0
Opcode ID: d66494a0eb13fe10eba1f62d4e9df0684cb66f902e58c6fc4cb43092a07d42e0
Instruction ID: c9d80109e13dfd4b469843542c2470c3f20b05a7db7b7469771456da1fb489db
Opcode Fuzzy Hash: d66494a0eb13fe10eba1f62d4e9df0684cb66f902e58c6fc4cb43092a07d42e0
Instruction Fuzzy Hash: 7CF04930B80300D7D9A0B7546C85A1F73A4EB48351F20243FF504E0102CD6848C9679D

Function 00435EB1 Relevance: 6.0, APIs: 4, Instructions: 43threadwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00435E57: GetSysColor.USER32(00000004), ref: 00435E70
Part of subcall function 00435E57: CreateSolidBrush.GDI32(00202020), ref: 00435E79

GetCurrentThreadId.KERNEL32 ref: 00435EC8
SetWindowsHookExW.USER32(000000FF,0043607A,00000000,00000000), ref: 00435ED9
TrackPopupMenuEx.USER32(00000001,?,?,?,?,00000000), ref: 00435EFB

Part of subcall function 00435BC2: SendMessageW.USER32(?,00000403,?,?), ref: 00435BDA

UnhookWindowsHookEx.USER32(?), ref: 00435F17

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: HookWindows$BrushColorCreateCurrentMenuMessagePopupSendSolidThreadTrackUnhook
String ID:
API String ID: 848778860-0
Opcode ID: 1d873a512fcda4e245097d57ed7911f59a8c40b2c60a321dac30504288063662
Instruction ID: cf64ac5a47d6376922e15437f2d7f2f83126d17ed40067883966b7e05527ed14
Opcode Fuzzy Hash: 1d873a512fcda4e245097d57ed7911f59a8c40b2c60a321dac30504288063662
Instruction Fuzzy Hash: 81015672100204BFEBA25F56EC8985ABFF9EFA8720B10552EF41992270C7B568909F58

Function 0041F675 Relevance: 6.0, APIs: 4, Instructions: 39windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000000), ref: 0041F6D6
GetDlgItem.USER32(?,0000041D), ref: 0041F6F3
GetDlgItem.USER32(?,000003F7), ref: 0041F74C
SendMessageW.USER32(00000000), ref: 0041F753

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: Item$DialogMessageSend
String ID:
API String ID: 2485852401-0
Opcode ID: 3216459fc540d4e531237b778d380bc645650f6ab5a306c85b629d0275c759bf
Instruction ID: 4589bec126f157b5648a86f0faf83c62447a804bef39f48419c5bfca6cf3ada6
Opcode Fuzzy Hash: 3216459fc540d4e531237b778d380bc645650f6ab5a306c85b629d0275c759bf
Instruction Fuzzy Hash: 27F03673644308B7DB115F78DD89FDA3F69A704750F104032B609AA1E1C679D9C2975C

Function 00421728 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042172D
SendMessageW.USER32(?,00000440,?,00000000), ref: 00421798

Strings

4AD, xrefs: 00421739

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: H_prologMessageSend
String ID: 4AD
API String ID: 2337391251-1156607891
Opcode ID: 7c7efd9a41c4564eb31d483a36773584485011917f6f380ef5ccd48d1d8448ba
Instruction ID: 733a4daa048f09d878c84373d9e27e6e514a652ddd9bfd7e8f13655adea388da
Opcode Fuzzy Hash: 7c7efd9a41c4564eb31d483a36773584485011917f6f380ef5ccd48d1d8448ba
Instruction Fuzzy Hash: 06116A72D14248EBDB10DFA9D845BDEFBB8BF54318F10816AE251B71D0C7B85648CBA8

Function 004217C6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004217CB

Part of subcall function 0043226F: __EH_prolog.LIBCMT ref: 00432274
Part of subcall function 0043226F: lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,00000400,?,?,00000000,00456830,?), ref: 0043234B

Part of subcall function 004323BC: __EH_prolog.LIBCMT ref: 004323C1
Part of subcall function 004323BC: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000004,00000080,00000000,00000000,?,?,?,0042181D,00456830,?,00000000,00000000), ref: 004323E2
Part of subcall function 004323BC: WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000,00456830,?,?,0042181D,00456830,?,00000000,00000000,?), ref: 0043240B
Part of subcall function 004323BC: WriteFile.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,0042181D,00456830,?,00000000,00000000,?), ref: 00432428
Part of subcall function 004323BC: CloseHandle.KERNEL32(00000000,?,?,0042181D,00456830,?,00000000,00000000,?,?,?,00421E9B,?,?,?,?), ref: 0043242B

Strings

0hE, xrefs: 004217E4
4AD, xrefs: 004217D2

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: FileH_prolog$Write$CloseCreateHandlelstrlen
String ID: 0hE$4AD
API String ID: 1478509966-3579489994
Opcode ID: 2a0967ffddc51ba83c71f050ea1981077daa5538e582c75cfa8f3ba9a157e76a
Instruction ID: 9e83c795c787fddd3087b27f22b1da45db781b12704cccbdf9cbf08cfdd3352a
Opcode Fuzzy Hash: 2a0967ffddc51ba83c71f050ea1981077daa5538e582c75cfa8f3ba9a157e76a
Instruction Fuzzy Hash: 7C018672915115ABEB08EB95E906ABF73B8EF09324F10552FF051A31C0DB785A048AA9

Function 004353F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

SHGetFileInfoW.SHELL32(C:\,00000000,00004001,000002B4,00004001), ref: 00435438
SHGetFileInfoW.SHELL32(C:\,00000000,?,000002B4,00004000), ref: 0043544B

Strings

C:\, xrefs: 00435431, 00435437, 0043544A

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: FileInfo
String ID: C:\
API String ID: 4041567068-3404278061
Opcode ID: 01dc84b88e69e622cc95e543275c728969252cc4be772f7a86a4fbfaad203ff7
Instruction ID: 1c494cc5095be1daaf244086f18a01e1dbc19f33f732a340317776a5c34a2c14
Opcode Fuzzy Hash: 01dc84b88e69e622cc95e543275c728969252cc4be772f7a86a4fbfaad203ff7
Instruction Fuzzy Hash: 99F012B25007046FF324DA15FD80B67B7DCEBC5704F41883AB650A7291D7B569088B6A

Function 00424FEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00425052: wsprintfW.USER32 ref: 00425084

Part of subcall function 00424F77: lstrcatW.KERNEL32(?,00000000,?,00425030,?,?,?,?,?,753D5540), ref: 00424FE3

lstrcatW.KERNEL32(?, + ,?,?,?,753D5540), ref: 0042503F
lstrcatW.KERNEL32(?,?,?,?,?,753D5540), ref: 00425049

Strings

+ , xrefs: 00425039

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: lstrcat$wsprintf
String ID: +
API String ID: 3128662910-2316452435
Opcode ID: 9d691adb5465460d9d67230d8dad96486cfee40a2408d7953968010c8d6e6f81
Instruction ID: 31f09c5765a734f01087b9e08a0d40a2a40db7a6571c408345fa732e7d9f4246
Opcode Fuzzy Hash: 9d691adb5465460d9d67230d8dad96486cfee40a2408d7953968010c8d6e6f81
Instruction Fuzzy Hash: 72F090339002196BEB10AB55EC85FAA3BB9FB84710F0040A6F918A6152E375AA55CF95

Function 00435E57 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000004), ref: 00435E70
CreateSolidBrush.GDI32(00202020), ref: 00435E79

Strings

, xrefs: 00435E5E

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: BrushColorCreateSolid
String ID:
API String ID: 2798526982-1776720792
Opcode ID: aaca61e81d3d844478bb37b696ac1b44aa490725bc7ce6fe2d2d7237d7cd6fc2
Instruction ID: 3dd9d888673b6d09164eca94f326f92a682deda0ecca37f3c94d09e4dc8b9edb
Opcode Fuzzy Hash: aaca61e81d3d844478bb37b696ac1b44aa490725bc7ce6fe2d2d7237d7cd6fc2
Instruction Fuzzy Hash: C8F08973904205AFEF04AFA4E846BEF7BB9DB54314F10402AEE00F7286D67555054BE9

Function 004354E9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(shell32,004212C7,0000000E,?,00000001), ref: 004354F7
LoadIconW.USER32(?,00000001), ref: 0043550D

Strings

shell32, xrefs: 004354F2

Memory Dump Source

Source File: 00000000.00000002.1625884948.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1625859479.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625928161.000000000043C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1625952340.0000000000444000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000481000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626032229.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626085788.000000000049E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626107435.00000000004AA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626128541.00000000004AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626150548.00000000004B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626169096.00000000004B9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626191889.00000000004BE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626217666.00000000004C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626236299.00000000004C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626257359.00000000004CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626288901.00000000004FB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1626308609.00000000004FE000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QuickTextPaste.jbxd

Yara matches

Similarity

API ID: HandleIconLoadModule
String ID: shell32
API String ID: 3495291681-4179111565
Opcode ID: 03b9c54a1b8e5c80b5bd845499610cc0e2a2e66cb0a35801c504cfa6e16a83cf
Instruction ID: e6696932341dcb94caecbd5586413caec97c01d6295ff654805490fc0b1eae49
Opcode Fuzzy Hash: 03b9c54a1b8e5c80b5bd845499610cc0e2a2e66cb0a35801c504cfa6e16a83cf
Instruction Fuzzy Hash: 49D05B702205006A67D05F209C4862736D89A04701B10343EB005C2154E734E944FF1C

Analysis Process: csc.exePID: 7588, Parent PID: 7320COMMON

Executed Functions

Function 0573B408 Relevance: 1.6, APIs: 1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3863445424.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5730000_csc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c9e026156fec3feaf7b6a3671e6d601a6a289c022718a94ce29d5c74953424e
Instruction ID: f664ba2553f76e574978a20b6ebe04e3d0ae99cb7b1bfdd128ad1d3fc4d12c34
Opcode Fuzzy Hash: 3c9e026156fec3feaf7b6a3671e6d601a6a289c022718a94ce29d5c74953424e
Instruction Fuzzy Hash: EF416472E043599FCB10CFAAD8057EEBBF5FF89220F15856AD408A7241EB749844CBE0

Function 0573A9B8 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,0573B45A), ref: 0573B547

Memory Dump Source

Source File: 00000003.00000002.3863445424.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5730000_csc.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: dd03e1a61243d55e7cd754ebaf4b83378f1750fda82b42bd530f8e231d512ac2
Instruction ID: c283e2984ec570f3baf4b4c35fde5d8cad468c328e53425b521342627a557004
Opcode Fuzzy Hash: dd03e1a61243d55e7cd754ebaf4b83378f1750fda82b42bd530f8e231d512ac2
Instruction Fuzzy Hash: 021130B1C046599BCB10CF9AC445BAEFBF4FB48320F10816AE818A7241D3B8A944CFE5

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report QuickTextPaste.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

C:\Users\user\AppData\Roaming\XClient.exe

C:\Users\user\Pictures\DesktopInfo\Bin\DesktopInfo.exe

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Windows Analysis Report
QuickTextPaste.exe

Function 004067E0 Relevance: 24.8, APIs: 1, Strings: 13, Instructions: 304
COMMON

Function 0040691A Relevance: 24.8, APIs: 1, Strings: 13, Instructions: 286
COMMON

Function 0041E397 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 195
COMMON

Function 00406EBE Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 402
COMMON

Function 0040747A Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 198
COMMON

Function 0040759C Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 198
COMMON

Function 00406981 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 208
COMMON

Function 0040675C Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 198
COMMON

Function 004067B8 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 198
COMMON

Function 00406A27 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 192
COMMON

Function 0041E52E Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 89
COMMON

Function 0041F13C Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 194
COMMON

Function 00407801 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 189
memoryCOMMON

Function 00406D70 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184
memoryCOMMON

Function 004074D0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 173
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre