Edit tour

Windows Analysis Report
ftFxGrU7W4.exe

Overview

General Information

Sample name:	ftFxGrU7W4.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original sample name:	4a9f9560ca57e2b6a15a48ada96ed39a5e3e62d8822ad28bb6de2921acef8f98
Analysis ID:	1562665
MD5:	5f5e9ab72e28a8ef4241d82a8782d872
SHA1:	2d187dba62b128fd434ce1cebb069c08c5634db5
SHA256:	4a9f9560ca57e2b6a15a48ada96ed39a5e3e62d8822ad28bb6de2921acef8f98
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious sample

Contains functionality to detect sleep reduction / modifications

Installs a global keyboard hook

Sample or dropped binary is a compiled AutoHotkey binary

Uses Windows timers to delay execution

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May check if the current machine is a sandbox (GetTickCount - Sleep)

OS version to string mapping found (often used in BOTs)

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Process Tree

System is w10x64

ftFxGrU7W4.exe (PID: 2196 cmdline: "C:\Users\user\Desktop\ftFxGrU7W4.exe" MD5: 5F5E9AB72E28A8EF4241D82A8782D872)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.5% probability

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400AE280 FindFirstFileW,FindClose,FindFirstFileW,FindClose,	0_2_00000001400AE280
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400AE180 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00000001400AE180
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014003C900 FindFirstFileW,FindNextFileW,FindClose,GetTickCount,FindNextFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,	0_2_000000014003C900
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140066F70 FindFirstFileW,GetTickCount,PeekMessageW,GetTickCount,FindNextFileW,FindClose,GetLastError,FindFirstFileW,GetTickCount,PeekMessageW,GetTickCount,FindNextFileW,FindClose,	0_2_0000000140066F70
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400672D0 FindFirstFileW,GetLastError,FindClose,FileTimeToLocalFileTime,FileTimeToSystemTime,free,malloc,	0_2_00000001400672D0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140081680 GetFullPathNameW,GetFullPathNameW,GetFileAttributesW,GetFileAttributesW,FindFirstFileW,GetLastError,wcsncpy,GetTickCount,PeekMessageW,GetTickCount,FindNextFileW,FindClose,MoveFileW,DeleteFileW,MoveFileW,GetLastError,CopyFileW,GetLastError,	0_2_0000000140081680
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140067920 CreateFileW,GetFileSizeEx,CloseHandle,FindFirstFileW,GetLastError,FindClose,	0_2_0000000140067920
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140081C70 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0000000140081C70

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Code function: 0_2_000000014007E4B0 _wcstoi64,InternetOpenW,InternetOpenUrlW,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetReadFile,GetTickCount,PeekMessageW,GetTickCount,InternetReadFile,InternetReadFileExA,GetTickCount,PeekMessageW,GetTickCount,InternetReadFileExA,InternetCloseHandle,InternetCloseHandle,fclose,DeleteFileW,

0_2_000000014007E4B0

Source: ftFxGrU7W4.exe	String found in binary or memory: https://autohotkey.com
Source: ftFxGrU7W4.exe	String found in binary or memory: https://autohotkey.comCould

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\ftFxGrU7W4.exe

Jump to behavior

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Code function: 0_2_00000001400065B0 GetTickCount,OpenClipboard,GetTickCount,OpenClipboard,

0_2_00000001400065B0

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140006210 EmptyClipboard,GlobalUnlock,CloseClipboard,GlobalUnlock,GlobalFree,GlobalUnlock,CloseClipboard,SetClipboardData,GlobalUnlock,CloseClipboard,GlobalUnlock,CloseClipboard,GlobalUnlock,GlobalFree,		0_2_0000000140006210
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400B12E0 EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalUnlock,CloseClipboard,GlobalFree,GlobalUnlock,CloseClipboard,GlobalUnlock,CloseClipboard,		0_2_00000001400B12E0

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Code function: 0_2_0000000140006490 GetClipboardFormatNameW,GetClipboardData,

0_2_0000000140006490

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Code function: 0_2_0000000140054F30 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,GetSystemMetrics,GetSystemMetrics,wcsncpy,GetDC,DestroyIcon,DeleteObject,GetIconInfo,CreateCompatibleDC,DeleteObject,DeleteObject,CreateCompatibleDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,CreateCompatibleDC,free,malloc,ReleaseDC,DeleteObject,SelectObject,DeleteDC,DeleteObject,free,free,free,free,malloc,

0_2_0000000140054F30

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Code function: 0_2_0000000140016730 GetTickCount,PeekMessageW,GetTickCount,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetTickCount,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetTickCount,

0_2_0000000140016730

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Code function: 0_2_0000000140001ABC GlobalUnlock,CloseClipboard,SetTimer,GetTickCount,GetMessageW,GetTickCount,GetFocus,TranslateAcceleratorW,GetKeyState,GetWindowLongW,IsWindowEnabled,GetKeyState,GetKeyState,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,PostMessageW,SendMessageW,SendMessageW,IsDialogMessageW,ShowWindow,GetForegroundWindow,GetWindowThreadProcessId,GetClassNameW,IsDialogMessageW,SetCurrentDirectoryW,KillTimer,

0_2_0000000140001ABC

System Summary

Sample or dropped binary is a compiled AutoHotkey binary

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Window found: window name: AutoHotkey

Jump to behavior

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Code function: 0_2_000000014005F650: CreateFileW,DeviceIoControl,CloseHandle,

0_2_000000014005F650

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Code function: 0_2_0000000140081CF0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,

0_2_0000000140081CF0

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140056150	0_2_0000000140056150
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014004E3CB	0_2_000000014004E3CB
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014000A820	0_2_000000014000A820
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014001EFA0	0_2_000000014001EFA0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140001ABC	0_2_0000000140001ABC
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014004A010	0_2_000000014004A010
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014004C070	0_2_000000014004C070
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014003A0A5	0_2_000000014003A0A5
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400BE0C0	0_2_00000001400BE0C0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140062100	0_2_0000000140062100
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014005C100	0_2_000000014005C100
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400BC1B0	0_2_00000001400BC1B0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400201C3	0_2_00000001400201C3
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014008E1E0	0_2_000000014008E1E0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400501F8	0_2_00000001400501F8
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014009E240	0_2_000000014009E240
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014004624B	0_2_000000014004624B
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400A02F0	0_2_00000001400A02F0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400D63D0	0_2_00000001400D63D0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014004A3E0	0_2_000000014004A3E0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014000A400	0_2_000000014000A400
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014004C410	0_2_000000014004C410
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014005A440	0_2_000000014005A440
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014007E4B0	0_2_000000014007E4B0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400904CD	0_2_00000001400904CD
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400904DC	0_2_00000001400904DC
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400904F8	0_2_00000001400904F8
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014009051A	0_2_000000014009051A
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400DE520	0_2_00000001400DE520
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014009053B	0_2_000000014009053B
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140090547	0_2_0000000140090547
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014009056D	0_2_000000014009056D
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014004656B	0_2_000000014004656B
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400905AE	0_2_00000001400905AE
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400885A1	0_2_00000001400885A1
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014009A5E8	0_2_000000014009A5E8
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140092658	0_2_0000000140092658
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400B2670	0_2_00000001400B2670
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400286C0	0_2_00000001400286C0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014008A6D0	0_2_000000014008A6D0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014000273B	0_2_000000014000273B
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014002A770	0_2_000000014002A770
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400B07E0	0_2_00000001400B07E0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140080810	0_2_0000000140080810
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014005C860	0_2_000000014005C860
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014007E880	0_2_000000014007E880
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400988A0	0_2_00000001400988A0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014004C8B0	0_2_000000014004C8B0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400588C0	0_2_00000001400588C0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014009A8C5	0_2_000000014009A8C5
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140070920	0_2_0000000140070920
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140020930	0_2_0000000140020930
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014005094D	0_2_000000014005094D
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014005E970	0_2_000000014005E970
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400869B0	0_2_00000001400869B0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400409C0	0_2_00000001400409C0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400AC9D0	0_2_00000001400AC9D0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014007A9E0	0_2_000000014007A9E0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140008A40	0_2_0000000140008A40
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400D2AE4	0_2_00000001400D2AE4
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140072B00	0_2_0000000140072B00
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400B8B30	0_2_00000001400B8B30
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400AEB80	0_2_00000001400AEB80
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140052BB0	0_2_0000000140052BB0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140050BB2	0_2_0000000140050BB2
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140048BC0	0_2_0000000140048BC0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014008CC40	0_2_000000014008CC40
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014006EC40	0_2_000000014006EC40
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014007CC3F	0_2_000000014007CC3F
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400C8C70	0_2_00000001400C8C70
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140032C88	0_2_0000000140032C88
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140046CC0	0_2_0000000140046CC0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140060CD9	0_2_0000000140060CD9
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140074D20	0_2_0000000140074D20
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140006D40	0_2_0000000140006D40
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140094D50	0_2_0000000140094D50
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400D6D5C	0_2_00000001400D6D5C
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140076D60	0_2_0000000140076D60
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140058D80	0_2_0000000140058D80
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400CEE40	0_2_00000001400CEE40
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140080E40	0_2_0000000140080E40
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140044E80	0_2_0000000140044E80
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014004AE90	0_2_000000014004AE90
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140012ED0	0_2_0000000140012ED0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140018ED0	0_2_0000000140018ED0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140054F30	0_2_0000000140054F30
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140050FD0	0_2_0000000140050FD0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140127000	0_2_0000000140127000
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140015000	0_2_0000000140015000
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400D7030	0_2_00000001400D7030
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140065050	0_2_0000000140065050
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400B30D0	0_2_00000001400B30D0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400110D0	0_2_00000001400110D0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014009712B	0_2_000000014009712B
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140097139	0_2_0000000140097139
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140097144	0_2_0000000140097144
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014006D160	0_2_000000014006D160
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014007B170	0_2_000000014007B170
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140063180	0_2_0000000140063180
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014003F1C0	0_2_000000014003F1C0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400751E0	0_2_00000001400751E0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140097200	0_2_0000000140097200
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140097219	0_2_0000000140097219
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140097221	0_2_0000000140097221
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140003236	0_2_0000000140003236
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140017240	0_2_0000000140017240
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140097237	0_2_0000000140097237
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014005B290	0_2_000000014005B290
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400612A0	0_2_00000001400612A0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014000D2F0	0_2_000000014000D2F0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014005D3B0	0_2_000000014005D3B0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400993D0	0_2_00000001400993D0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400393D9	0_2_00000001400393D9
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140057400	0_2_0000000140057400
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014009D420	0_2_000000014009D420
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014007F440	0_2_000000014007F440
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014005F450	0_2_000000014005F450
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140059490	0_2_0000000140059490
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400254B0	0_2_00000001400254B0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400994BB	0_2_00000001400994BB
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014007B4E0	0_2_000000014007B4E0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014004B510	0_2_000000014004B510
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014004F510	0_2_000000014004F510
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400855D0	0_2_00000001400855D0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400715F0	0_2_00000001400715F0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400635F0	0_2_00000001400635F0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140051690	0_2_0000000140051690
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400156D0	0_2_00000001400156D0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400196F0	0_2_00000001400196F0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014005F720	0_2_000000014005F720
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014003F730	0_2_000000014003F730
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140043760	0_2_0000000140043760
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014005B7D0	0_2_000000014005B7D0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400997FC	0_2_00000001400997FC
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400337FF	0_2_00000001400337FF
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140065880	0_2_0000000140065880
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140089890	0_2_0000000140089890
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400358F8	0_2_00000001400358F8
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014001B900	0_2_000000014001B900
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140017910	0_2_0000000140017910
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400A9920	0_2_00000001400A9920
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400D1960	0_2_00000001400D1960
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400D99B0	0_2_00000001400D99B0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400539B0	0_2_00000001400539B0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400059C0	0_2_00000001400059C0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400719D0	0_2_00000001400719D0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014004DA40	0_2_000000014004DA40
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014007DA48	0_2_000000014007DA48
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140069A80	0_2_0000000140069A80
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014006FA90	0_2_000000014006FA90
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140039AB0	0_2_0000000140039AB0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014003FAD0	0_2_000000014003FAD0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014008FB00	0_2_000000014008FB00
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140041B80	0_2_0000000140041B80
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140073BC0	0_2_0000000140073BC0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140031BB9	0_2_0000000140031BB9
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014008DC13	0_2_000000014008DC13
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014005DC40	0_2_000000014005DC40
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140099C41	0_2_0000000140099C41
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014004BCA0	0_2_000000014004BCA0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014002BCA0	0_2_000000014002BCA0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140097CC0	0_2_0000000140097CC0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400CFCCC	0_2_00000001400CFCCC
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140057CD0	0_2_0000000140057CD0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014001FD29	0_2_000000014001FD29
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014007BD4E	0_2_000000014007BD4E
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140047D60	0_2_0000000140047D60
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014000DDA0	0_2_000000014000DDA0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014003DE20	0_2_000000014003DE20
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140013E40	0_2_0000000140013E40
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140063E70	0_2_0000000140063E70
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400A3EF0	0_2_00000001400A3EF0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140051F00	0_2_0000000140051F00
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140093F10	0_2_0000000140093F10
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014005FF22	0_2_000000014005FF22
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400DDF3C	0_2_00000001400DDF3C
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140099F4D	0_2_0000000140099F4D
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014004FF4B	0_2_000000014004FF4B
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140085F60	0_2_0000000140085F60
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014008FF70	0_2_000000014008FF70
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400BBF8B	0_2_00000001400BBF8B
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014006DFA0	0_2_000000014006DFA0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014006BFB0	0_2_000000014006BFB0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014000FFB0	0_2_000000014000FFB0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014004DFC0	0_2_000000014004DFC0

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: String function: 00000001400CAB94 appears 59 times
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: String function: 00000001400CA93C appears 395 times
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: String function: 0000000140040410 appears 62 times
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: String function: 0000000140040760 appears 465 times
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: String function: 00000001400CB634 appears 38 times

Source: ftFxGrU7W4.exe	Binary or memory string: OriginalFilename vs ftFxGrU7W4.exe
Source: ftFxGrU7W4.exe, 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename vs ftFxGrU7W4.exe
Source: ftFxGrU7W4.exe	Binary or memory string: OriginalFilename vs ftFxGrU7W4.exe

Source: classification engine

Classification label: mal60.spyw.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Code function: 0_2_0000000140041B80 CreateProcessW,CloseHandle,GetLastError,SetCurrentDirectoryW,GetFileAttributesW,SetCurrentDirectoryW,ShellExecuteExW,GetModuleHandleW,GetProcAddress,CloseHandle,GetLastError,FormatMessageW,

0_2_0000000140041B80

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Code function: 0_2_0000000140081CF0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,

0_2_0000000140081CF0

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Code function: 0_2_0000000140060CD9 wcsncpy,GetDiskFreeSpaceW,GetLastError,free,malloc,

0_2_0000000140060CD9

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Code function: 0_2_0000000140081F80 CreateToolhelp32Snapshot,Process32FirstW,_wcstoi64,Process32NextW,Process32NextW,CloseHandle,CloseHandle,CloseHandle,

0_2_0000000140081F80

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Code function: 0_2_0000000140062100 _wcstoi64,CoCreateInstance,powf,powf,powf,log10,free,malloc,free,malloc,

0_2_0000000140062100

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Code function: 0_2_00000001400207F0 FindResourceW,SizeofResource,LoadResource,LockResource,

0_2_00000001400207F0

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Mutant created: \Sessions\1\BaseNamedObjects\AHK Keybd

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Section loaded: textshaping.dll	Jump to behavior

Source: ftFxGrU7W4.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: ftFxGrU7W4.exe

Static file information: File size 1232896 > 1048576

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Code function: 0_2_00000001400B4320 LoadLibraryW,GetProcAddress,

0_2_00000001400B4320

Source: ftFxGrU7W4.exe

Static PE information: section name: text

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014006CC28 push rsp; retf	0_2_000000014006CC29
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014009D020 push rdx; retn 0009h	0_2_000000014009D029
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400D914C push rbp; iretd	0_2_00000001400D9644

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014009E240 SendMessageW,GetWindowLongW,IsWindowVisible,IsIconic,GetFocus,GetWindowRect,GetPropW,ShowWindow,GetUpdateRect,SendMessageW,GetWindowLongW,ShowWindow,EnableWindow,GetWindowRect,PtInRect,PtInRect,SetFocus,SendMessageW,ShowWindow,SetFocus,InvalidateRect,MapWindowPoints,InvalidateRect,	0_2_000000014009E240
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400B24A0 GetForegroundWindow,IsWindowVisible,IsIconic,ShowWindow,	0_2_00000001400B24A0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400B2670 GetWindowThreadProcessId,GetForegroundWindow,IsIconic,ShowWindow,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,BringWindowToTop,	0_2_00000001400B2670
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400508A2 IsZoomed,IsIconic,	0_2_00000001400508A2
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400AE940 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,	0_2_00000001400AE940
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014007A9E0 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,CreateDCW,GetDC,GetPixel,DeleteDC,ReleaseDC,free,malloc,free,malloc,	0_2_000000014007A9E0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400A2A10 CheckMenuItem,CheckMenuItem,GetCursorPos,GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,GetForegroundWindow,GetWindowThreadProcessId,SetForegroundWindow,SetForegroundWindow,TrackPopupMenuEx,PostMessageW,GetForegroundWindow,SetForegroundWindow,	0_2_00000001400A2A10
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140058D80 GetCursorPos,GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,WindowFromPoint,EnumChildWindows,GetClassNameW,EnumChildWindows,free,malloc,	0_2_0000000140058D80
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140044E80 IsWindow,DestroyWindow,GetCursorPos,GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,MonitorFromPoint,GetMonitorInfoW,IsWindow,CreateWindowExW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetWindowRect,SendMessageW,SendMessageW,	0_2_0000000140044E80
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140054F30 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,GetSystemMetrics,GetSystemMetrics,wcsncpy,GetDC,DestroyIcon,DeleteObject,GetIconInfo,CreateCompatibleDC,DeleteObject,DeleteObject,CreateCompatibleDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,CreateCompatibleDC,free,malloc,ReleaseDC,DeleteObject,SelectObject,DeleteDC,DeleteObject,free,free,free,free,malloc,	0_2_0000000140054F30
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400570D0 SendMessageW,IsWindowVisible,ShowWindow,IsIconic,ShowWindow,GetForegroundWindow,SetForegroundWindow,SendMessageW,	0_2_00000001400570D0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140069820 GetTickCount,GetForegroundWindow,GetTickCount,GetWindowThreadProcessId,GetGUIThreadInfo,ClientToScreen,GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,_itow,	0_2_0000000140069820
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400539B0 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,CreateCompatibleDC,free,malloc,ReleaseDC,SelectObject,DeleteDC,DeleteObject,free,free,malloc,GetPixel,ReleaseDC,free,malloc,free,malloc,	0_2_00000001400539B0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140097CC0 SetWindowTextW,IsZoomed,IsIconic,ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowLongW,GetWindowRect,GetClientRect,SystemParametersInfoW,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,DefDlgProcW,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,SetFocus,	0_2_0000000140097CC0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140097CC0 SetWindowTextW,IsZoomed,IsIconic,ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowLongW,GetWindowRect,GetClientRect,SystemParametersInfoW,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,DefDlgProcW,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,SetFocus,	0_2_0000000140097CC0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140091DAD GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,	0_2_0000000140091DAD
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140091DBD MulDiv,GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,	0_2_0000000140091DBD
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140091DB5 GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,	0_2_0000000140091DB5
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140091DCB MulDiv,GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,	0_2_0000000140091DCB
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140097DEF ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,DefDlgProcW,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	0_2_0000000140097DEF
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140097DE5 ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,DefDlgProcW,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	0_2_0000000140097DE5
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140091E0F MulDiv,GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,	0_2_0000000140091E0F
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140097E1A ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,DefDlgProcW,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	0_2_0000000140097E1A
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140097E4C ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,DefDlgProcW,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	0_2_0000000140097E4C
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140091E47 GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,	0_2_0000000140091E47
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140091E56 GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,	0_2_0000000140091E56
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140097EAA ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,DefDlgProcW,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	0_2_0000000140097EAA
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140093F10 GetWindowLongW,GetWindowLongW,SetWindowPos,EnableWindow,GetWindowRect,GetClientRect,MulDiv,MulDiv,GetWindowRect,GetClientRect,MulDiv,MulDiv,_wcstoi64,IsWindow,SetParent,SetWindowLongPtrW,SetParent,IsWindowVisible,IsIconic,SetWindowLongW,SetWindowLongW,SetWindowPos,InvalidateRect,	0_2_0000000140093F10
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140097F08 ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,DefDlgProcW,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	0_2_0000000140097F08
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140097F39 MulDiv,MulDiv,ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,DefDlgProcW,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,	0_2_0000000140097F39
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014008FF70 SendMessageW,MulDiv,MulDiv,free,free,free,free,free,free,free,free,free,free,free,free,COMRefPtr,MulDiv,GetDC,SelectObject,GetTextMetricsW,MulDiv,GetDC,SelectObject,GetTextMetricsW,GetSystemMetrics,GetDC,SelectObject,GetTextMetricsW,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,DrawTextW,DrawTextW,GetCharABCWidthsW,MulDiv,GetSystemMetrics,GetSystemMetrics,MulDiv,GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,SelectObject,ReleaseDC,SendMessageW,SendMessageW,GetClientRect,SetWindowLongW,SendMessageW,SetWindowLongW,MoveWindow,GetWindowRect,SendMessageW,GetWindowRect,MapWindowPoints,InvalidateRect,SetWindowPos,SetWindowPos,MapWindowPoints,	0_2_000000014008FF70

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Code function: 0_2_0000000140018ED0

0_2_0000000140018ED0

Uses Windows timers to delay execution

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

User Timer Set: Timeout: 100ms

Jump to behavior

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Window / User API: foregroundWindowGot 1017

Jump to behavior

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

API coverage: 1.0 %

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Code function: 0_2_0000000140018ED0

0_2_0000000140018ED0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014001A8F0 GetKeyboardLayout followed by cmp: cmp dl, 00000019h and CTI: ja 000000014001AA6Dh country: Russian (ru)	0_2_000000014001A8F0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400229F7 GetKeyboardLayout followed by cmp: cmp ax, 0020h and CTI: je 0000000140022C2Ah country: Urdu (ur)	0_2_00000001400229F7
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400229F7 GetKeyboardLayout followed by cmp: cmp eax, 5dh and CTI: ja 0000000140022C2Ah country: Inuktitut (iu)	0_2_00000001400229F7
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400229FF GetKeyboardLayout followed by cmp: cmp ax, 0020h and CTI: je 0000000140022C2Ah country: Urdu (ur)	0_2_00000001400229FF
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400229FF GetKeyboardLayout followed by cmp: cmp eax, 5dh and CTI: ja 0000000140022C2Ah country: Inuktitut (iu)	0_2_00000001400229FF
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140022A06 GetKeyboardLayout followed by cmp: cmp ax, 0020h and CTI: je 0000000140022C2Ah country: Urdu (ur)	0_2_0000000140022A06
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140022A06 GetKeyboardLayout followed by cmp: cmp eax, 5dh and CTI: ja 0000000140022C2Ah country: Inuktitut (iu)	0_2_0000000140022A06
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140022A2D GetKeyboardLayout followed by cmp: cmp ax, 0020h and CTI: je 0000000140022C2Ah country: Urdu (ur)	0_2_0000000140022A2D
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140022A2D GetKeyboardLayout followed by cmp: cmp eax, 5dh and CTI: ja 0000000140022C2Ah country: Inuktitut (iu)	0_2_0000000140022A2D
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140022A51 GetKeyboardLayout followed by cmp: cmp ax, 0020h and CTI: je 0000000140022C2Ah country: Urdu (ur)	0_2_0000000140022A51
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140022A51 GetKeyboardLayout followed by cmp: cmp eax, 5dh and CTI: ja 0000000140022C2Ah country: Inuktitut (iu)	0_2_0000000140022A51
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140022A75 GetKeyboardLayout followed by cmp: cmp ax, 0020h and CTI: je 0000000140022C2Ah country: Urdu (ur)	0_2_0000000140022A75
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140022A75 GetKeyboardLayout followed by cmp: cmp eax, 5dh and CTI: ja 0000000140022C2Ah country: Inuktitut (iu)	0_2_0000000140022A75
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140015000 GetKeyboardLayout followed by cmp: cmp ecx, 0ah and CTI: jl 0000000140015362h country: Spanish (es)	0_2_0000000140015000

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140059490 GetLocalTime followed by cmp: cmp word ptr [rbx], cx and CTI: je 00000001400597C3h		0_2_0000000140059490
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140059490 GetLocalTime followed by cmp: cmp dx, ax and CTI: je 0000000140059683h		0_2_0000000140059490

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400AE280 FindFirstFileW,FindClose,FindFirstFileW,FindClose,	0_2_00000001400AE280
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400AE180 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00000001400AE180
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014003C900 FindFirstFileW,FindNextFileW,FindClose,GetTickCount,FindNextFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,	0_2_000000014003C900
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140066F70 FindFirstFileW,GetTickCount,PeekMessageW,GetTickCount,FindNextFileW,FindClose,GetLastError,FindFirstFileW,GetTickCount,PeekMessageW,GetTickCount,FindNextFileW,FindClose,	0_2_0000000140066F70
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400672D0 FindFirstFileW,GetLastError,FindClose,FileTimeToLocalFileTime,FileTimeToSystemTime,free,malloc,	0_2_00000001400672D0
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140081680 GetFullPathNameW,GetFullPathNameW,GetFileAttributesW,GetFileAttributesW,FindFirstFileW,GetLastError,wcsncpy,GetTickCount,PeekMessageW,GetTickCount,FindNextFileW,FindClose,MoveFileW,DeleteFileW,MoveFileW,GetLastError,CopyFileW,GetLastError,	0_2_0000000140081680
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140067920 CreateFileW,GetFileSizeEx,CloseHandle,FindFirstFileW,GetLastError,FindClose,	0_2_0000000140067920
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140081C70 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0000000140081C70

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

API call chain: ExitProcess graph end node

graph_0-242472

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Code function: 0_2_0000000140017FF0 BlockInput,free,BlockInput,

0_2_0000000140017FF0

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Code function: 0_2_00000001400CEB34 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00000001400CEB34

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Code function: 0_2_00000001400B4320 LoadLibraryW,GetProcAddress,

0_2_00000001400B4320

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Code function: 0_2_00000001400D8698 GetProcessHeap,HeapAlloc,_errno,_errno,__doserrno,_errno,GetProcessHeap,HeapFree,SetEndOfFile,_errno,__doserrno,GetLastError,

0_2_00000001400D8698

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400CEB34 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00000001400CEB34
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400D37E4 SetUnhandledExceptionFilter,	0_2_00000001400D37E4
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_00000001400D1940 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00000001400D1940

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

0_2_0000000140041B80

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Code function: 0_2_0000000140017240 GetCurrentThreadId,GetKeyboardState,SetKeyboardState,PostMessageW,PostMessageW,BlockInput,GetForegroundWindow,GetAsyncKeyState,keybd_event,GetAsyncKeyState,keybd_event,GetAsyncKeyState,BlockInput,

0_2_0000000140017240

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Code function: 0_2_0000000140018A50 mouse_event,

0_2_0000000140018A50

Source: ftFxGrU7W4.exe	Binary or memory string: Program Manager
Source: ftFxGrU7W4.exe	Binary or memory string: Shell_TrayWnd
Source: ftFxGrU7W4.exe, ftFxGrU7W4.exe, 00000000.00000002.3394630665.00000000007FB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: Progman
Source: ftFxGrU7W4.exe	Binary or memory string: TextLEFTLRIGHTRMIDDLEMX1X2WUWDWLWR{Blind}{ClickLl{}^+!#{}RawTempASC U+ ,LWin RWin LShift RShift LCtrl RCtrl LAlt RAlt SYSTEM\CurrentControlSet\Control\Keyboard Layouts\Layout FileKbdLayerDescriptorsc%03Xvk%02XSCALTDOWNALTUPSHIFTDOWNSHIFTUPCTRLDOWNCONTROLDOWNCTRLUPCONTROLUPLWINDOWNLWINUPRWINDOWNRWINUPRtlGetVersionntdll.dll%u.%u.%uStdOutAllUnreachableClassOverwriteUseEnvLocalSameAsGlobalUseUnsetGlobalUseUnsetLocalYYYYYWeekYearYDayWorkingDirWinDirWinDelayWDayUserNameTitleMatchModeSpeedTitleMatchModeTimeSinceThisHotkeyTimeSincePriorHotkeyTimeIdlePhysicalTimeIdleMouseTimeIdleKeyboardTimeIdleTickCountThisMenuItemPosThisMenuItemThisMenuThisLabelThisHotkeyThisFuncStoreCapslockModeStartupCommonStartupStartMenuCommonStartMenuSecScriptNameScriptHwndScriptFullPathScriptDirScreenWidthScreenHeightScreenDPIRegViewPtrSizeProgramsCommonProgramsPriorKeyPriorHotkeyOSVersionOSTypeNumBatchLinesNowUTCNowMyDocumentsMSecMouseDelayPlayMouseDelayMonMMMMMMMMMMinMDayLoopRegTypeLoopRegTimeModifiedLoopRegSubKeyLoopRegNameLoopRegKeyLoopReadLineLoopFileTimeModifiedLoopFileTimeCreatedLoopFileTimeAccessedLoopFileSizeMBLoopFileSizeKBLoopFileSizeLoopFileShortPathLoopFileShortNameLoopFilePathLoopFileNameLoopFileLongPathLoopFileFullPathLoopFileExtLoopFileDirLoopFileAttribLoopFieldLineNumberLineFileLastErrorLanguageKeyDurationPlayKeyDurationKeyDelayPlayKeyDelayIsUnicodeIsSuspendedIsPausedIsCriticalIsCompiledIsAdminIs64bitOSIPAddress4IPAddress3IPAddress2IPAddress1InitialWorkingDirIndexIconTipIconNumberIconHiddenIconFileHourGuiYGuiXGuiWidthGuiHeightGuiEventGuiControlEventFormatIntegerFormatFloatExitReasonEventInfoEndCharDesktopCommonDesktopDefaultTreeViewDefaultMouseSpeedDefaultListViewDefaultGuiDDDDDDDDDCursorCoordModeToolTipCoordModePixelCoordModeMouseCoordModeMenuCoordModeCaretControlDelayComputerNameCaretYCaretXBatchLinesAppDataCommonAppDataAhkVersionAhkPathTrueProgramFilesFalseComSpecClipboardAllClipboard...%s[%Iu of %Iu]: %-1.60s%sPropertyRegExMatch\:\:REG_SZREG_EXPAND_SZREG_MULTI_SZREG_DWORDREG_BINARYDefault3264LineRegExFASTSLOWAscChrDerefHTMLModPowExpSqrtLogLnRoundCeilFloorAbsSinCosTanASinACosATanBitAndBitOrBitXOrBitNotBitShiftLeftBitShiftRightAddDestroyNamePriorityInterruptNoTimersLabelTypeCountLocalePermitMouseSendAndMouseMouseMoveOffPlayEventThenEventThenPlayYESNOOKCANCELABORTIGNORERETRYCONTINUETRYAGAINMINMAXHIDEScreenRelativeWindowClientPixelCaretIntegerFloatNumberTimeDateDigitXdigitAlnumAlphaUpperLowerUTF-8UTF-8-RAWUTF-16UTF-16-RAWCPFuncRemoveClipboardFormatListeneruser32AddClipboardFormatListenerTrayNo tray memA_Clipboardstatus AHK_PlayMe modeclose AHK_PlayMeRegClassAutoHotkey2Shell_TrayWndCreateWindoweditConsolasLucida ConsoleErrorLevel <>=/\|^,:&~!()[]{}+-?."'\;`IFWHILEClass>AUTOHOTKEY SCRIPT<Could not extract script from EXE./#CommentFlag/and<>=/\|^,:<>=/\|^,:.+-&!?~::?- Continuation section too long.JoinLTrimRTrimMissing ")"Functions cannot contain functions.Missing "{"Not a valid method, class or property definition.GetSetNot a valid property getter/setter.Hotke
Source: ftFxGrU7W4.exe	Binary or memory string: "%-1.300s"The maximum number of MsgBoxes has been reached.IsHungAppWindowDwmGetWindowAttributedwmapi.dllahk_idpidgroup%s%uProgram ManagerProgmanWorkerWError text not found (please report)Q\E{0,DEFINEUTF16)UCP)NO_START_OPT)CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument is compiled in 8 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Code function: 0_2_00000001400D4140 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00000001400D4140

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Code function: 0_2_00000001400693F0 GetComputerNameW,GetUserNameW,

0_2_00000001400693F0

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe

Code function: 0_2_00000001400CF0E4 HeapCreate,GetVersion,HeapSetInformation,

0_2_00000001400CF0E4

Source: ftFxGrU7W4.exe	Binary or memory string: WIN_XP
Source: ftFxGrU7W4.exe	Binary or memory string: WIN_VISTA
Source: ftFxGrU7W4.exe	Binary or memory string: WIN_7
Source: ftFxGrU7W4.exe	Binary or memory string: WIN_8
Source: ftFxGrU7W4.exe	Binary or memory string: ?A Goto/Gosub must not jump into a block that doesn't enclose it.ddddddd%02d%dmsSlowLogoffSingle\AutoHotkey.exeWIN32_NTWIN_8.1WIN_8WIN_7WIN_VISTAWIN_XPWIN_2003%04hX0x%IxpPIntStrPtrShortInt64DoubleAStrWStrgdi32comctl32kernel32W-3-4CDecl-2This DllCall requires a prior VarSetCapacity.Pos%sLen%sPos%dLen%dLenMarkpcre_calloutCompile error %d at offset %d: %hs-+0 #diouxXeEfgGaAcCpULlTt%0.*fFfSelectVisCenterUniDescLogicalNoSortAutoHdrFirstBoldExpandGDI+JoyJoyXJoyYJoyZJoyRJoyUJoyVJoyPOVJoyNameJoyButtonsJoyAxesJoyInfo
Source: ftFxGrU7W4.exe	Binary or memory string: WIN_8.1

Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014001E990 Shell_NotifyIconW,RemoveClipboardFormatListener,ChangeClipboardChain,DestroyWindow,IsWindow,DestroyWindow,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DestroyIcon,IsWindow,DestroyWindow,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DestroyIcon,DestroyIcon,IsWindow,DestroyWindow,DeleteObject,mciSendStringW,mciSendStringW,DeleteCriticalSection,OleUninitialize,free,free,free,	0_2_000000014001E990
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_000000014001F420 AddClipboardFormatListener,PostMessageW,SetClipboardViewer,RemoveClipboardFormatListener,ChangeClipboardChain,	0_2_000000014001F420
Source: C:\Users\user\Desktop\ftFxGrU7W4.exe	Code function: 0_2_0000000140073930 RemoveClipboardFormatListener,ChangeClipboardChain,	0_2_0000000140073930

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Virtualization/Sandbox Evasion	121 Input Capture	11 System Time Discovery	Remote Services	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Disable or Modify Tools	LSASS Memory	13 Security Software Discovery	Remote Desktop Protocol	121 Input Capture	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Process Injection	1 Access Token Manipulation	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Archive Collected Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Process Injection	NTDS	3 Process Discovery	Distributed Component Object Model	3 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	11 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	14 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ftFxGrU7W4.exe	3%	ReversingLabs

Name	Source	Malicious	Antivirus Detection	Reputation
https://autohotkey.com	ftFxGrU7W4.exe	false		high
https://autohotkey.comCould	ftFxGrU7W4.exe	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562665
Start date and time:	2024-11-25 21:00:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ftFxGrU7W4.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original Sample Name:	4a9f9560ca57e2b6a15a48ada96ed39a5e3e62d8822ad28bb6de2921acef8f98
Detection:	MAL
Classification:	mal60.spyw.evad.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 44 Number of non-executed functions: 188

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: ftFxGrU7W4.exe

Simulations

Behavior and APIs

Time	Type	Description
15:00:53	API Interceptor	1x Sleep call for process: ftFxGrU7W4.exe modified

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.441638297632495
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ftFxGrU7W4.exe
File size:	1'232'896 bytes
MD5:	5f5e9ab72e28a8ef4241d82a8782d872
SHA1:	2d187dba62b128fd434ce1cebb069c08c5634db5
SHA256:	4a9f9560ca57e2b6a15a48ada96ed39a5e3e62d8822ad28bb6de2921acef8f98
SHA512:	e9969e2a4aa6737787383f8979b5a1d36032b263861b04b0d54e6af49d4934b8ff64f614041fff4d368c3287dc8c117d863f19cef5ad721b362b401c062da2a6
SSDEEP:	24576:gUNxvqF6FGYJf6yjNQpNONZNlTX5PlGPgquLEIWxUc7N11QaSYx7Gq/r:gUNxvC6FGYJf6yjNQpNONZnTX5PlGPgG
TLSH:	E7457C0733A2C0E9DE6BD0F2C6296222D77274151B289BDF64E05E2DDFA3E915B36311
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C...C...C...XTX.v...XTY.....J.p.D...J.t.B...J.`.^...C.......XTm.T...XT\.h...XTi.B...XTn.B...RichC...........PE..d....6.e...

File Icon


Icon Hash:	8e172d4661e8c441

Static PE Info

General

Entrypoint:	0x1400cdb30
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:
Time Stamp:	0x65F53619 [Sat Mar 16 06:03:05 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	a649e6750bcf2911044dec744c57f40f

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F8D14AF630Ch
dec eax
add esp, 28h
jmp 00007F8D14AEFB57h
int3
int3
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], ebp
dec eax
mov dword ptr [esp+18h], esi
push edi
dec eax
sub esp, 20h
dec eax
lea ebx, dword ptr [ecx+1Ch]
dec eax
mov ebp, ecx
mov esi, 00000101h
dec eax
mov ecx, ebx
inc esp
mov eax, esi
xor edx, edx
call 00007F8D14AF2964h
inc ebp
xor ebx, ebx
dec eax
lea edi, dword ptr [ebp+10h]
inc ecx
lea ecx, dword ptr [ebx+06h]
inc ecx
movzx eax, bx
inc esp
mov dword ptr [ebp+0Ch], ebx
dec esp
mov dword ptr [ebp+04h], ebx
rep stosw
dec eax
lea edi, dword ptr [000444EEh]
dec eax
sub edi, ebp
mov al, byte ptr [edi+ebx]
mov byte ptr [ebx], al
dec eax
inc ebx
dec eax
dec esi
jne 00007F8D14AEFCF5h
dec eax
lea ecx, dword ptr [ebp+0000011Dh]
mov edx, 00000100h
mov al, byte ptr [ecx+edi]
mov byte ptr [ecx], al
dec eax
inc ecx
dec eax
dec edx
jne 00007F8D14AEFCF5h
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov ebp, dword ptr [esp+38h]
dec eax
mov esi, dword ptr [esp+40h]
dec eax
add esp, 20h
pop edi
ret
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+10h], ebx
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
push ebp
dec eax
lea ebp, dword ptr [eax-00000488h]
dec eax
sub esp, 00000580h
dec eax
mov eax, dword ptr [0004529Bh]
dec eax
xor eax, esp

Rich Headers

Programming Language:

[C++] VS2010 SP1 build 40219
[ C ] VS2010 SP1 build 40219
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x10e39c	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x131000	0x7064	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x11f000	0x7a58	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xe0000	0xeb8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xde3e6	0xde400	1b1d6dd14717b7a4a86bc608450d2229	False	0.5378805188413949	data	6.547530261634082	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xe0000	0x312fe	0x31400	09069cfe30350895756a1046ae0bd101	False	0.28075428299492383	data	4.968893111667075	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x112000	0xc3b8	0x5000	969162fa5a35d1af3366239c5d31d147	False	0.25	data	3.3115656660148853	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x11f000	0x7a58	0x7c00	ee1089d1b53300da83162d138f4a39cc	False	0.4783581149193548	data	5.987995779242859	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
text	0x127000	0x258d	0x2600	6cae918481287a7ff0aaef42fc0b95ee	False	0.46484375	data	5.774323838239317	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE
data	0x12a000	0x6ec0	0x7000	8f4275b626558a8640120f611553e570	False	0.47119140625	data	6.457359279664662	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x131000	0x7064	0x7200	85cb0bf36eea4c8c62a8c83ce3357425	False	0.19188596491228072	data	4.650274657297926	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1313f8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	English	United States	0.0543221539914974
RT_ICON	0x135620	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6941489361702128
RT_ICON	0x135a88	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6622340425531915
RT_ICON	0x135ef0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6453900709219859
RT_ICON	0x136358	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.6655405405405406
RT_MENU	0x136480	0x2c8	data	English	United States	0.46207865168539325
RT_DIALOG	0x136748	0xe8	data	English	United States	0.6206896551724138
RT_ACCELERATOR	0x136830	0x48	data	English	United States	0.8194444444444444
RT_RCDATA	0x136878	0x1075	ASCII text	English	United States	0.20887728459530025
RT_GROUP_ICON	0x1378f0	0x14	data	English	United States	1.05
RT_GROUP_ICON	0x137904	0x14	data	English	United States	1.25
RT_GROUP_ICON	0x137918	0x14	data	English	United States	1.25
RT_GROUP_ICON	0x13792c	0x14	data	English	United States	1.25
RT_GROUP_ICON	0x137940	0x14	data	English	United States	1.25
RT_VERSION	0x137954	0x21c	data	English	United States	0.4925925925925926
RT_MANIFEST	0x137b70	0x4f4	ASCII text, with very long lines (1268), with no line terminators	English	United States	0.4755520504731861

Imports

DLL	Import
WSOCK32.dll	gethostbyname, inet_addr, WSACleanup, gethostname, WSAStartup
WINMM.dll	mixerGetLineInfoW, mixerGetDevCapsW, mixerOpen, mciSendStringW, joyGetPosEx, mixerGetLineControlsW, mixerGetControlDetailsW, mixerSetControlDetails, waveOutGetVolume, mixerClose, waveOutSetVolume, joyGetDevCapsW
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
COMCTL32.dll	ImageList_Create, CreateStatusWindowW, ImageList_ReplaceIcon, ImageList_GetIconSize, ImageList_Destroy, ImageList_AddMasked
PSAPI.DLL	GetProcessImageFileNameW, GetModuleBaseNameW, GetModuleFileNameExW
WININET.dll	InternetOpenW, InternetOpenUrlW, InternetCloseHandle, InternetReadFileExA, InternetReadFile
KERNEL32.dll	GetModuleFileNameW, GetSystemTimeAsFileTime, FindResourceW, SizeofResource, LoadResource, LockResource, GetFullPathNameW, GetShortPathNameW, FindFirstFileW, FindNextFileW, FindClose, FileTimeToLocalFileTime, SetEnvironmentVariableW, Beep, MoveFileW, OutputDebugStringW, CreateProcessW, GetFileAttributesW, WideCharToMultiByte, MultiByteToWideChar, GetExitCodeProcess, WriteProcessMemory, ReadProcessMemory, GetCurrentProcessId, OpenProcess, TerminateProcess, SetPriorityClass, SetLastError, GetEnvironmentVariableW, GetLocalTime, GetDateFormatW, GetTimeFormatW, GetDiskFreeSpaceExW, SetVolumeLabelW, CreateFileW, DeviceIoControl, GetDriveTypeW, GetVolumeInformationW, GetDiskFreeSpaceW, GetCurrentDirectoryW, CreateDirectoryW, ReadFile, WriteFile, DeleteFileW, SetFileAttributesW, LocalFileTimeToFileTime, SetFileTime, DeleteCriticalSection, GetSystemTime, GetSystemDefaultUILanguage, GetComputerNameW, GetSystemWindowsDirectoryW, GetTempPathW, EnterCriticalSection, LeaveCriticalSection, VirtualProtect, QueryDosDeviceW, CompareStringW, RemoveDirectoryW, CopyFileW, GetCurrentProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, FormatMessageW, GetPrivateProfileStringW, GetPrivateProfileSectionW, GetPrivateProfileSectionNamesW, WritePrivateProfileStringW, WritePrivateProfileSectionW, SetEndOfFile, GetACP, GetFileType, GetStdHandle, SetFilePointerEx, SystemTimeToFileTime, FileTimeToSystemTime, GetFileSize, IsWow64Process, VirtualAllocEx, VirtualFreeEx, EnumResourceNamesW, LoadLibraryExW, GlobalSize, HeapReAlloc, EncodePointer, HeapFree, DecodePointer, ExitProcess, HeapAlloc, IsValidCodePage, FlsGetValue, FlsSetValue, FlsFree, FlsAlloc, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, RtlVirtualUnwind, RtlLookupFunctionEntry, InitializeCriticalSection, GetCPInfo, GetVersionExW, GetModuleHandleW, FreeLibrary, GetProcAddress, LoadLibraryW, GetLastError, CreateMutexW, CloseHandle, GetExitCodeThread, SetThreadPriority, CreateThread, GetStringTypeExW, lstrcmpiW, GetCurrentThreadId, GlobalUnlock, GlobalFree, GlobalAlloc, GlobalLock, SetErrorMode, SetCurrentDirectoryW, Sleep, GetTickCount, MulDiv, RtlCaptureContext, HeapSetInformation, GetVersion, HeapCreate, InitializeCriticalSectionAndSpinCount, HeapSize, HeapQueryInformation, GetCommandLineW, GetStartupInfoW, RtlUnwindEx, GetStringTypeW, RaiseException, RtlPcToFileHeader, LCMapStringW, GetConsoleCP, GetConsoleMode, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, QueryPerformanceCounter, GetOEMCP, SetFilePointer, WriteConsoleW, SetStdHandle, FlushFileBuffers, GetFileSizeEx, GetProcessHeap
USER32.dll	GetDlgItem, SetDlgItemTextW, MessageBeep, GetCursorInfo, GetLastInputInfo, GetSystemMenu, GetMenuItemCount, GetMenuItemID, GetSubMenu, GetMenuStringW, ExitWindowsEx, SetMenu, FlashWindow, GetPropW, SetPropW, RemovePropW, MapWindowPoints, RedrawWindow, SetWindowLongPtrW, SetParent, GetClassInfoExW, DefDlgProcW, GetAncestor, UpdateWindow, GetMessagePos, GetClassLongPtrW, CallWindowProcW, CheckRadioButton, IntersectRect, GetUpdateRect, PtInRect, CreateDialogIndirectParamW, GetWindowLongPtrW, CreateAcceleratorTableW, DestroyAcceleratorTable, InsertMenuItemW, SetMenuDefaultItem, RemoveMenu, SetMenuItemInfoW, IsMenu, GetMenuItemInfoW, CreateMenu, CreatePopupMenu, SetMenuInfo, AppendMenuW, DestroyMenu, TrackPopupMenuEx, CopyImage, CreateIconIndirect, CreateIconFromResourceEx, EnumClipboardFormats, GetWindow, BringWindowToTop, MessageBoxW, GetTopWindow, GetQueueStatus, SendDlgItemMessageW, SetClipboardViewer, LoadAcceleratorsW, EnableMenuItem, GetMenu, CreateWindowExW, RegisterClassExW, LoadCursorW, DestroyWindow, EnableWindow, MapVirtualKeyW, VkKeyScanExW, MapVirtualKeyExW, GetKeyboardLayoutNameW, ActivateKeyboardLayout, GetGUIThreadInfo, GetWindowTextW, mouse_event, WindowFromPoint, GetSystemMetrics, keybd_event, SetKeyboardState, GetKeyboardState, GetCursorPos, GetAsyncKeyState, AttachThreadInput, SendInput, UnregisterHotKey, RegisterHotKey, SendMessageTimeoutW, UnhookWindowsHookEx, SetWindowsHookExW, PostThreadMessageW, IsCharAlphaNumericW, IsCharUpperW, IsCharLowerW, ToUnicodeEx, GetKeyboardLayout, CallNextHookEx, CharLowerW, ReleaseDC, GetDC, OpenClipboard, GetClipboardData, GetClipboardFormatNameW, CloseClipboard, SetClipboardData, EmptyClipboard, PostMessageW, FindWindowW, EndDialog, IsWindow, DispatchMessageW, TranslateMessage, ShowWindow, CountClipboardFormats, SetWindowLongW, ScreenToClient, IsDialogMessageW, DialogBoxParamW, SetForegroundWindow, DefWindowProcW, FillRect, DrawIconEx, GetSysColorBrush, GetSysColor, RegisterWindowMessageW, EnumDisplayMonitors, IsIconic, IsZoomed, EnumWindows, ChangeClipboardChain, GetWindowTextLengthW, SendMessageW, IsWindowEnabled, GetWindowLongW, GetKeyState, TranslateAcceleratorW, KillTimer, PeekMessageW, GetFocus, GetClassNameW, GetWindowThreadProcessId, GetForegroundWindow, InvalidateRect, SetLayeredWindowAttributes, SetWindowPos, SetWindowRgn, SetFocus, SetActiveWindow, ClientToScreen, EnumChildWindows, MoveWindow, GetWindowRect, GetMonitorInfoW, MonitorFromPoint, GetClientRect, SystemParametersInfoW, AdjustWindowRectEx, DrawTextW, SetRect, GetIconInfo, SetWindowTextW, IsWindowVisible, BlockInput, GetMessageW, SetTimer, GetParent, GetDlgCtrlID, CharUpperW, IsClipboardFormatAvailable, CheckMenuItem, PostQuitMessage, IsCharAlphaW, LoadImageW, DestroyIcon
GDI32.dll	GetPixel, GetClipRgn, GetCharABCWidthsW, SetBkMode, CreatePatternBrush, SetBrushOrgEx, EnumFontFamiliesExW, CreateDIBSection, GdiFlush, SetBkColor, ExcludeClipRect, SetTextColor, GetClipBox, BitBlt, CreateCompatibleBitmap, GetSystemPaletteEntries, GetDIBits, CreateCompatibleDC, CreatePolygonRgn, CreateRectRgn, CreateRoundRectRgn, CreateEllipticRgn, DeleteDC, GetObjectW, GetTextMetricsW, GetTextFaceW, SelectObject, GetStockObject, CreateDCW, CreateSolidBrush, CreateFontW, FillRgn, GetDeviceCaps, DeleteObject
COMDLG32.dll	CommDlgExtendedError, GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	RegDeleteKeyW, RegSetValueExW, RegCreateKeyExW, RegQueryValueExW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, CloseServiceHandle, UnlockServiceDatabase, LockServiceDatabase, OpenSCManagerW, GetUserNameW, RegEnumKeyExW, RegEnumValueW, RegQueryInfoKeyW, RegOpenKeyExW, RegCloseKey, RegConnectRegistryW, RegDeleteValueW
SHELL32.dll	DragQueryPoint, SHEmptyRecycleBinW, SHFileOperationW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetDesktopFolder, SHGetMalloc, SHGetFolderPathW, ShellExecuteExW, Shell_NotifyIconW, DragFinish, DragQueryFileW, ExtractIconW
ole32.dll	OleInitialize, OleUninitialize, CoCreateInstance, CoInitialize, CoUninitialize, CLSIDFromString, CLSIDFromProgID, CoGetObject, StringFromGUID2, CreateStreamOnHGlobal
OLEAUT32.dll	SafeArrayGetLBound, GetActiveObject, SysStringLen, OleLoadPicture, SafeArrayUnaccessData, SafeArrayGetElemsize, SafeArrayAccessData, SafeArrayUnlock, SafeArrayPtrOfIndex, SafeArrayLock, SafeArrayGetDim, SafeArrayDestroy, SafeArrayGetUBound, VariantCopyInd, SafeArrayCopy, SysAllocString, VariantChangeType, VariantClear, SafeArrayCreate, SysFreeString

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	15:00:53
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\ftFxGrU7W4.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\ftFxGrU7W4.exe"
Imagebase:	0x140000000
File size:	1'232'896 bytes
MD5 hash:	5F5E9AB72E28A8EF4241D82A8782D872
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	24.6%
Total number of Nodes:	756
Total number of Limit Nodes:	32

Executed Functions

Function 0000000140056150 Relevance: 65.2, APIs: 35, Strings: 2, Instructions: 462
registrywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterWindowMessageW.USER32 ref: 000000014005618D

Strings

, xrefs: 0000000140056594
TaskbarCreated, xrefs: 0000000140056180

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: MessageRegisterWindow
String ID: $TaskbarCreated
API String ID: 1814269913-2756569325
Opcode ID: 94e4697f1b54d3e95581d5b80e8b9b15aa115fc46969299653cc422c9fd158ea
Instruction ID: 3d2a4659ac04b8fd781bf1f1e5821c7e0ff0b23da157bbf93be823c0ca50bb91
Opcode Fuzzy Hash: 94e4697f1b54d3e95581d5b80e8b9b15aa115fc46969299653cc422c9fd158ea
Instruction Fuzzy Hash: 32227B352046408AEB6ACF67E4447EA77A1F78CBD4F544125EB8A57BB4DF3AD884CB00

Function 000000014000A820 Relevance: 57.0, APIs: 28, Strings: 4, Instructions: 1046sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32 ref: 000000014000A8A1
Sleep.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 000000014000A8AE
GetTickCount.KERNEL32 ref: 000000014000A8BE
GetExitCodeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 000000014000A8DF
GetTickCount.KERNEL32 ref: 000000014000A8F2
Sleep.KERNEL32 ref: 000000014000A903
CloseHandle.KERNEL32 ref: 000000014000A912
CreateMutexW.KERNEL32 ref: 000000014000A93D
CloseHandle.KERNEL32 ref: 000000014000A958
CreateMutexW.KERNEL32 ref: 000000014000A97F
CloseHandle.KERNEL32 ref: 000000014000A99B
malloc.LIBCMT ref: 000000014000AA6D

Strings

AHK Keybd, xrefs: 000000014000A932, 000000014000BA0B
AHK Mouse, xrefs: 000000014000A974, 000000014000BA4E
2, xrefs: 000000014000A8B6
Warning: The keyboard and/or mouse hook could not be activated; some parts of the script will not function., xrefs: 000000014000A9B5, 000000014000BA8A

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CloseHandle$CountCreateMutexSleepThreadTick$CodeExitMessagePostmalloc
String ID: 2$AHK Keybd$AHK Mouse$Warning: The keyboard and/or mouse hook could not be activated; some parts of the script will not function.
API String ID: 2185308758-62447575
Opcode ID: 4bfda9af8a9896fb664633e2ac2c58b683d106673624f1363ec0ac702c0586c6
Instruction ID: ebd41942e90c014abbbfa1dfacde388b2bc72a789e1f70ae703de7455ece9b52
Opcode Fuzzy Hash: 4bfda9af8a9896fb664633e2ac2c58b683d106673624f1363ec0ac702c0586c6
Instruction Fuzzy Hash: 6EB29BB2214A8085F76ACB26E4143F93BA0F75EB94F484126EB990B7F2DB7DC594C311

Function 000000014001EFA0 Relevance: 54.5, APIs: 22, Strings: 9, Instructions: 233
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400AF3C0: LoadLibraryExW.KERNEL32 ref: 00000001400AF3F3
Part of subcall function 00000001400AF3C0: FindResourceW.KERNEL32 ref: 00000001400AF478
Part of subcall function 00000001400AF3C0: LoadResource.KERNEL32 ref: 00000001400AF48D
Part of subcall function 00000001400AF3C0: LockResource.KERNEL32 ref: 00000001400AF49F
Part of subcall function 00000001400AF3C0: GetSystemMetrics.USER32 ref: 00000001400AF4BF
Part of subcall function 00000001400AF3C0: FindResourceW.KERNEL32 ref: 00000001400AF535
Part of subcall function 00000001400AF3C0: LoadResource.KERNEL32 ref: 00000001400AF549
Part of subcall function 00000001400AF3C0: LockResource.KERNEL32 ref: 00000001400AF557

GetSystemMetrics.USER32 ref: 000000014001F038

Part of subcall function 00000001400AF3C0: EnumResourceNamesW.KERNEL32 ref: 00000001400AF45B
Part of subcall function 00000001400AF3C0: SizeofResource.KERNEL32 ref: 00000001400AF56B
Part of subcall function 00000001400AF3C0: CreateIconFromResourceEx.USER32 ref: 00000001400AF58E

LoadCursorW.USER32 ref: 000000014001F07A
RegisterClassExW.USER32 ref: 000000014001F0A5
RegisterClassExW.USER32 ref: 000000014001F0CC
GetForegroundWindow.USER32 ref: 000000014001F103
GetClassNameW.USER32 ref: 000000014001F11F
CreateWindowExW.USER32 ref: 000000014001F1A2
GetMenu.USER32 ref: 000000014001F1C7
EnableMenuItem.USER32 ref: 000000014001F1DE
CreateWindowExW.USER32 ref: 000000014001F246
GetDC.USER32 ref: 000000014001F2A3
GetDeviceCaps.GDI32 ref: 000000014001F2CD
MulDiv.KERNEL32 ref: 000000014001F2DE
CreateFontW.GDI32 ref: 000000014001F322
ReleaseDC.USER32 ref: 000000014001F339
SendMessageW.USER32 ref: 000000014001F354
SendMessageW.USER32 ref: 000000014001F36C
ShowWindow.USER32 ref: 000000014001F37B
ShowWindow.USER32 ref: 000000014001F38A
ShowWindow.USER32 ref: 000000014001F3A9
SetWindowLongW.USER32 ref: 000000014001F3BD
LoadAcceleratorsW.USER32 ref: 000000014001F3CF

Strings

AutoHotkey, xrefs: 000000014001EFE7
P, xrefs: 000000014001F012
CreateWindow, xrefs: 000000014001F25C
AutoHotkey2, xrefs: 000000014001F0B0
Consolas, xrefs: 000000014001F2BA
Lucida Console, xrefs: 000000014001F2B0
RegClass, xrefs: 000000014001F0DB
edit, xrefs: 000000014001F20D
Shell_TrayWnd, xrefs: 000000014001F129

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Resource$Window$Load$Create$ClassShow$FindLockMenuMessageMetricsRegisterSendSystem$AcceleratorsCapsCursorDeviceEnableEnumFontForegroundFromIconItemLibraryLongNameNamesReleaseSizeof
String ID: AutoHotkey$AutoHotkey2$Consolas$CreateWindow$Lucida Console$P$RegClass$Shell_TrayWnd$edit
API String ID: 221421807-2636979444
Opcode ID: 9f0a374761176a418978be3c1379a1759a994d3ef96bc3faca75ebb80cc0896e
Instruction ID: 968f40cefe4a0f8d73f4e9c232b4fcd87372d36ebbf80ff45b512957cacca498
Opcode Fuzzy Hash: 9f0a374761176a418978be3c1379a1759a994d3ef96bc3faca75ebb80cc0896e
Instruction Fuzzy Hash: 76C16A35218B8182E7629F22F8547EA73A4F78DB94F540119EB895BBB8DF3DC485CB40

Function 0000000140001ABC Relevance: 51.4, APIs: 28, Strings: 1, Instructions: 608timewindowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 0000000140001AED
CloseClipboard.USER32 ref: 0000000140001AFA
SetTimer.USER32 ref: 0000000140001BAA
GetTickCount.KERNEL32 ref: 0000000140001C7D
GetMessageW.USER32 ref: 0000000140001CB3
GetTickCount.KERNEL32 ref: 0000000140001CBE

Strings

#32770, xrefs: 00000001400029F9

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessageTimerUnlock
String ID: #32770
API String ID: 1115112458-463685578
Opcode ID: 053d57a55ae809349e8037f561e1ef5e31ca59676e365c3c37fe4c9ca857211b
Instruction ID: 16e9fd3f2d3deeb1c89529255d5b1a4cf61a1ee717150be675451d4bc97e3919
Opcode Fuzzy Hash: 053d57a55ae809349e8037f561e1ef5e31ca59676e365c3c37fe4c9ca857211b
Instruction Fuzzy Hash: E2528FB220468086FB67CB27F8503E93BA1F78DBD8F584115EB4A17AB5DB78C981C740

Function 000000014000273B Relevance: 31.9, APIs: 17, Strings: 1, Instructions: 430windowthreadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0000000140001C7D
GetMessageW.USER32 ref: 0000000140001CB3
GetTickCount.KERNEL32 ref: 0000000140001CBE
ShowWindow.USER32 ref: 0000000140002850
GetForegroundWindow.USER32(?,?,?,Unk,?,?,AutoHotkey v1.1.37.02,?,00000001400B50A9), ref: 00000001400029B3
GetWindowThreadProcessId.USER32 ref: 00000001400029CA
GetClassNameW.USER32 ref: 00000001400029EC
IsDialogMessageW.USER32 ref: 0000000140002A2E
SetCurrentDirectoryW.KERNEL32(?,?,?,Unk,?,?,AutoHotkey v1.1.37.02,?,00000001400B50A9), ref: 0000000140002A5E
DragFinish.SHELL32 ref: 0000000140003083
GetTickCount.KERNEL32 ref: 0000000140003151
wcsncpy.LIBCMT ref: 0000000140003170
wcsncpy.LIBCMT ref: 0000000140003195
wcsncpy.LIBCMT ref: 00000001400031CF
GetTickCount.KERNEL32 ref: 00000001400031F7

Strings

#32770, xrefs: 00000001400029F9

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$Windowwcsncpy$Message$ClassCurrentDialogDirectoryDragFinishForegroundNameProcessShowThread
String ID: #32770
API String ID: 1745663375-463685578
Opcode ID: fbe917881213136dd4fb58954175c1f166627a5a69082d15888b119d7f3c9d24
Instruction ID: ac4c83e85054edae261d361d87cebb4de6b7dce580e82fabf61456b9cdbc042f
Opcode Fuzzy Hash: fbe917881213136dd4fb58954175c1f166627a5a69082d15888b119d7f3c9d24
Instruction Fuzzy Hash: 32229FB2605A908AFB66CF27B8507EA37A4F78DBD8F544115EB4A17BB4DB34C881C710

Function 0000000140081F80 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 159
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0000000140081F9D
Process32FirstW.KERNEL32 ref: 0000000140081FAE
_wcstoi64.LIBCMT ref: 00000001400820C4
Process32NextW.KERNEL32 ref: 00000001400820DD
Process32NextW.KERNEL32 ref: 000000014008218E
CloseHandle.KERNELBASE ref: 000000014008219F
CloseHandle.KERNEL32 ref: 00000001400821BF
CloseHandle.KERNEL32 ref: 00000001400821C9

Strings

., xrefs: 000000014008204C
, xrefs: 000000014008203E

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CloseHandleProcess32$Next$CreateFirstSnapshotToolhelp32_wcstoi64
String ID: $.
API String ID: 3074079693-3929174939
Opcode ID: a073b43f13d5261475da1d8407fe2279b2438f4328bd4077b5019029635f5553
Instruction ID: 4533296359261cdf3c9d56e40923cd3aadf4856d2da79d96861ea0ca9e904dd4
Opcode Fuzzy Hash: a073b43f13d5261475da1d8407fe2279b2438f4328bd4077b5019029635f5553
Instruction Fuzzy Hash: AF51FE7360569181FBB69B17A1443FE62A0F74CBD0F844112FF8647AEADB38CA85CB40

Function 000000014004E3CB Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 000000014004E401
OpenProcess.KERNEL32 ref: 000000014004E417
SetPriorityClass.KERNEL32 ref: 000000014004E42A
CloseHandle.KERNEL32 ref: 000000014004E435

Part of subcall function 0000000140081F80: CreateToolhelp32Snapshot.KERNEL32 ref: 0000000140081F9D
Part of subcall function 0000000140081F80: Process32FirstW.KERNEL32 ref: 0000000140081FAE
Part of subcall function 0000000140081F80: Process32NextW.KERNEL32 ref: 00000001400820DD

free.LIBCMT ref: 000000014004E606
malloc.LIBCMT ref: 000000014004E618

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 000000014004E936
Out of memory., xrefs: 000000014004EB3D

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: ProcessProcess32$ClassCloseCreateCurrentFirstHandleNextOpenPrioritySnapshotToolhelp32freemalloc
String ID: Memory limit reached (see #MaxMem in the help file).$Out of memory.
API String ID: 2256640844-457448710
Opcode ID: d70210c70cf60830f0294bea8def767a19b83ac2d77039fc13af69c1104c8f73
Instruction ID: 070bc0a45c506fb490ab7eccf0b432d9d144fc932f9f39896afd936bbec60666
Opcode Fuzzy Hash: d70210c70cf60830f0294bea8def767a19b83ac2d77039fc13af69c1104c8f73
Instruction Fuzzy Hash: A391D272604B8086FB639B27D6543E95392EB8C7D8F464532FB0A1B6F5EA78C8418348

Function 00000001400207F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32 ref: 000000014002082A
SizeofResource.KERNEL32 ref: 0000000140020841
LoadResource.KERNEL32 ref: 0000000140020858
LockResource.KERNEL32 ref: 000000014002086A

Part of subcall function 00000001400CBD60: malloc.LIBCMT ref: 00000001400CBD7A

Part of subcall function 000000014001E4D0: GetCPInfo.KERNEL32 ref: 000000014001E511

Strings

>AUTOHOTKEY SCRIPT<, xrefs: 0000000140020805
Could not extract script from EXE., xrefs: 0000000140020901

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Resource$FindInfoLoadLockSizeofmalloc
String ID: >AUTOHOTKEY SCRIPT<$Could not extract script from EXE.
API String ID: 3366556718-1775548002
Opcode ID: a40408cb1bf94199baaa69e3b613d217fb0d26f8259f78298cce53bcdda4c896
Instruction ID: 4ca7666f5d533042d4ca9a9cad77b3cddb827c80f71eef5efff0dddd3ba21b57
Opcode Fuzzy Hash: a40408cb1bf94199baaa69e3b613d217fb0d26f8259f78298cce53bcdda4c896
Instruction Fuzzy Hash: 10317A31209B4481EB668B56F45439AA3A1F74CBD8F084529EF8D0BBBADF7DC444CB40

Function 00000001400AE280 Relevance: 6.1, APIs: 4, Instructions: 137fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE ref: 00000001400AE38D
FindClose.KERNELBASE ref: 00000001400AE3A1
FindFirstFileW.KERNELBASE ref: 00000001400AE409
FindClose.KERNEL32 ref: 00000001400AE41C

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f833d4a0713a5c8d6de575c904e800df0c91a906833fd943bef45137d0ba8481
Instruction ID: 869df9760f0148c9f829586e4073e97515fd48e62f034122f43eef2aed448627
Opcode Fuzzy Hash: f833d4a0713a5c8d6de575c904e800df0c91a906833fd943bef45137d0ba8481
Instruction Fuzzy Hash: A251AD32304B8491EE169B16D5483DAB3A9FB58BE4F958316EB69077E4DF38C58AC700

Function 00000001400CF0E4 Relevance: 4.5, APIs: 3, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 00000001400CF0FA
GetVersion.KERNEL32 ref: 00000001400CF10C
HeapSetInformation.KERNEL32 ref: 00000001400CF12A

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: 2aae9347a45451b879d68f4c96062e5d6e9eb486b1f21193dd6ae4d59cce5ed9
Instruction ID: da4e4383b9ef4f05b0bc2872ceacfce4d983aefa46e52d53b2cc2322927a9f3f
Opcode Fuzzy Hash: 2aae9347a45451b879d68f4c96062e5d6e9eb486b1f21193dd6ae4d59cce5ed9
Instruction Fuzzy Hash: 49E09274221B4082FB8A5B53E845BE52261F78C780F800414FB4A03B74DF3CC49A8700

Function 0000000140005660 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 102
sleepwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindWindowW.USER32 ref: 00000001400056EC
FindWindowW.USER32 ref: 000000014000575C
PostMessageW.USER32 ref: 0000000140005780
Sleep.KERNEL32(?,?,?,?,?,?,?,0000000140005395), ref: 000000014000578D
IsWindow.USER32 ref: 0000000140005796
Sleep.KERNEL32(?,?,?,?,?,?,?,0000000140005395), ref: 00000001400057CE
IsWindow.USER32 ref: 00000001400057D7
Sleep.KERNEL32(?,?,?,?,?,?,?,0000000140005395), ref: 00000001400057E6

Strings

AutoHotkey, xrefs: 00000001400056E5, 0000000140005755
Could not close the previous instance of this script. Keep waiting?, xrefs: 00000001400057A8
d, xrefs: 00000001400057A0
An older instance of this script is already running. Replace it with this instance?Note: To avoid this message, see #SingleInsta, xrefs: 000000014000571B

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Window$Sleep$Find$MessagePost
String ID: An older instance of this script is already running. Replace it with this instance?Note: To avoid this message, see #SingleInsta$AutoHotkey$Could not close the previous instance of this script. Keep waiting?$d
API String ID: 1104075879-823662016
Opcode ID: 9be76a8b86065992f11beeb97ac03ba929bd344f95d33b48398e52f44b7c9567
Instruction ID: f46e981cd836c53c074747acff47b3a235bc4a799830d710d07ea1a2ac91e491
Opcode Fuzzy Hash: 9be76a8b86065992f11beeb97ac03ba929bd344f95d33b48398e52f44b7c9567
Instruction Fuzzy Hash: 63415CB0608A51C2FA67EB23F8403EA22A0F74EBD5F540126FB49976B4DB39C8819741

Function 00000001400AF3C0 Relevance: 19.7, APIs: 13, Instructions: 164
windowlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 00000001400AF3F3
EnumResourceNamesW.KERNEL32 ref: 00000001400AF45B
FindResourceW.KERNEL32 ref: 00000001400AF478
LoadResource.KERNEL32 ref: 00000001400AF48D
LockResource.KERNEL32 ref: 00000001400AF49F
GetSystemMetrics.USER32 ref: 00000001400AF4BF
FindResourceW.KERNEL32 ref: 00000001400AF535
LoadResource.KERNEL32 ref: 00000001400AF549
LockResource.KERNEL32 ref: 00000001400AF557
SizeofResource.KERNEL32 ref: 00000001400AF56B
CreateIconFromResourceEx.USER32 ref: 00000001400AF58E
ExtractIconW.SHELL32 ref: 00000001400AF5EA

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Resource$Load$FindIconLock$CreateEnumExtractFromLibraryMetricsNamesSizeofSystem
String ID:
API String ID: 1568753105-0
Opcode ID: 33d089be9ebdc0d64a94b64a1d3b0a3a67a64df8bae5bc6057e580e510e08665
Instruction ID: 9a0abc6b989a2079d1a8385865f242b4ed64abd64c1c020e43650a27a5f9203e
Opcode Fuzzy Hash: 33d089be9ebdc0d64a94b64a1d3b0a3a67a64df8bae5bc6057e580e510e08665
Instruction Fuzzy Hash: 5951C731701B5086EA6A8FA3A4447F96790BB5CBD4F584625EF4A5BBA4DF3CC881DB00

Function 000000014001F780 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 296
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.LIBCMT ref: 000000014001F799

Part of subcall function 00000001400CA9C4: _FF_MSGBANNER.LIBCMT ref: 00000001400CA9F4
Part of subcall function 00000001400CA9C4: HeapAlloc.KERNEL32(?,?,00000000,00000001400D0AC0,?,?,00000000,00000001400CF2FD,?,?,?,00000001400CF3A7,?,?,00000000,00000001400CE795), ref: 00000001400CAA19
Part of subcall function 00000001400CA9C4: _callnewh.LIBCMT ref: 00000001400CAA32
Part of subcall function 00000001400CA9C4: _errno.LIBCMT ref: 00000001400CAA3D
Part of subcall function 00000001400CA9C4: _errno.LIBCMT ref: 00000001400CAA48

SetTimer.USER32 ref: 000000014001F7F7
free.LIBCMT ref: 000000014001F91B

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 000000014001FA5E
Out of memory., xrefs: 000000014001FC95

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: _errno$AllocHeapTimer_callnewhfreemalloc
String ID: Memory limit reached (see #MaxMem in the help file).$Out of memory.
API String ID: 3883470740-457448710
Opcode ID: 8afe974486a8d800e565ee9075ffe8f511129c3e096d9f83695b6cb917d219cb
Instruction ID: 8f66554224957d9de1fb3b7a0c1da5cc8a2b031ce745352ae12844b27a401f91
Opcode Fuzzy Hash: 8afe974486a8d800e565ee9075ffe8f511129c3e096d9f83695b6cb917d219cb
Instruction Fuzzy Hash: 6CE1AD72204B8486EB169F22E8903E837A1F74CFD8F544125EF9A1B7B9CB39C491E740

Function 00000001400CD994 Relevance: 18.1, APIs: 12, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoW.KERNEL32 ref: 00000001400CD9A6
_FF_MSGBANNER.LIBCMT ref: 00000001400CDA11
_FF_MSGBANNER.LIBCMT ref: 00000001400CDA3C
_RTC_Initialize.LIBCMT ref: 00000001400CDA55
_amsg_exit.LIBCMT ref: 00000001400CDA69
GetCommandLineW.KERNEL32 ref: 00000001400CDA6E
__wsetargv.LIBCMT ref: 00000001400CDA87
_amsg_exit.LIBCMT ref: 00000001400CDA95
_amsg_exit.LIBCMT ref: 00000001400CDAA8
_cinit.LIBCMT ref: 00000001400CDAB2
_amsg_exit.LIBCMT ref: 00000001400CDABD
_wwincmdln.LIBCMT ref: 00000001400CDAC2

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: _amsg_exit$CommandInfoInitializeLineStartup__wsetargv_cinit_wwincmdln
String ID:
API String ID: 697445056-0
Opcode ID: b4475c2a61ccf680a2b57b882e77c30ad0794943197dd7ee3e36d7eef23a5246
Instruction ID: 609180317a09595b3129bb57f799dfd153210b2efc9d7a91502459921f4d60e3
Opcode Fuzzy Hash: b4475c2a61ccf680a2b57b882e77c30ad0794943197dd7ee3e36d7eef23a5246
Instruction Fuzzy Hash: 86415E3161834286FB6AB7A3A4513ED3291AB8D7C8F00403AB745472F3EF7CC846A652

Function 0000000140002982 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 220threadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,Unk,?,?,AutoHotkey v1.1.37.02,?,00000001400B50A9), ref: 00000001400029B3
GetWindowThreadProcessId.USER32 ref: 00000001400029CA
GetClassNameW.USER32 ref: 00000001400029EC
IsDialogMessageW.USER32 ref: 0000000140002A2E
SetCurrentDirectoryW.KERNEL32(?,?,?,Unk,?,?,AutoHotkey v1.1.37.02,?,00000001400B50A9), ref: 0000000140002A5E
DragFinish.SHELL32 ref: 0000000140003083

Strings

#32770, xrefs: 00000001400029F9

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Window$ClassCurrentDialogDirectoryDragFinishForegroundMessageNameProcessThread
String ID: #32770
API String ID: 3456408793-463685578
Opcode ID: 60cd076971c80a99909ccec28924f312fb6838927afc6aa3ff89a3eec4d90db2
Instruction ID: fd0e39c55082546efb900ab456086316c6b45ba5157be4ab6b2f3111c2a1b44d
Opcode Fuzzy Hash: 60cd076971c80a99909ccec28924f312fb6838927afc6aa3ff89a3eec4d90db2
Instruction Fuzzy Hash: 60B117B2205B818AEB67CF27B8543EA37A4B78DBD4F184115EB4A17BB9DB34D841C740

Function 00000001400053C0 Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 318
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncpy.LIBCMT ref: 00000001400054ED

Part of subcall function 00000001400CA93C: _errno.LIBCMT ref: 00000001400CA954
Part of subcall function 00000001400CA93C: _invalid_parameter_noinfo.LIBCMT ref: 00000001400CA95F

Part of subcall function 00000001400CAB94: _errno.LIBCMT ref: 00000001400CABB2
Part of subcall function 00000001400CAB94: _invalid_parameter_noinfo.LIBCMT ref: 00000001400CABBD

Strings

/restart, xrefs: 000000014000540E
/force, xrefs: 0000000140005434
A_Args, xrefs: 00000001400054CB, 0000000140005597
=, xrefs: 0000000140005460
Out of memory., xrefs: 000000014001EE4A, 000000014001EF2D
/ErrorStdOut, xrefs: 0000000140005447

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$wcsncpy
String ID: /ErrorStdOut$/force$/restart$=$A_Args$Out of memory.
API String ID: 3818259516-673611611
Opcode ID: 30ee42c29ee8abd73bc7f287809120eae1f3a325f3f8523a907cf8667fa0fe56
Instruction ID: df151bc6e530dde0a0f471a7549e07a4e02559e32d04c0a7d5ab0e679c69e57f
Opcode Fuzzy Hash: 30ee42c29ee8abd73bc7f287809120eae1f3a325f3f8523a907cf8667fa0fe56
Instruction Fuzzy Hash: 6ED1DF72205B8181EA26DB26F8403EF63A1F78D7D8F840215BB4D4B6E9EF79C549C700

Function 000000014000BCF0 Relevance: 12.1, APIs: 8, Instructions: 106
windowthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetMessageW.USER32 ref: 000000014000BD0D
SetWindowsHookExW.USER32 ref: 000000014000BD77
UnhookWindowsHookEx.USER32 ref: 000000014000BD9C
GetLastError.KERNEL32 ref: 000000014000BDA6
SetWindowsHookExW.USER32 ref: 000000014000BDF5
UnhookWindowsHookEx.USER32 ref: 000000014000BE13
GetLastError.KERNEL32 ref: 000000014000BE1D
PostThreadMessageW.USER32 ref: 000000014000BE56

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: HookWindows$ErrorLastMessageUnhook$PostThread
String ID:
API String ID: 2811735471-0
Opcode ID: 16d4d3f01b71a8e01d453e2e6db01f33a87422ac06e8696e7cc018ab576d6605
Instruction ID: 2e36ca43ca18cf0ac84042a4cd25ea91332eaf64369059a0fe9feacd8af26c6f
Opcode Fuzzy Hash: 16d4d3f01b71a8e01d453e2e6db01f33a87422ac06e8696e7cc018ab576d6605
Instruction Fuzzy Hash: AC41DFB1105B4981FAA7DB23F894BE9A3D0E75DBD0F080026FB554BAB4EF38C8818741

Function 000000014002E64C Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 245
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Illegal parameter name., xrefs: 000000014002E795
The following %s name contains an illegal character:"%-1.300s", xrefs: 000000014002E68A
_$#@, xrefs: 000000014002E65E
ErrorLevel, xrefs: 000000014002E6FB
variable, xrefs: 000000014002E683
Out of memory., xrefs: 000000014002E9C7

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID:
String ID: ErrorLevel$Illegal parameter name.$Out of memory.$The following %s name contains an illegal character:"%-1.300s"$_$#@$variable
API String ID: 0-1002950332
Opcode ID: 4a253c4075ca4afc0b89e78d4de4a40da552ec100a64879d0995958056df1955
Instruction ID: e20ac4bb486f400e216ba22a444663530b03c3c63c8afc318dcf4ca588859b31
Opcode Fuzzy Hash: 4a253c4075ca4afc0b89e78d4de4a40da552ec100a64879d0995958056df1955
Instruction Fuzzy Hash: E3C18D32205BC586EBA69B16E0403D963A1F78DBD4F54012AEB8D07BB9EF39C995C740

Function 000000014001E5C0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 185
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400A1530: malloc.LIBCMT ref: 00000001400A157C

InitializeCriticalSection.KERNEL32 ref: 000000014001E967
OleInitialize.OLE32 ref: 000000014001E96F

Strings

A_Clipboard, xrefs: 000000014001E8F3, 000000014001E920
Clipboard, xrefs: 000000014001E86B, 000000014001E899
Tray, xrefs: 000000014001E802
No tray mem, xrefs: 000000014001E820

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Initialize$CriticalSectionmalloc
String ID: A_Clipboard$Clipboard$No tray mem$Tray
API String ID: 2052168798-66866361
Opcode ID: ed2499b9edc8328269fbca50d421fff63701b1881e1851b1e7a3dc92aee2b278
Instruction ID: 34c4ee07c10a01aecee0d8bc948f6e5a51b5fd2068c90f0e7f9a28d9235baf38
Opcode Fuzzy Hash: ed2499b9edc8328269fbca50d421fff63701b1881e1851b1e7a3dc92aee2b278
Instruction Fuzzy Hash: 78B1F271104B4485FB1B8B57BD80BC9B7E8BB6CB98F58021ADB890BBB1DB78C554C740

Function 00000001400026CF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64threadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,Unk,?,?,AutoHotkey v1.1.37.02,?,00000001400B50A9), ref: 00000001400029B3
GetWindowThreadProcessId.USER32 ref: 00000001400029CA
GetClassNameW.USER32 ref: 00000001400029EC
IsDialogMessageW.USER32 ref: 0000000140002A2E
SetCurrentDirectoryW.KERNEL32(?,?,?,Unk,?,?,AutoHotkey v1.1.37.02,?,00000001400B50A9), ref: 0000000140002A5E

Strings

#32770, xrefs: 00000001400029F9

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Window$ClassCurrentDialogDirectoryForegroundMessageNameProcessThread
String ID: #32770
API String ID: 2633243691-463685578
Opcode ID: 39f3f6b2c820b2adc62ec0c46248f4b1bb58d213936c8f867b0529768ee1e0a8
Instruction ID: 2df3fe5cf134a09a3c39c27088c360e089d1495c2714eb68477407849d860956
Opcode Fuzzy Hash: 39f3f6b2c820b2adc62ec0c46248f4b1bb58d213936c8f867b0529768ee1e0a8
Instruction Fuzzy Hash: 343145B1205B4586FB67CB16F9443E837A0A74DB98F180026EB0A276B4DF78D989C641

Function 000000014000B4EE Relevance: 9.2, APIs: 6, Instructions: 189threadwindowsleepCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 000000014000B7F8
SetThreadPriority.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 000000014000B816
PostThreadMessageW.USER32 ref: 000000014000B834
Sleep.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 000000014000B841
GetTickCount.KERNEL32 ref: 000000014000B850
PeekMessageW.USER32 ref: 000000014000B87D

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Thread$Message$CountCreatePeekPostPrioritySleepTick
String ID:
API String ID: 2785037528-0
Opcode ID: 6f2903994f9f0dd071cb65601b94e17217e65a96a21375288ae1fb37526dfa2d
Instruction ID: 0ba042fe028a092e18cc6b09935748a84d61711e1a6cb0792fc9e4c8f37b989b
Opcode Fuzzy Hash: 6f2903994f9f0dd071cb65601b94e17217e65a96a21375288ae1fb37526dfa2d
Instruction Fuzzy Hash: 2891AFB261479581E7AACB07E0507FA37A4FB5DB95F848122EB49077B1DB3DC8A4D310

Function 000000014000B521 Relevance: 9.2, APIs: 6, Instructions: 189threadwindowsleepCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 000000014000B7F8
SetThreadPriority.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 000000014000B816
PostThreadMessageW.USER32 ref: 000000014000B834
Sleep.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 000000014000B841
GetTickCount.KERNEL32 ref: 000000014000B850
PeekMessageW.USER32 ref: 000000014000B87D

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Thread$Message$CountCreatePeekPostPrioritySleepTick
String ID:
API String ID: 2785037528-0
Opcode ID: eb8891a3af8560fa8eee4a6e94b86ffb8101f849493c6342d1562406fb7e3f63
Instruction ID: 19b65fbb63ceac6258a053ee7b8882423f92cdae53e3f65395be620b60548393
Opcode Fuzzy Hash: eb8891a3af8560fa8eee4a6e94b86ffb8101f849493c6342d1562406fb7e3f63
Instruction Fuzzy Hash: D591BEB261479581E7AACB07E0507FA37A4FB5DB94F848122EB89077B1DB3CC8A4D310

Function 000000014000B555 Relevance: 9.2, APIs: 6, Instructions: 188threadwindowsleepCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 000000014000B7F8
SetThreadPriority.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 000000014000B816
PostThreadMessageW.USER32 ref: 000000014000B834
Sleep.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 000000014000B841
GetTickCount.KERNEL32 ref: 000000014000B850
PeekMessageW.USER32 ref: 000000014000B87D

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Thread$Message$CountCreatePeekPostPrioritySleepTick
String ID:
API String ID: 2785037528-0
Opcode ID: 3668caed14cebb90389da379cf07514920ee0517db728a7c123ceef38ad945e7
Instruction ID: ac9088f559e68c99835174571333dc1872e99b82857aeb2c91a9fa042a092975
Opcode Fuzzy Hash: 3668caed14cebb90389da379cf07514920ee0517db728a7c123ceef38ad945e7
Instruction Fuzzy Hash: 2A91AEB261479581E7AACB07E0507FA37A4FB5DB94F848122EB89077B1DB3DC8A4D310

Function 0000000140036C57 Relevance: 9.2, APIs: 6, Instructions: 174
windowclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659
GetTickCount.KERNEL32 ref: 0000000140032737

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
String ID:
API String ID: 1623861271-0
Opcode ID: 32c4a221dbbddeb90f78db417bacdbfc2be93c834418e794d7a2c37c98ac6879
Instruction ID: a2fbf90fff0e3be7ab64733bd63c16797d57b2a71fd77f5f22b8deaea7f4c573
Opcode Fuzzy Hash: 32c4a221dbbddeb90f78db417bacdbfc2be93c834418e794d7a2c37c98ac6879
Instruction Fuzzy Hash: AB917D32605B4486FB6B8B27E9847EA37A1F74DBE4F540116EB5A876F5CB38C881C740

Function 0000000140056A91 Relevance: 7.5, APIs: 5, Instructions: 44
timeclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalUnlock.KERNEL32 ref: 0000000140056AAA
CloseClipboard.USER32 ref: 0000000140056AB7
GetCurrentProcessId.KERNEL32 ref: 0000000140056ACB
EnumWindows.USER32 ref: 0000000140056AE6
SetTimer.USER32 ref: 0000000140056B2C

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: ClipboardCloseCurrentEnumGlobalProcessTimerUnlockWindows
String ID:
API String ID: 555064778-0
Opcode ID: b3aa6cb8a8f5b3ded0d6dcd204e045097ae81de683c751879e1074c6204f0191
Instruction ID: 1aa1a896c3b13dfc405faa8ba5e5f1160fa57b842e8c45d78e90df4c3ad6bb2a
Opcode Fuzzy Hash: b3aa6cb8a8f5b3ded0d6dcd204e045097ae81de683c751879e1074c6204f0191
Instruction Fuzzy Hash: 0621F336205B8685EB56CF62E8807D973A4F74CBE4F584026EB4967634DE78C885CB40

Function 000000014000CD80 Relevance: 6.4, APIs: 4, Instructions: 379registrytimeCOMMON

Download Yara Rule

APIs

UnregisterHotKey.USER32 ref: 000000014000CE82
RegisterHotKey.USER32 ref: 000000014000D1AF
UnregisterHotKey.USER32 ref: 000000014000D1DF
SetTimer.USER32 ref: 000000014000D2AA

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Unregister$RegisterTimer
String ID:
API String ID: 1006365865-0
Opcode ID: 1a3cb21ec15428c6f4588a15878fa62b0b7a0eac8c9de4d73d5138e3bfe7ad8b
Instruction ID: a3b69c14189f9f8b403d18b09b6e2fe1963c99262312e42ede6895cc9cc4e967
Opcode Fuzzy Hash: 1a3cb21ec15428c6f4588a15878fa62b0b7a0eac8c9de4d73d5138e3bfe7ad8b
Instruction Fuzzy Hash: CA02CFB25156C495FB67CB23A4007E93BE1A31DBD8F08411BEB99076F2C739C999D322

Function 0000000140005810 Relevance: 4.5, APIs: 3, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 000000014001EFA0: GetSystemMetrics.USER32 ref: 000000014001F038
Part of subcall function 000000014001EFA0: LoadCursorW.USER32 ref: 000000014001F07A
Part of subcall function 000000014001EFA0: RegisterClassExW.USER32 ref: 000000014001F0A5
Part of subcall function 000000014001EFA0: RegisterClassExW.USER32 ref: 000000014001F0CC

SystemParametersInfoW.USER32 ref: 000000014000583A
SystemParametersInfoW.USER32 ref: 000000014000585D
malloc.LIBCMT ref: 0000000140005880

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: System$ClassInfoParametersRegister$CursorLoadMetricsmalloc
String ID:
API String ID: 2336117585-0
Opcode ID: adeeed114d63920d911f1c57e51d90b0419fcba936161dfe887f5c35c37e2175
Instruction ID: aa6dd1fc03d2a4c48dc0af4e102b70f09245cbb967c09fcaf673b4fba339693a
Opcode Fuzzy Hash: adeeed114d63920d911f1c57e51d90b0419fcba936161dfe887f5c35c37e2175
Instruction Fuzzy Hash: D7015E70B0474081FB5AEB57B8957D66291ABCDB85F8C8039AF4C5B6F1EE3CC5858710

Function 000000014004E3D2 Relevance: 4.5, APIs: 3, Instructions: 39COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 000000014004E401
OpenProcess.KERNEL32 ref: 000000014004E417
SetPriorityClass.KERNEL32 ref: 000000014004E42A
CloseHandle.KERNEL32 ref: 000000014004E435

Part of subcall function 0000000140081F80: CreateToolhelp32Snapshot.KERNEL32 ref: 0000000140081F9D
Part of subcall function 0000000140081F80: Process32FirstW.KERNEL32 ref: 0000000140081FAE
Part of subcall function 0000000140081F80: Process32NextW.KERNEL32 ref: 00000001400820DD

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: ProcessProcess32$ClassCloseCreateCurrentFirstHandleNextOpenPrioritySnapshotToolhelp32
String ID:
API String ID: 1771318894-0
Opcode ID: ef9edbf377b2a7e840aff60de5adf9dbd7feb1d909d8ca876a573373a60b7605
Instruction ID: 22852bffbe32204ec63ac2b8123a67d6999aa8dde5f465185d5f597d01fc84a2
Opcode Fuzzy Hash: ef9edbf377b2a7e840aff60de5adf9dbd7feb1d909d8ca876a573373a60b7605
Instruction Fuzzy Hash: 0EF0AF72B0064082FB139B6BA4183E912C1ABCDBE1F494031AF09473B1EE38C8868254

Function 000000014004E3E0 Relevance: 4.5, APIs: 3, Instructions: 39COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 000000014004E401
OpenProcess.KERNEL32 ref: 000000014004E417
SetPriorityClass.KERNEL32 ref: 000000014004E42A
CloseHandle.KERNEL32 ref: 000000014004E435

Part of subcall function 0000000140081F80: CreateToolhelp32Snapshot.KERNEL32 ref: 0000000140081F9D
Part of subcall function 0000000140081F80: Process32FirstW.KERNEL32 ref: 0000000140081FAE
Part of subcall function 0000000140081F80: Process32NextW.KERNEL32 ref: 00000001400820DD

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: ProcessProcess32$ClassCloseCreateCurrentFirstHandleNextOpenPrioritySnapshotToolhelp32
String ID:
API String ID: 1771318894-0
Opcode ID: 829747cd70cd14996132b1a41e8b31b91bc1ca2e923c335aa63b5f1ae09952db
Instruction ID: 97446a14954eb81cfb5d31a3bc8f7032dad3a6429b7651870dff7d1687a30977
Opcode Fuzzy Hash: 829747cd70cd14996132b1a41e8b31b91bc1ca2e923c335aa63b5f1ae09952db
Instruction Fuzzy Hash: 0FF04F72B0164082FB179B6BA4583E912C1ABCDBE1F494135AF09473B5EE78C8868755

Function 000000014004E3D9 Relevance: 4.5, APIs: 3, Instructions: 39COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 000000014004E401
OpenProcess.KERNEL32 ref: 000000014004E417
SetPriorityClass.KERNEL32 ref: 000000014004E42A
CloseHandle.KERNEL32 ref: 000000014004E435

Part of subcall function 0000000140081F80: CreateToolhelp32Snapshot.KERNEL32 ref: 0000000140081F9D
Part of subcall function 0000000140081F80: Process32FirstW.KERNEL32 ref: 0000000140081FAE
Part of subcall function 0000000140081F80: Process32NextW.KERNEL32 ref: 00000001400820DD

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: ProcessProcess32$ClassCloseCreateCurrentFirstHandleNextOpenPrioritySnapshotToolhelp32
String ID:
API String ID: 1771318894-0
Opcode ID: 7bc28cbb1aa2dc1b34b64ab0a1e17be295b47b07b2ae33ddfedccb265c5af020
Instruction ID: cb3374f4a5296659f8141f99a3e3a60566b93ec14164019558d3a217bdedb968
Opcode Fuzzy Hash: 7bc28cbb1aa2dc1b34b64ab0a1e17be295b47b07b2ae33ddfedccb265c5af020
Instruction Fuzzy Hash: 76F04F72B0164082FB179B6BA4583E912C1ABCDBE1F494135AF09473B5EE78C8868655

Function 000000014004E3E7 Relevance: 4.5, APIs: 3, Instructions: 39COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 000000014004E401
OpenProcess.KERNEL32 ref: 000000014004E417
SetPriorityClass.KERNEL32 ref: 000000014004E42A
CloseHandle.KERNEL32 ref: 000000014004E435

Part of subcall function 0000000140081F80: CreateToolhelp32Snapshot.KERNEL32 ref: 0000000140081F9D
Part of subcall function 0000000140081F80: Process32FirstW.KERNEL32 ref: 0000000140081FAE
Part of subcall function 0000000140081F80: Process32NextW.KERNEL32 ref: 00000001400820DD

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: ProcessProcess32$ClassCloseCreateCurrentFirstHandleNextOpenPrioritySnapshotToolhelp32
String ID:
API String ID: 1771318894-0
Opcode ID: 9f7139f11e06a6345e544bf262a077ee3d70ffd5ff0a43ef230029bd4e193804
Instruction ID: 9e6652d27a0b8c89e48e43d5dfa14592c95d0e39f5d4b2e24a50f057e2a3f813
Opcode Fuzzy Hash: 9f7139f11e06a6345e544bf262a077ee3d70ffd5ff0a43ef230029bd4e193804
Instruction Fuzzy Hash: 28F0C232B0064083FB139B7BA4583E912C1ABCDBE1F494035AF05473B1EE38C8868350

Function 000000014004E3EB Relevance: 4.5, APIs: 3, Instructions: 38COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 000000014004E401
OpenProcess.KERNEL32 ref: 000000014004E417
SetPriorityClass.KERNEL32 ref: 000000014004E42A
CloseHandle.KERNEL32 ref: 000000014004E435

Part of subcall function 0000000140081F80: CreateToolhelp32Snapshot.KERNEL32 ref: 0000000140081F9D
Part of subcall function 0000000140081F80: Process32FirstW.KERNEL32 ref: 0000000140081FAE
Part of subcall function 0000000140081F80: Process32NextW.KERNEL32 ref: 00000001400820DD

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: ProcessProcess32$ClassCloseCreateCurrentFirstHandleNextOpenPrioritySnapshotToolhelp32
String ID:
API String ID: 1771318894-0
Opcode ID: 14958583bcd16c9cd936544688cd73251a04f4824191377e74294f93251e4b9c
Instruction ID: 2ee11113112613932fc6b43a36abc71ec63443c92b1d68fd3aa7e46580b46165
Opcode Fuzzy Hash: 14958583bcd16c9cd936544688cd73251a04f4824191377e74294f93251e4b9c
Instruction Fuzzy Hash: 07F04F72B0164042FB079B6BA4583E912C16BCDBE1F494135AF09473B5EE78C8868250

Function 000000014000BE90 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

FindWindowW.USER32 ref: 000000014000C05F

Strings

#32771, xrefs: 000000014000C04A

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: FindWindow
String ID: #32771
API String ID: 134000473-1822717788
Opcode ID: c6008a0b0e0e542c63bdf14c3264bed1d516f3078ff36275700f98caa614bba4
Instruction ID: 23a10c22c2ecffa83aee5b63840c17901200db1134498e78a575db741932760d
Opcode Fuzzy Hash: c6008a0b0e0e542c63bdf14c3264bed1d516f3078ff36275700f98caa614bba4
Instruction Fuzzy Hash: 2A6124725263C0C5E717CF1AE468BD97BA5FB2D780F89802AEB48473B6E73A8045C715

Function 00000001400AAB90 Relevance: 3.1, APIs: 2, Instructions: 106COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00000001400AABC6
GetCPInfo.KERNEL32 ref: 00000001400AAC7B

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 1a90680036c19e922d6c52027731fdc606d85e7d379e83badf0b7055807d3c2c
Instruction ID: e81c79421bb14a7be2457c43d923f3a937507750e9e2d4301a6a03fade4ed29e
Opcode Fuzzy Hash: 1a90680036c19e922d6c52027731fdc606d85e7d379e83badf0b7055807d3c2c
Instruction Fuzzy Hash: 82415D72604B4086FB668F26E45439977A1E7AEBE4F488215EB45077E8CB3DC881CB41

Function 0000000140056A05 Relevance: 3.1, APIs: 2, Instructions: 51windowtimeCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32 ref: 000000014005689A
SendMessageTimeoutW.USER32 ref: 0000000140056914
PostMessageW.USER32 ref: 0000000140056945
PostMessageW.USER32 ref: 0000000140056997
SendMessageTimeoutW.USER32 ref: 00000001400569CC
PostMessageW.USER32 ref: 0000000140056A5D

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Message$Post$SendTimeout$ProcWindow
String ID:
API String ID: 2617672042-0
Opcode ID: 452e0cbbef118e0098b41bc898a5ecd7b5c503e8964b8024d1a303133481c515
Instruction ID: dbf8fa8167f1aa047b5a89bb4eea0efaf6aafdde3deddb13f6630b496da13ff6
Opcode Fuzzy Hash: 452e0cbbef118e0098b41bc898a5ecd7b5c503e8964b8024d1a303133481c515
Instruction Fuzzy Hash: AA11A03131028085EFB6CB3794047EA2391E74CBD8F584912EF09277B0CE3AC842C700

Function 00000001400562E2 Relevance: 3.0, APIs: 2, Instructions: 21windowCOMMON

Download Yara Rule

APIs

SetFocus.USER32 ref: 00000001400562F6
DefWindowProcW.USER32 ref: 000000014005689A

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: FocusProcWindow
String ID:
API String ID: 1691694861-0
Opcode ID: 7f6fdec764571e86f1907e6865b635a467b3a95f3365bcbffd90c40c78c863ad
Instruction ID: 43be29760b6003af43ff3aabb428fde74b4e2e7218dfc3684602e9a5ca2171b3
Opcode Fuzzy Hash: 7f6fdec764571e86f1907e6865b635a467b3a95f3365bcbffd90c40c78c863ad
Instruction Fuzzy Hash: 8CF0E536220A84C9D6A6CB53A8083DA7325F78DFE8F984452DF4967778CE39C886C740

Function 0000000140005300 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE ref: 0000000140005310

Part of subcall function 0000000140063E20: GetCurrentDirectoryW.KERNEL32(?,000000014000531D), ref: 0000000140063E3C

Part of subcall function 0000000140005660: FindWindowW.USER32 ref: 00000001400056EC

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CurrentDirectoryErrorFindModeWindow
String ID:
API String ID: 2401824476-0
Opcode ID: 8e5bb56eea2d6c595b5c99b0194fd3963056dda9a204920914395c88226d3757
Instruction ID: a767f65e330600fcd84777f9cc0cdf34d132e03d461d7ff85166b88e96f2a39c
Opcode Fuzzy Hash: 8e5bb56eea2d6c595b5c99b0194fd3963056dda9a204920914395c88226d3757
Instruction Fuzzy Hash: 4C3191B1A1160481FB5BFB23B8553EB22D1AB4E7E1F800525B72A8B2F1EE7CC5848310

Function 0000000140056303 Relevance: 1.5, APIs: 1, Instructions: 28windowtimeCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32 ref: 000000014005689A
SendMessageTimeoutW.USER32 ref: 0000000140056914
PostMessageW.USER32 ref: 0000000140056945
PostMessageW.USER32 ref: 0000000140056997
SendMessageTimeoutW.USER32 ref: 00000001400569CC

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Message$PostSendTimeout$ProcWindow
String ID:
API String ID: 2241355032-0
Opcode ID: 52b3c87fc0582bffd949f044ad4d3b2e21c1a90051e58b688e997ea240a15d43
Instruction ID: e8bd0f09ae92e8976c601995abb46682831f5666f2fb82043f7a4eea84b7b487
Opcode Fuzzy Hash: 52b3c87fc0582bffd949f044ad4d3b2e21c1a90051e58b688e997ea240a15d43
Instruction Fuzzy Hash: 19F08C3160468089EABBDB23A9047EA6354F75DBE4F880552EF49177B8CE39C882C701

Function 00000001400562AF Relevance: 1.5, APIs: 1, Instructions: 27windowtimeCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32 ref: 000000014005689A
SendMessageTimeoutW.USER32 ref: 0000000140056914
PostMessageW.USER32 ref: 0000000140056945
PostMessageW.USER32 ref: 0000000140056997
SendMessageTimeoutW.USER32 ref: 00000001400569CC

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Message$PostSendTimeout$ProcWindow
String ID:
API String ID: 2241355032-0
Opcode ID: 73769f3404a28d8316fd93cc677cfca1075c57be5523aa1eb7f863a1f34821c0
Instruction ID: 51854d67a934218697dbb0bed4505ae7712fb3b0623df01f16fe71c5103f5623
Opcode Fuzzy Hash: 73769f3404a28d8316fd93cc677cfca1075c57be5523aa1eb7f863a1f34821c0
Instruction Fuzzy Hash: 0FF0E231220A8094EBA2DB33A8083E63311F74CBF4F880202EF59537B4CE35C482C700

Function 0000000140056330 Relevance: 1.5, APIs: 1, Instructions: 27windowtimeCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32 ref: 000000014005689A
SendMessageTimeoutW.USER32 ref: 0000000140056914
PostMessageW.USER32 ref: 0000000140056945
PostMessageW.USER32 ref: 0000000140056997
SendMessageTimeoutW.USER32 ref: 00000001400569CC

Part of subcall function 00000001400A31A0: DrawIconEx.USER32 ref: 00000001400A3248

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Message$PostSendTimeout$DrawIconProcWindow
String ID:
API String ID: 2027319081-0
Opcode ID: 08578b2a9eee807a6cd43f69dd54896c4b6916bfde4dd0ba2f78ade3ed896f34
Instruction ID: 1af1e95ca84cacf10ff083a3b160eb6954cdc5e7fa65472f6dec53d82aed3348
Opcode Fuzzy Hash: 08578b2a9eee807a6cd43f69dd54896c4b6916bfde4dd0ba2f78ade3ed896f34
Instruction Fuzzy Hash: 4AF0A03170468089EABBDB23A9047E66354F75CFE4F880552EF48177B8DE39C882C701

Function 000000014005625B Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32 ref: 000000014005689A

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: ProcWindow
String ID:
API String ID: 181713994-0
Opcode ID: a1a2dc6b5c5f2252d2a6f71790d7efdfbdae763811175e89f4c7e69d753ad5bf
Instruction ID: 09ac8345ab926d3f659aa5b10624fa1af9c94c2182bb39313a7b5bdfb659d8d7
Opcode Fuzzy Hash: a1a2dc6b5c5f2252d2a6f71790d7efdfbdae763811175e89f4c7e69d753ad5bf
Instruction Fuzzy Hash: 10F0A936220A84D5D6A2DB12E4087DA2321F78CBE8F844412DF4813738CE34C88ACB40

Function 0000000140056B39 Relevance: 1.5, APIs: 1, Instructions: 21windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140004EA0: GetTickCount.KERNEL32 ref: 0000000140004ED8

PostMessageW.USER32 ref: 0000000140056B52

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountMessagePostTick
String ID:
API String ID: 1233319983-0
Opcode ID: 559b25f915f190700bafda9ec81ed6373ac053419a0defaa4b3700ea00f2d7c2
Instruction ID: dbf9eac6577d8fa7336361ee20d3d890234e70cc5ed3963604f3a4ff82f5720a
Opcode Fuzzy Hash: 559b25f915f190700bafda9ec81ed6373ac053419a0defaa4b3700ea00f2d7c2
Instruction Fuzzy Hash: 00E08636314AC1C4D7A2CB63A4043DA5315F74CFD4F984052EF8963765DE35D846C300

Function 00000001400AA8E0 Relevance: 1.3, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 00000001400AA8FB

Part of subcall function 00000001400CA9C4: _FF_MSGBANNER.LIBCMT ref: 00000001400CA9F4
Part of subcall function 00000001400CA9C4: HeapAlloc.KERNEL32(?,?,00000000,00000001400D0AC0,?,?,00000000,00000001400CF2FD,?,?,?,00000001400CF3A7,?,?,00000000,00000001400CE795), ref: 00000001400CAA19
Part of subcall function 00000001400CA9C4: _callnewh.LIBCMT ref: 00000001400CAA32
Part of subcall function 00000001400CA9C4: _errno.LIBCMT ref: 00000001400CAA3D
Part of subcall function 00000001400CA9C4: _errno.LIBCMT ref: 00000001400CAA48

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: _errno$AllocHeap_callnewhmalloc
String ID:
API String ID: 908589684-0
Opcode ID: e8415347e7a035ba761bbc2622fb1c7cb660b6b0b126d0e4fd6f6fb66c3e52f0
Instruction ID: c81b00bb37ac1c51701ff997527113ff163bba93f9151a614237ab336f08699d
Opcode Fuzzy Hash: e8415347e7a035ba761bbc2622fb1c7cb660b6b0b126d0e4fd6f6fb66c3e52f0
Instruction Fuzzy Hash: 70F0813270464086EF95CF2AE08436D23A1E79CB98F195125EB4D47399DB38C8C1CB00

Function 00000001400AA4B0 Relevance: 1.3, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400CBD60: malloc.LIBCMT ref: 00000001400CBD7A

malloc.LIBCMT ref: 00000001400AA4D5

Part of subcall function 00000001400CA9C4: _FF_MSGBANNER.LIBCMT ref: 00000001400CA9F4
Part of subcall function 00000001400CA9C4: HeapAlloc.KERNEL32(?,?,00000000,00000001400D0AC0,?,?,00000000,00000001400CF2FD,?,?,?,00000001400CF3A7,?,?,00000000,00000001400CE795), ref: 00000001400CAA19
Part of subcall function 00000001400CA9C4: _callnewh.LIBCMT ref: 00000001400CAA32
Part of subcall function 00000001400CA9C4: _errno.LIBCMT ref: 00000001400CAA3D
Part of subcall function 00000001400CA9C4: _errno.LIBCMT ref: 00000001400CAA48

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: _errnomalloc$AllocHeap_callnewh
String ID:
API String ID: 3069281513-0
Opcode ID: dce769f4384ba7f9329884e7849865cb8c0fa210c1ebbf421af3de28cba1bde4
Instruction ID: cc2869e1643afeacdc4934b6a57c6d6c748a122b421dba749d8fb7c5255d004d
Opcode Fuzzy Hash: dce769f4384ba7f9329884e7849865cb8c0fa210c1ebbf421af3de28cba1bde4
Instruction Fuzzy Hash: D3F01531642B0481EB5F9B67A4653A822D0EB9DB84F081528BF890B3E2EF7C84E18750

Non-executed Functions

Function 0000000140015000 Relevance: 84.7, APIs: 42, Strings: 6, Instructions: 746threadkeyboardlibraryCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00000001400150CE
CreateMutexW.KERNEL32 ref: 00000001400150DF
GetLastError.KERNEL32 ref: 00000001400150E8
CloseHandle.KERNEL32 ref: 000000014001510B
GetWindowThreadProcessId.USER32 ref: 00000001400151A4
AttachThreadInput.USER32 ref: 00000001400151DF
GetKeyboardLayout.USER32 ref: 0000000140015345

Part of subcall function 00000001400CAB94: _errno.LIBCMT ref: 00000001400CABB2
Part of subcall function 00000001400CAB94: _invalid_parameter_noinfo.LIBCMT ref: 00000001400CABBD

GetTickCount.KERNEL32 ref: 00000001400151FF
GetCurrentThreadId.KERNEL32 ref: 0000000140015240
GetAsyncKeyState.USER32 ref: 0000000140015275
GetAsyncKeyState.USER32 ref: 0000000140015285
GetForegroundWindow.USER32 ref: 00000001400152EF
GetWindowThreadProcessId.USER32 ref: 00000001400152FF
GetGUIThreadInfo.USER32 ref: 000000014001531A
GetWindowThreadProcessId.USER32 ref: 0000000140015332
GetProcAddress.KERNEL32 ref: 00000001400153B0
FreeLibrary.KERNEL32 ref: 00000001400153CD
GetTickCount.KERNEL32 ref: 0000000140015424
BlockInput.USER32 ref: 000000014001559D
GetTickCount.KERNEL32 ref: 00000001400155DF
PeekMessageW.USER32 ref: 000000014001560A
GetTickCount.KERNEL32 ref: 0000000140015631

Strings

{Click, xrefs: 0000000140015127
^+!#{}, xrefs: 0000000140015648
{Blind}, xrefs: 000000014001504E
AHK Keybd, xrefs: 00000001400150D4
KbdLayerDescriptor, xrefs: 00000001400153A6
{Text}, xrefs: 0000000140015077

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Thread$CountTickWindow$Process$AsyncCloseHandleInputState$AddressAttachBlockCreateCurrentErrorForegroundFreeInfoKeyboardLastLayoutLibraryMessageMutexPeekProc_errno_invalid_parameter_noinfo
String ID: AHK Keybd$KbdLayerDescriptor$^+!#{}${Blind}${Click${Text}
API String ID: 4276635616-2714328142
Opcode ID: 59a7694801dc7813bc4d93d965764625739caa19ed8db1c2fdb9cad20351eab2
Instruction ID: 0860cf20998349ac46e59709059a1ad11ae8c3e82860a789d493fd3134482ed3
Opcode Fuzzy Hash: 59a7694801dc7813bc4d93d965764625739caa19ed8db1c2fdb9cad20351eab2
Instruction Fuzzy Hash: 0772DE322046808AF76B9F37A8503E93BA1E74DB99F484119FB560F6F5DB3AC944C750

Function 0000000140059490 Relevance: 53.5, APIs: 15, Strings: 15, Instructions: 1026COMMON

Download Yara Rule

APIs

wcsncpy.LIBCMT ref: 000000014005954F

Strings

ShortDate, xrefs: 0000000140059A1B
YearMonth, xrefs: 0000000140059A8C
WDay, xrefs: 00000001400599EE
%03d, xrefs: 000000014005A119
LongDate, xrefs: 0000000140059A53
dMyg, xrefs: 0000000140059C38
YDay0, xrefs: 00000001400599D7
YDay, xrefs: 00000001400599C0, 000000014005A0F0
Time, xrefs: 0000000140059ABF
, xrefs: 000000014005A280
Memory limit reached (see #MaxMem in the help file)., xrefs: 000000014005A1C6
YWeek, xrefs: 0000000140059829
Sys, xrefs: 0000000140059719
hHmst, xrefs: 0000000140059CE7
Out of memory., xrefs: 000000014005A41D

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: wcsncpy
String ID: $%03d$LongDate$Memory limit reached (see #MaxMem in the help file).$Out of memory.$ShortDate$Sys$Time$WDay$YDay$YDay0$YWeek$YearMonth$dMyg$hHmst
API String ID: 322933527-1989723997
Opcode ID: 38cbedc918e546283e374eda6a316d214977181464338bf7a9308a5e35d7ace9
Instruction ID: f094ba77bebd9a3990d619dc445c7f06b459f7537eaba7ee8b73b16baf7b6a80
Opcode Fuzzy Hash: 38cbedc918e546283e374eda6a316d214977181464338bf7a9308a5e35d7ace9
Instruction Fuzzy Hash: E292123260868086EB62CF27D5417EE67A6FB9D7D4F454116FB8A476F8EB3AC845C300

Function 00000001400612A0 Relevance: 51.4, APIs: 19, Strings: 10, Instructions: 692COMMON

Download Yara Rule

APIs

_wcstoi64.LIBCMT ref: 000000014006135F
mixerOpen.WINMM ref: 00000001400613C0
mixerGetDevCapsW.WINMM ref: 00000001400613EB
mixerGetLineInfoW.WINMM ref: 0000000140061442
mixerClose.WINMM ref: 0000000140061455
mixerGetLineInfoW.WINMM ref: 000000014006149F
mixerGetLineInfoW.WINMM ref: 00000001400614D8

Part of subcall function 00000001400B1BB0: free.LIBCMT ref: 00000001400B1C50

mixerGetLineControlsW.WINMM ref: 000000014006156C
mixerClose.WINMM ref: 000000014006157B
mixerGetControlDetailsW.WINMM ref: 0000000140061617
mixerClose.WINMM ref: 0000000140061626
mixerSetControlDetails.WINMM ref: 00000001400616AA
mixerClose.WINMM ref: 00000001400616B7
mixerClose.WINMM ref: 000000014006172E
free.LIBCMT ref: 0000000140061C79
malloc.LIBCMT ref: 0000000140061C8B
mixerClose.WINMM ref: 0000000140061D65

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 00000001400617D5, 0000000140061AD1
Component Doesn't Support This Control Type, xrefs: 0000000140061581
Mixer Doesn't Have That Many of That Component Type, xrefs: 0000000140061D72
Can't Open Specified Mixer, xrefs: 00000001400613CA
Off, xrefs: 00000001400619F0
Can't Change Setting, xrefs: 00000001400616C4
Mixer Doesn't Support This Component Type, xrefs: 000000014006145B
, xrefs: 00000001400615C5
Can't Get Current Setting, xrefs: 000000014006162C
Out of memory., xrefs: 0000000140061A45, 0000000140061CF8

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: mixer$Close$Line$Info$ControlDetailsfree$CapsControlsOpen_wcstoi64malloc
String ID: $Can't Change Setting$Can't Get Current Setting$Can't Open Specified Mixer$Component Doesn't Support This Control Type$Memory limit reached (see #MaxMem in the help file).$Mixer Doesn't Have That Many of That Component Type$Mixer Doesn't Support This Component Type$Off$Out of memory.
API String ID: 1278014356-3934002841
Opcode ID: 5bcaef830cf30f64d29c6108cff121e107a57f944d8335d673c76b0379514d4e
Instruction ID: bb15fa6409e08cbcdf131759eaec7dde90ddef0f16fbf5f6a193b4e3b657ff69
Opcode Fuzzy Hash: 5bcaef830cf30f64d29c6108cff121e107a57f944d8335d673c76b0379514d4e
Instruction Fuzzy Hash: FE62CF32214A8186EB628B27D8543EE63A6F7CC7D8F684A11FB4E17BB4DB78C545C740

Function 0000000140003236 Relevance: 46.2, APIs: 23, Strings: 3, Instructions: 730windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 000000014000330F
ScreenToClient.USER32 ref: 0000000140003325
SendMessageW.USER32 ref: 000000014000333A
GetWindowRect.USER32 ref: 0000000140003377
MulDiv.KERNEL32 ref: 00000001400034C5
GetWindowRect.USER32 ref: 0000000140003513

Part of subcall function 00000001400B1BB0: free.LIBCMT ref: 00000001400B1C50

GetWindowRect.USER32 ref: 0000000140003637
GetWindowLongW.USER32 ref: 000000014000365A
SetWindowLongW.USER32 ref: 000000014000366F
MulDiv.KERNEL32 ref: 0000000140003709
MulDiv.KERNEL32 ref: 0000000140003752
SendMessageW.USER32 ref: 00000001400037D0
ShowWindow.USER32 ref: 0000000140003C2E
DragFinish.SHELL32 ref: 0000000140003C54
GetWindowLongW.USER32 ref: 0000000140003C6A
SetWindowLongW.USER32 ref: 0000000140003C7F
free.LIBCMT ref: 0000000140003C96

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 000000014000390C
Out of memory., xrefs: 0000000140003B13
call, xrefs: 0000000140003BD5

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Window$Long$MessageRectSend$free$ClientDragFinishScreenShow
String ID: Memory limit reached (see #MaxMem in the help file).$Out of memory.$call
API String ID: 1298873099-3963558559
Opcode ID: 40b7f8bf0a042c4511a4156588bcb4cde021b6ad3e565325829d5f095b8f7e8f
Instruction ID: ceb96e6e940a86436d1104c4e662abd7b2f3a10282a9207ffcfeb287d8b57534
Opcode Fuzzy Hash: 40b7f8bf0a042c4511a4156588bcb4cde021b6ad3e565325829d5f095b8f7e8f
Instruction Fuzzy Hash: 9F72BCB2604B848AEB67CF26E4447ED37A9F74CBD8F554225EB4A17BA8DB38C540C740

Function 000000014009E240 Relevance: 42.3, APIs: 23, Strings: 1, Instructions: 252windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 000000014009E272
GetWindowLongW.USER32 ref: 000000014009E286
IsWindowVisible.USER32 ref: 000000014009E2B0
IsIconic.USER32 ref: 000000014009E2C3
GetFocus.USER32(?,?,?,00000000,00000000,00000000,00000000,00000000,?,000000014009E985), ref: 000000014009E2ED
GetWindowRect.USER32(?,?,?,00000000,00000000,00000000,00000000,00000000,?,000000014009E985), ref: 000000014009E32A
GetPropW.USER32 ref: 000000014009E33B
ShowWindow.USER32(?,?,?,00000000,00000000,00000000,00000000,00000000,?,000000014009E985), ref: 000000014009E353
GetUpdateRect.USER32 ref: 000000014009E379
SendMessageW.USER32 ref: 000000014009E38D
GetWindowLongW.USER32 ref: 000000014009E40C
ShowWindow.USER32 ref: 000000014009E439
EnableWindow.USER32 ref: 000000014009E44E
GetWindowRect.USER32 ref: 000000014009E463
PtInRect.USER32 ref: 000000014009E473
PtInRect.USER32 ref: 000000014009E487
SetFocus.USER32 ref: 000000014009E4CF
SendMessageW.USER32 ref: 000000014009E52F
ShowWindow.USER32(?,?,?,00000000,00000000,00000000,00000000,00000000,?,000000014009E985), ref: 000000014009E547
SetFocus.USER32(?,?,?,00000000,00000000,00000000,00000000,00000000,?,000000014009E985), ref: 000000014009E556
InvalidateRect.USER32(?,?,?,00000000,00000000,00000000,00000000,00000000,?,000000014009E985), ref: 000000014009E582
MapWindowPoints.USER32 ref: 000000014009E599
InvalidateRect.USER32(?,?,?,00000000,00000000,00000000,00000000,00000000,?,000000014009E985), ref: 000000014009E5AE

Strings

ahk_dlg, xrefs: 000000014009E334

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Window$Rect$FocusMessageSendShow$InvalidateLong$EnableIconicPointsPropUpdateVisible
String ID: ahk_dlg
API String ID: 2875520219-2093416220
Opcode ID: 68c8d808155ae5766832122fd42fb1921bac80d3489f7ef294baf8f57cf22d8b
Instruction ID: e6f5c87fc398643b063a8809f91e205ab52c95b8707eaf4d0365a99a1d36e6bb
Opcode Fuzzy Hash: 68c8d808155ae5766832122fd42fb1921bac80d3489f7ef294baf8f57cf22d8b
Instruction Fuzzy Hash: BFB17232108AC086EB628B27E5547AB67A1F78CBD9F148115FF8A07AB5DF38CD84C750

Function 000000014007B170 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 192windowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 000000014007B198
GetSystemMetrics.USER32 ref: 000000014007B1A6
GetSystemMetrics.USER32 ref: 000000014007B1B5
SystemParametersInfoW.USER32 ref: 000000014007B1CF
IsWindow.USER32 ref: 000000014007B215
DestroyWindow.USER32 ref: 000000014007B226
CreateWindowExW.USER32 ref: 000000014007B27C
GetClientRect.USER32 ref: 000000014007B291
CreateWindowExW.USER32 ref: 000000014007B2F0
CreateDCW.GDI32 ref: 000000014007B31B
wcsncpy.LIBCMT ref: 000000014007B34A
EnumFontFamiliesExW.GDI32 ref: 000000014007B37F
GetStockObject.GDI32 ref: 000000014007B3BC
SelectObject.GDI32 ref: 000000014007B3C8
GetTextFaceW.GDI32 ref: 000000014007B3DE
GetDeviceCaps.GDI32 ref: 000000014007B3EC
DeleteDC.GDI32 ref: 000000014007B3F7
CreateFontW.GDI32 ref: 000000014007B461
SendMessageW.USER32 ref: 000000014007B47E
ShowWindow.USER32 ref: 000000014007B490

Strings

AutoHotkey2, xrefs: 000000014007B236
Segoe UI, xrefs: 000000014007B321
static, xrefs: 000000014007B2D4
DISPLAY, xrefs: 000000014007B309

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Window$CreateSystem$Metrics$FontObject$CapsClientDeleteDestroyDeviceEnumFaceFamiliesInfoMessageParametersRectSelectSendShowStockTextwcsncpy
String ID: AutoHotkey2$DISPLAY$Segoe UI$static
API String ID: 318928480-4085670783
Opcode ID: 3d9e7554f856616607bdba244c398c7b843aa41e97c6d1c648e04fae9b795416
Instruction ID: 31d5d4e9383a9daa4673fe859a93be3b694af2c3670b88ac9da1f2bd46cb53c8
Opcode Fuzzy Hash: 3d9e7554f856616607bdba244c398c7b843aa41e97c6d1c648e04fae9b795416
Instruction Fuzzy Hash: E6917C72204B818AE755CF66F8807DA77A4F78CB94F140129EB8A67B78CB3DC485CB40

Function 000000014007F440 Relevance: 39.8, APIs: 15, Strings: 7, Instructions: 1251comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 000000014007F547
CoCreateInstance.OLE32 ref: 000000014007F56B
free.LIBCMT ref: 000000014007FB29
malloc.LIBCMT ref: 000000014007FB3E
free.LIBCMT ref: 000000014007FE5E
malloc.LIBCMT ref: 000000014007FE6F
free.LIBCMT ref: 00000001400800F3
malloc.LIBCMT ref: 0000000140080108
free.LIBCMT ref: 0000000140080426
malloc.LIBCMT ref: 0000000140080437
CoUninitialize.OLE32 ref: 0000000140080790

Part of subcall function 00000001400B1BB0: free.LIBCMT ref: 00000001400B1C50

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 000000014007F6AE, 000000014007F990, 000000014007FCCD, 000000014007FF62, 000000014008025E, 000000014008057C
, xrefs: 000000014007FD8F
, xrefs: 0000000140080637
, xrefs: 000000014007FA59
, xrefs: 0000000140080024
, xrefs: 0000000140080356
Out of memory., xrefs: 000000014007F912, 000000014007FC51, 000000014007FEE7, 00000001400801E4, 00000001400804BE, 00000001400807CB

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: free$malloc$CreateInitializeInstanceUninitialize
String ID: $ $ $ $ $Memory limit reached (see #MaxMem in the help file).$Out of memory.
API String ID: 3846668080-3083028912
Opcode ID: 8efa29bb937e9688e4e937eb5313fd3027c3e58f69e2ed9fdacb05ea4b845542
Instruction ID: 24d23ebf811e875dc21f519999cbb223ad35fc2322bc0f284fa2c5a4035c2a4a
Opcode Fuzzy Hash: 8efa29bb937e9688e4e937eb5313fd3027c3e58f69e2ed9fdacb05ea4b845542
Instruction Fuzzy Hash: F3C2FC32304B8482FBA38B26D0587EA23A2FB4CBD8F554612FB5A176F5EB78C545D311

Function 00000001400D7030 Relevance: 39.6, APIs: 26, Instructions: 573fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00000001400D708D
__doserrno.LIBCMT ref: 00000001400D70D3
_errno.LIBCMT ref: 00000001400D70DD
_invalid_parameter_noinfo.LIBCMT ref: 00000001400D70E9
__doserrno.LIBCMT ref: 00000001400D7237
_errno.LIBCMT ref: 00000001400D7241
_errno.LIBCMT ref: 00000001400D724C
CreateFileW.KERNEL32 ref: 00000001400D7282
CreateFileW.KERNEL32 ref: 00000001400D72D7
GetLastError.KERNEL32 ref: 00000001400D7308
_errno.LIBCMT ref: 00000001400D7315
GetFileType.KERNEL32 ref: 00000001400D7324
GetLastError.KERNEL32 ref: 00000001400D734F
CloseHandle.KERNEL32 ref: 00000001400D7362
_errno.LIBCMT ref: 00000001400D736C
_lseek_nolock.LIBCMT ref: 00000001400D7400
__doserrno.LIBCMT ref: 00000001400D740D
_lseek_nolock.LIBCMT ref: 00000001400D745D
_errno.LIBCMT ref: 00000001400D75D5
_lseek_nolock.LIBCMT ref: 00000001400D75F7
CloseHandle.KERNEL32 ref: 00000001400D7734
CreateFileW.KERNEL32 ref: 00000001400D7762
GetLastError.KERNEL32 ref: 00000001400D776E
_errno.LIBCMT ref: 00000001400D77F8
_invalid_parameter_noinfo.LIBCMT ref: 00000001400D7804

Part of subcall function 00000001400D350C: CloseHandle.KERNEL32(?,?,00000000,00000001400D7421), ref: 00000001400D356B
Part of subcall function 00000001400D350C: GetLastError.KERNEL32(?,?,00000000,00000001400D7421), ref: 00000001400D3575

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: _errno$ErrorFileLast$CloseCreateHandle__doserrno_lseek_nolock$_invalid_parameter_noinfo$Type_get_daylight
String ID:
API String ID: 6860575-0
Opcode ID: 445b1690d209de46c1df0dfb894a0b52653c4a4e6651d37fa25beeaca9a11dea
Instruction ID: 07816edda11750760eab9b0d84292ae9485dd87831621d75fdcba698ae89c25c
Opcode Fuzzy Hash: 445b1690d209de46c1df0dfb894a0b52653c4a4e6651d37fa25beeaca9a11dea
Instruction Fuzzy Hash: DF32E532710A5089FB678B7AD450BEC26A1AB4C7E8F544615FF1A877F5EB38C842C721

Function 00000001400B30D0 Relevance: 37.5, APIs: 19, Strings: 2, Instructions: 703windowtimememoryCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32 ref: 00000001400B316A
GetWindowThreadProcessId.USER32 ref: 00000001400B318A
OpenProcess.KERNEL32(?,?,?,00000000,?,?,000000014004D8CE), ref: 00000001400B319D
VirtualAllocEx.KERNEL32(?,?,?,00000000,?,?,000000014004D8CE), ref: 00000001400B31C9
CloseHandle.KERNEL32(?,?,?,00000000,?,?,000000014004D8CE), ref: 00000001400B31DF
GetTickCount.KERNEL32 ref: 00000001400B322B
SendMessageTimeoutW.USER32 ref: 00000001400B326B
SendMessageTimeoutW.USER32 ref: 00000001400B32C2
ReadProcessMemory.KERNEL32(?,?,?,00000000,?,?,000000014004D8CE), ref: 00000001400B32F6
IsWindow.USER32 ref: 00000001400B3326
GetTickCount.KERNEL32 ref: 00000001400B3338
VirtualFreeEx.KERNEL32(?,?,?,00000000,?,?,000000014004D8CE), ref: 00000001400B3BDA
CloseHandle.KERNEL32(?,?,?,00000000,?,?,000000014004D8CE), ref: 00000001400B3BE3

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 00000001400B33D8, 00000001400B36ED, 00000001400B39C2
Out of memory., xrefs: 00000001400B35F0, 00000001400B390B, 00000001400B3C1B

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: MessageProcessSendTimeout$CloseCountHandleTickVirtualWindow$AllocFreeMemoryOpenReadThread
String ID: Memory limit reached (see #MaxMem in the help file).$Out of memory.
API String ID: 2761252263-457448710
Opcode ID: 4e148e458d5288412ee9f6f7c3cd070bcefc5ca313b2385e7b3221fab8e4dd75
Instruction ID: ead2ff81f1ff95c29bd010f9c56181b48e695424291b4e408234bc24f66c1db5
Opcode Fuzzy Hash: 4e148e458d5288412ee9f6f7c3cd070bcefc5ca313b2385e7b3221fab8e4dd75
Instruction Fuzzy Hash: 0262DC72204E8496EA739FA7E5143EA63B1F74CBD4F644512FB9A17AB5EB78C484C300

Function 0000000140062100 Relevance: 34.1, APIs: 10, Strings: 9, Instructions: 824comCOMMON

Download Yara Rule

APIs

_wcstoi64.LIBCMT ref: 00000001400621A6
CoCreateInstance.OLE32 ref: 0000000140062241
powf.LIBCMT ref: 0000000140062559
powf.LIBCMT ref: 0000000140062574
powf.LIBCMT ref: 0000000140062598
free.LIBCMT ref: 00000001400629D7
malloc.LIBCMT ref: 00000001400629ED
free.LIBCMT ref: 0000000140062CDC
malloc.LIBCMT ref: 0000000140062CEE

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 0000000140062848, 0000000140062B40
Component Doesn't Support This Control Type, xrefs: 00000001400622AF, 0000000140062457
Mixer Doesn't Have That Many of That Component Type, xrefs: 000000014006228D, 0000000140062437
Can't Open Specified Mixer, xrefs: 0000000140062267
Off, xrefs: 0000000140062A66
Can't Change Setting, xrefs: 0000000140062760
Mixer Doesn't Support This Component Type, xrefs: 000000014006243E
Can't Get Current Setting, xrefs: 0000000140062759
Out of memory., xrefs: 0000000140062AB8, 0000000140062D55

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: powf$freemalloc$CreateInstance_wcstoi64
String ID: Can't Change Setting$Can't Get Current Setting$Can't Open Specified Mixer$Component Doesn't Support This Control Type$Memory limit reached (see #MaxMem in the help file).$Mixer Doesn't Have That Many of That Component Type$Mixer Doesn't Support This Component Type$Off$Out of memory.
API String ID: 545791434-609076530
Opcode ID: 3b3f29247c2570ac68965ad940f4be1a35e1323ce43aa06a5d6118ad62416587
Instruction ID: 4fe8900142f2625c942088093b6c1168b90d48ef294a9f323286c306f438c17b
Opcode Fuzzy Hash: 3b3f29247c2570ac68965ad940f4be1a35e1323ce43aa06a5d6118ad62416587
Instruction Fuzzy Hash: 1D82BF32604E8496EB639F26D8447E823A2FB5D7D8F258A12FB4D27BB4DB34C595C340

Function 000000014004A3E0 Relevance: 33.9, APIs: 16, Strings: 3, Instructions: 672COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140067BD0: GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,0000000140048B02), ref: 0000000140067C03
Part of subcall function 0000000140067BD0: IsWindowVisible.USER32 ref: 0000000140067C24

GetWindowRect.USER32 ref: 000000014004A695
EnumChildWindows.USER32 ref: 000000014004A6B7
ScreenToClient.USER32 ref: 000000014004A6DC

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 000000014004A776
X, xrefs: 000000014004A5B6
Out of memory., xrefs: 000000014004A993

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Window$ChildClientEnumForegroundRectScreenVisibleWindows
String ID: Memory limit reached (see #MaxMem in the help file).$Out of memory.$X
API String ID: 63631066-3772643972
Opcode ID: 980438c41360b662ba557f54fbc948f48416c7c654c1e644e71abdf079b21b9a
Instruction ID: d59ced3f3ad466f5faf0b7366960b44406eede55143f28e7ee53de4ec92bb604
Opcode Fuzzy Hash: 980438c41360b662ba557f54fbc948f48416c7c654c1e644e71abdf079b21b9a
Instruction Fuzzy Hash: EC52FF32B04A5086FB669B2794003ED23A1F74E7D8F564126FF5A17AE5DB3CC896C348

Function 0000000140065050 Relevance: 33.8, APIs: 18, Strings: 1, Instructions: 527fileCOMMON

Download Yara Rule

APIs

_wcstoui64.LIBCMT ref: 00000001400651FE
CreateFileW.KERNEL32 ref: 00000001400652BD
GetLastError.KERNEL32 ref: 00000001400652CC
GetFileSize.KERNEL32 ref: 00000001400652F9
GetLastError.KERNEL32 ref: 000000014006530F
GetLastError.KERNEL32 ref: 000000014006532C
CloseHandle.KERNEL32 ref: 000000014006533F
CloseHandle.KERNEL32 ref: 0000000140065381
ReadFile.KERNEL32 ref: 000000014006541A
GetLastError.KERNEL32 ref: 000000014006542A
CloseHandle.KERNEL32 ref: 000000014006543D
free.LIBCMT ref: 0000000140065537
free.LIBCMT ref: 000000014006581C
free.LIBCMT ref: 000000014006586F

Strings

Out of memory., xrefs: 0000000140065362, 00000001400654BE

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: ErrorLast$CloseFileHandlefree$CreateReadSize_wcstoui64
String ID: Out of memory.
API String ID: 144052852-4087320997
Opcode ID: 49f5170b2c8a34eb11e5896d9c44adeb612d4aeedd3cd92f65c9da58cbf524f2
Instruction ID: 3e7ede080246a4f00161a1d7367a582e6a5b08f718aef361cdbb375fe852fd20
Opcode Fuzzy Hash: 49f5170b2c8a34eb11e5896d9c44adeb612d4aeedd3cd92f65c9da58cbf524f2
Instruction Fuzzy Hash: BE220A7120468085FB66AB27A8103EA67A2FB9DBE5FA44611FF5E0B7F5DB38C445C700

Function 000000014000D2F0 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 141sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32 ref: 000000014000D343
Sleep.KERNEL32 ref: 000000014000D350
GetTickCount.KERNEL32 ref: 000000014000D360
GetExitCodeThread.KERNEL32 ref: 000000014000D37C
GetTickCount.KERNEL32 ref: 000000014000D38C
Sleep.KERNEL32 ref: 000000014000D39D
CloseHandle.KERNEL32 ref: 000000014000D3AC
CreateMutexW.KERNEL32 ref: 000000014000D3D7
CloseHandle.KERNEL32 ref: 000000014000D3F2
CreateMutexW.KERNEL32 ref: 000000014000D419
CloseHandle.KERNEL32 ref: 000000014000D435
UnhookWindowsHookEx.USER32 ref: 000000014000D481
UnregisterHotKey.USER32 ref: 000000014000D4D1

Strings

AHK Keybd, xrefs: 000000014000D3CC
AHK Mouse, xrefs: 000000014000D40E
2, xrefs: 000000014000D358
Warning: The keyboard and/or mouse hook could not be activated; some parts of the script will not function., xrefs: 000000014000D450

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CloseHandle$CountCreateMutexSleepThreadTick$CodeExitHookMessagePostUnhookUnregisterWindows
String ID: 2$AHK Keybd$AHK Mouse$Warning: The keyboard and/or mouse hook could not be activated; some parts of the script will not function.
API String ID: 2263482667-62447575
Opcode ID: 3fbfa8c04e88573c215f387af4c2d6bf94647df07d155914e15343c3a48a5061
Instruction ID: d92d0c0bb4aedd84c4ee01a266829731a3ef285425fab7798c8d1f3778efdbf3
Opcode Fuzzy Hash: 3fbfa8c04e88573c215f387af4c2d6bf94647df07d155914e15343c3a48a5061
Instruction Fuzzy Hash: D8613676200B4486FB5ADF63F8403EA37A1BB4DBE4F584126AB46476B4DF38C8818650

Function 0000000140006210 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 135clipboardCOMMON

Download Yara Rule

APIs

EmptyClipboard.USER32(?,?,?,?,?), ref: 0000000140006241
GlobalUnlock.KERNEL32 ref: 000000014000625B
CloseClipboard.USER32(?,?,?,?,?), ref: 0000000140006265
GlobalUnlock.KERNEL32 ref: 00000001400062A9
GlobalFree.KERNEL32 ref: 00000001400062C3
GlobalUnlock.KERNEL32 ref: 00000001400062DB
CloseClipboard.USER32(?,?,?,?,?), ref: 00000001400062E5
GlobalUnlock.KERNEL32 ref: 0000000140006385
CloseClipboard.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 000000014000638F
GlobalUnlock.KERNEL32 ref: 00000001400063A5
GlobalFree.KERNEL32 ref: 00000001400063BB

Strings

SetClipboardData, xrefs: 000000014000633F
Can't open clipboard for writing., xrefs: 0000000140006228
EmptyClipboard, xrefs: 0000000140006271

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Global$Unlock$Clipboard$Close$Free$Empty
String ID: Can't open clipboard for writing.$EmptyClipboard$SetClipboardData
API String ID: 1414016178-2690908087
Opcode ID: fe18a3bd9d13f56f1eb653d6fea6f17a4154fd68d7a6e2c60458300421ec3116
Instruction ID: 7f79bef57d48f757aa7e08dfa71b8aae4a0c87a5a05be85d81ac8e5e10ec4be1
Opcode Fuzzy Hash: fe18a3bd9d13f56f1eb653d6fea6f17a4154fd68d7a6e2c60458300421ec3116
Instruction Fuzzy Hash: 12511672601B5082EB669F22E6403AD73A5F74CFD4F044026FB4A63A64DF78D9A1CB80

Function 0000000140097144 Relevance: 27.2, APIs: 18, Instructions: 180windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 000000014009718A
GetWindowLongW.USER32 ref: 00000001400971B8
SendMessageW.USER32 ref: 00000001400971DF
SendMessageW.USER32 ref: 00000001400971F8
SendMessageW.USER32 ref: 0000000140097288
SendMessageW.USER32 ref: 00000001400972C8
SendMessageW.USER32 ref: 0000000140097305
GetWindowRect.USER32 ref: 0000000140097332
SendMessageW.USER32 ref: 000000014009737B
SetLastError.KERNEL32 ref: 0000000140097383
SetWindowLongW.USER32 ref: 0000000140097394
GetLastError.KERNEL32 ref: 000000014009739E
GetWindowLongW.USER32 ref: 00000001400973B0
GetWindowLongW.USER32 ref: 00000001400973D1
SetLastError.KERNEL32 ref: 00000001400973FB
SetWindowLongW.USER32 ref: 000000014009740C
GetLastError.KERNEL32 ref: 0000000140097416
GetWindowLongW.USER32 ref: 0000000140097428
SendMessageW.USER32 ref: 000000014009745B
SendMessageW.USER32 ref: 0000000140097485
SendMessageW.USER32 ref: 0000000140097499

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: MessageSend$Window$Long$ErrorLast$Rect
String ID:
API String ID: 986955251-0
Opcode ID: 4a14f5c41efe0c57633b2c806eb334a5605a47c4c3e6f15bda656988a7c1f97f
Instruction ID: dd2a31af02820dca9a610a7f5b560f02d7c7d334e36579c06d81f3cd7b362529
Opcode Fuzzy Hash: 4a14f5c41efe0c57633b2c806eb334a5605a47c4c3e6f15bda656988a7c1f97f
Instruction Fuzzy Hash: 4671923361494182F7628B6AD454FEA2390E78DBE4F665211FF5A83AF4DF39C8848740

Function 0000000140057400 Relevance: 26.8, APIs: 10, Strings: 5, Instructions: 542COMMON

Download Yara Rule

APIs

wcsncpy.LIBCMT ref: 000000014005748D
wcsncpy.LIBCMT ref: 00000001400574AD
wcsncpy.LIBCMT ref: 00000001400574D0
DialogBoxParamW.USER32 ref: 0000000140057662

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 0000000140057767, 0000000140057A64
The InputBox window could not be displayed., xrefs: 00000001400579B1
AutoHotkey v1.1.37.02, xrefs: 000000014005747B
Out of memory., xrefs: 0000000140057989, 0000000140057CA9
The maximum number of InputBoxes has been reached., xrefs: 000000014005742E

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: wcsncpy$DialogParam
String ID: AutoHotkey v1.1.37.02$Memory limit reached (see #MaxMem in the help file).$Out of memory.$The InputBox window could not be displayed.$The maximum number of InputBoxes has been reached.
API String ID: 403427445-39691387
Opcode ID: 058d6deef732e5c9f85a9b2543fb250d95a53723d8f41ce6236cfc5ec9fcf558
Instruction ID: 47aa7d7e0f20c3c3fb7e886d0339fb474e8df69cbe4799195574a573751f1847
Opcode Fuzzy Hash: 058d6deef732e5c9f85a9b2543fb250d95a53723d8f41ce6236cfc5ec9fcf558
Instruction Fuzzy Hash: 3932F072604A8485FB27DB22F014BE963A2E74DBD4F544216EB5E177F8DB3AC841E348

Function 00000001400B12E0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 119clipboardmemoryCOMMON

Download Yara Rule

APIs

EmptyClipboard.USER32(?,?,?,?,00000000,?), ref: 00000001400B1336
GlobalAlloc.KERNEL32(?,?,?,?,00000000,?), ref: 00000001400B1386
GlobalLock.KERNEL32 ref: 00000001400B13A0
GlobalUnlock.KERNEL32 ref: 00000001400B13C0
SetClipboardData.USER32 ref: 00000001400B13CF
GlobalUnlock.KERNEL32 ref: 00000001400B13FB
CloseClipboard.USER32(?,?,?,?,00000000,?), ref: 00000001400B1408

Strings

GlobalLock, xrefs: 00000001400B148B
Can't open clipboard for writing., xrefs: 00000001400B1304
Out of memory., xrefs: 00000001400B14E1

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Global$Clipboard$Unlock$AllocCloseDataEmptyLock
String ID: Can't open clipboard for writing.$GlobalLock$Out of memory.
API String ID: 3906930916-2567692066
Opcode ID: 5477054b1ee72a468c1515e5d367db1430e7065205917cf1f915a336e4a14905
Instruction ID: 5f495e8a53ffb7fe39243be73deebc53c09a7f67f6972764e21802068eda5bf1
Opcode Fuzzy Hash: 5477054b1ee72a468c1515e5d367db1430e7065205917cf1f915a336e4a14905
Instruction Fuzzy Hash: DE512636202B4181EA169F53B9847E963B4FB8DFE5F980015EB492BA78DB7CC984C740

Function 00000001400A02F0 Relevance: 24.5, APIs: 2, Strings: 14, Instructions: 482COMMON

Download Yara Rule

Strings

Menu name too long., xrefs: 00000001400A0D8E
Submenu does not exist., xrefs: 00000001400A10CA
Nonexistent menu item., xrefs: 00000001400A0CD7
Too many menu items., xrefs: 00000001400A11A6
Submenu must not contain its parent menu., xrefs: 00000001400A10F9
Menu item name too long., xrefs: 00000001400A11EF
Memory limit reached (see #MaxMem in the help file)., xrefs: 00000001400A03BB
, xrefs: 00000001400A0479
Parameter #3 must not be blank in this case., xrefs: 00000001400A0FEB
tray, xrefs: 00000001400A0615
Parameter #2 invalid., xrefs: 00000001400A05C0
Target label does not exist., xrefs: 00000001400A115F
Menu does not exist., xrefs: 00000001400A0D5A
Out of memory., xrefs: 00000001400A05FC

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID:
String ID: $Memory limit reached (see #MaxMem in the help file).$Menu does not exist.$Menu item name too long.$Menu name too long.$Nonexistent menu item.$Out of memory.$Parameter #2 invalid.$Parameter #3 must not be blank in this case.$Submenu does not exist.$Submenu must not contain its parent menu.$Target label does not exist.$Too many menu items.$tray
API String ID: 0-887232450
Opcode ID: e00901725a639cf25e5e0b2961d1850ec99df1f92d94468ef944f22abcd0578c
Instruction ID: 94d3eb00d3b92ccf6201390e56d394bde4ad131b7cf5417d1340fe69b6120a1f
Opcode Fuzzy Hash: e00901725a639cf25e5e0b2961d1850ec99df1f92d94468ef944f22abcd0578c
Instruction Fuzzy Hash: A512C172604B8486EA67DB13A4103EA63A1B7ADBD4F444312FF8917BB9DB78D5C5CB00

Function 000000014005A440 Relevance: 23.7, APIs: 8, Strings: 5, Instructions: 939COMMON

Download Yara Rule

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 000000014005A96D, 000000014005ACC8, 000000014005B01E
, xrefs: 000000014005B0E8
, xrefs: 000000014005AA2C
Out of memory., xrefs: 000000014005AC00, 000000014005AED3, 000000014005B270
, xrefs: 000000014005AD86

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID:
String ID: $ $ $Memory limit reached (see #MaxMem in the help file).$Out of memory.
API String ID: 0-1407833225
Opcode ID: 2393a578187edcca432e6b3d46f40448de4afeaad80a1efcdbd39f1829826e43
Instruction ID: 7f564e3d5df9fb7a6caab6b89f2b87df36e4684ed0c6316d15f0fe698d28a268
Opcode Fuzzy Hash: 2393a578187edcca432e6b3d46f40448de4afeaad80a1efcdbd39f1829826e43
Instruction Fuzzy Hash: 5292DE72606A8485FB67DB23D0143EA27A2E74EBD4F594112FB4A0B6F5DB3EC885C340

Function 000000014006D160 Relevance: 23.3, APIs: 1, Strings: 12, Instructions: 580COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400CA93C: _errno.LIBCMT ref: 00000001400CA954
Part of subcall function 00000001400CA93C: _invalid_parameter_noinfo.LIBCMT ref: 00000001400CA95F

_itow.LIBCMT ref: 000000014006D8F8

Strings

ERCP, xrefs: 000000014006D254
PCRE, xrefs: 000000014006D25D
ERCP, xrefs: 000000014006D1E7
Pos%d, xrefs: 000000014006D5EA
ERCP, xrefs: 000000014006D220
Len%d, xrefs: 000000014006D678
Len%s, xrefs: 000000014006D4F9
ERCP, xrefs: 000000014006D1AB
PCRE, xrefs: 000000014006D1F0
PCRE, xrefs: 000000014006D229
PCRE, xrefs: 000000014006D1B4
Pos%s, xrefs: 000000014006D460

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo_itow
String ID: ERCP$ERCP$ERCP$ERCP$Len%d$Len%s$PCRE$PCRE$PCRE$PCRE$Pos%d$Pos%s
API String ID: 331763463-1878916919
Opcode ID: af2e78a512d21fd14fe0beccadae663071b853843c225cf57d34ecaf11e4a81e
Instruction ID: ae0648f5d52ffd2d2203050f8f09539fdbe47e61e13668fb72b5f01ed14406f1
Opcode Fuzzy Hash: af2e78a512d21fd14fe0beccadae663071b853843c225cf57d34ecaf11e4a81e
Instruction Fuzzy Hash: 4C329072601A818AEB66CF26D8547EC37A2F74C7D8F544916FB4D4BBA9EB34CA44C700

Function 000000014005F450 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 123COMMON

Download Yara Rule

APIs

wcsncpy.LIBCMT ref: 000000014005F4A9
SetVolumeLabelW.KERNEL32 ref: 000000014005F4F4
mciSendStringW.WINMM ref: 000000014005F582
mciSendStringW.WINMM ref: 000000014005F5B8
mciSendStringW.WINMM ref: 000000014005F602
mciSendStringW.WINMM ref: 000000014005F619

Strings

closed, xrefs: 000000014005F54A, 000000014005F5CA
close cd wait, xrefs: 000000014005F608
set cdaudio door %s wait, xrefs: 000000014005F55F
\, xrefs: 000000014005F4D1
set cd door %s wait, xrefs: 000000014005F5DB
open, xrefs: 000000014005F554, 000000014005F5D1
open %s type cdaudio alias cd wait shareable, xrefs: 000000014005F592

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: SendString$LabelVolumewcsncpy
String ID: \$close cd wait$closed$open$open %s type cdaudio alias cd wait shareable$set cd door %s wait$set cdaudio door %s wait
API String ID: 2486362098-1210049163
Opcode ID: 2b05aac162f55ea902263f406af139a35e42c78ef8e7101250fb7ed9650bfc42
Instruction ID: ddfeba876d40e27839f482eafa708575b5b3b69fa3fa457b6cd1fb0b3a49813f
Opcode Fuzzy Hash: 2b05aac162f55ea902263f406af139a35e42c78ef8e7101250fb7ed9650bfc42
Instruction Fuzzy Hash: 1241FE3121464481FB22DB73A854BEA2250FB9CBD4F804512FB4A979F5EF3DCA86DB40

Function 0000000140097237 Relevance: 22.6, APIs: 15, Instructions: 147windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 000000014009724E
SendMessageW.USER32 ref: 0000000140097288
SendMessageW.USER32 ref: 00000001400972C8
SendMessageW.USER32 ref: 0000000140097305
GetWindowRect.USER32 ref: 0000000140097332
SendMessageW.USER32 ref: 000000014009737B
SetLastError.KERNEL32 ref: 0000000140097383
SetWindowLongW.USER32 ref: 0000000140097394
GetLastError.KERNEL32 ref: 000000014009739E
GetWindowLongW.USER32 ref: 00000001400973B0
GetWindowLongW.USER32 ref: 00000001400973D1
SetLastError.KERNEL32 ref: 00000001400973FB
SetWindowLongW.USER32 ref: 000000014009740C
GetLastError.KERNEL32 ref: 0000000140097416
GetWindowLongW.USER32 ref: 0000000140097428
SendMessageW.USER32 ref: 000000014009745B
SendMessageW.USER32 ref: 0000000140097485
SendMessageW.USER32 ref: 0000000140097499

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: MessageSend$Window$Long$ErrorLast$Rect
String ID:
API String ID: 986955251-0
Opcode ID: 22ff196be06b8f920bad6c8addaecbcccfe3a07d3f514e16312c04aaf3b62738
Instruction ID: 18b9c8419a3c7512c655e07643af5975125c7ebbb78fc95ee74ba05df36d2fe0
Opcode Fuzzy Hash: 22ff196be06b8f920bad6c8addaecbcccfe3a07d3f514e16312c04aaf3b62738
Instruction Fuzzy Hash: CD51B33760495082F762877BD454FAA23D0A78D7E1F669201FFAA83AF0DF38C8848750

Function 00000001400751E0 Relevance: 21.4, APIs: 6, Strings: 6, Instructions: 417windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 0000000140075591
SendMessageW.USER32 ref: 000000014007563C

Part of subcall function 00000001400CAB94: _errno.LIBCMT ref: 00000001400CABB2
Part of subcall function 00000001400CAB94: _invalid_parameter_noinfo.LIBCMT ref: 00000001400CABBD

SendMessageW.USER32 ref: 000000014007567F

Part of subcall function 00000001400CA93C: _errno.LIBCMT ref: 00000001400CA954
Part of subcall function 00000001400CA93C: _invalid_parameter_noinfo.LIBCMT ref: 00000001400CA95F

SendMessageW.USER32 ref: 00000001400756AD
SendMessageW.USER32 ref: 0000000140075796
SendMessageW.USER32 ref: 0000000140075813

Strings

Col, xrefs: 00000001400754A5
Vis, xrefs: 0000000140075517
Check, xrefs: 0000000140075449
Select, xrefs: 00000001400753B3
Icon, xrefs: 00000001400754E3
Focus, xrefs: 00000001400753FE

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: MessageSend$_errno_invalid_parameter_noinfo
String ID: Check$Col$Focus$Icon$Select$Vis
API String ID: 4293396861-2776904722
Opcode ID: 6196bfaf0f949b3e9e33ac2e49bc5d9a296451d121b6d7bb2fcd0768d5a463c9
Instruction ID: 219f4e7ba34ec2fa69aa4cbce338524cf86e7c235219485c154c753eea380c88
Opcode Fuzzy Hash: 6196bfaf0f949b3e9e33ac2e49bc5d9a296451d121b6d7bb2fcd0768d5a463c9
Instruction Fuzzy Hash: F602A03260468086EB66AF27E5003EA77A1F78CBD9F548115FF4947AB9DBBCC941CB00

Function 0000000140097200 Relevance: 21.1, APIs: 14, Instructions: 144windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 0000000140097288
SendMessageW.USER32 ref: 0000000140097305
SetLastError.KERNEL32 ref: 0000000140097383
SetWindowLongW.USER32 ref: 0000000140097394
GetLastError.KERNEL32 ref: 000000014009739E
GetWindowLongW.USER32 ref: 00000001400973B0
GetWindowLongW.USER32 ref: 00000001400973D1
SetLastError.KERNEL32 ref: 00000001400973FB
SetWindowLongW.USER32 ref: 000000014009740C
GetLastError.KERNEL32 ref: 0000000140097416
GetWindowLongW.USER32 ref: 0000000140097428
SendMessageW.USER32 ref: 000000014009745B

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: LongWindow$ErrorLast$MessageSend
String ID:
API String ID: 3883446408-0
Opcode ID: 3bfdb41cdc8b1dfc31b7be44f9caa48db5b207ad1402d45fea5cf34dbae02090
Instruction ID: 96a37cbea5e61ff72190d4c3eed1f997b3b7708ff1a59391635f4f99a79de3c9
Opcode Fuzzy Hash: 3bfdb41cdc8b1dfc31b7be44f9caa48db5b207ad1402d45fea5cf34dbae02090
Instruction Fuzzy Hash: BD51D63760494082F7A28777D454FEA22D4A78D7E4F669201FFAA83AF0DF38C8849750

Function 0000000140097221 Relevance: 21.1, APIs: 14, Instructions: 142windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 0000000140097288
SendMessageW.USER32 ref: 0000000140097305
SetLastError.KERNEL32 ref: 0000000140097383
SetWindowLongW.USER32 ref: 0000000140097394
GetLastError.KERNEL32 ref: 000000014009739E
GetWindowLongW.USER32 ref: 00000001400973B0
GetWindowLongW.USER32 ref: 00000001400973D1
SetLastError.KERNEL32 ref: 00000001400973FB
SetWindowLongW.USER32 ref: 000000014009740C
GetLastError.KERNEL32 ref: 0000000140097416
GetWindowLongW.USER32 ref: 0000000140097428
SendMessageW.USER32 ref: 000000014009745B

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: LongWindow$ErrorLast$MessageSend
String ID:
API String ID: 3883446408-0
Opcode ID: 24723276136957833ac007c395f314dd127c39ac74bf7ec40bc7df2bf39718f1
Instruction ID: 2754cca556b3536d3700448921addf3c9900b824467f58221637dfbb16206945
Opcode Fuzzy Hash: 24723276136957833ac007c395f314dd127c39ac74bf7ec40bc7df2bf39718f1
Instruction Fuzzy Hash: F051C33760495082F762877BD455FEA26D0A79D7E0F669201FFAA83AF0DF38C8849750

Function 000000014009712B Relevance: 21.1, APIs: 14, Instructions: 139windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 0000000140097288
SendMessageW.USER32 ref: 00000001400972C8
SendMessageW.USER32 ref: 0000000140097305
GetWindowRect.USER32 ref: 0000000140097332
SendMessageW.USER32 ref: 000000014009737B
SetLastError.KERNEL32 ref: 0000000140097383
SetWindowLongW.USER32 ref: 0000000140097394
GetLastError.KERNEL32 ref: 000000014009739E
GetWindowLongW.USER32 ref: 00000001400973B0
GetWindowLongW.USER32 ref: 00000001400973D1
SetLastError.KERNEL32 ref: 00000001400973FB
SetWindowLongW.USER32 ref: 000000014009740C
GetLastError.KERNEL32 ref: 0000000140097416
GetWindowLongW.USER32 ref: 0000000140097428
SendMessageW.USER32 ref: 000000014009745B
SendMessageW.USER32 ref: 0000000140097485
SendMessageW.USER32 ref: 0000000140097499

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: MessageSend$Window$Long$ErrorLast$Rect
String ID:
API String ID: 986955251-0
Opcode ID: fae43b30a415d1e3a86d5332e9111596ee3c8ff00aa3f6295ace6cb6b03df076
Instruction ID: f8b6d5fc0b509c9229ce332ab147e6b7e4d86b4396fd3b42422c88260dfbc63b
Opcode Fuzzy Hash: fae43b30a415d1e3a86d5332e9111596ee3c8ff00aa3f6295ace6cb6b03df076
Instruction Fuzzy Hash: 6251B33760495082F7A28777D454FEA22D4A78D7E4F669201FF9A83AF0EF38C8849750

Function 0000000140097139 Relevance: 21.1, APIs: 14, Instructions: 137windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 0000000140097288
SendMessageW.USER32 ref: 00000001400972C8
SendMessageW.USER32 ref: 0000000140097305
GetWindowRect.USER32 ref: 0000000140097332
SendMessageW.USER32 ref: 000000014009737B
SetLastError.KERNEL32 ref: 0000000140097383
SetWindowLongW.USER32 ref: 0000000140097394
GetLastError.KERNEL32 ref: 000000014009739E
GetWindowLongW.USER32 ref: 00000001400973B0
GetWindowLongW.USER32 ref: 00000001400973D1
SetLastError.KERNEL32 ref: 00000001400973FB
SetWindowLongW.USER32 ref: 000000014009740C
GetLastError.KERNEL32 ref: 0000000140097416
GetWindowLongW.USER32 ref: 0000000140097428
SendMessageW.USER32 ref: 000000014009745B
SendMessageW.USER32 ref: 0000000140097485
SendMessageW.USER32 ref: 0000000140097499

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: MessageSend$Window$Long$ErrorLast$Rect
String ID:
API String ID: 986955251-0
Opcode ID: 061dbbea7afb87abea976c5d78eb11b606a230fec3e4f43b919c51ad8393ceab
Instruction ID: bcf726da935bf662f5fbfa16621ebb5425d57e8ac3ab675bf1d05344e65fdcce
Opcode Fuzzy Hash: 061dbbea7afb87abea976c5d78eb11b606a230fec3e4f43b919c51ad8393ceab
Instruction Fuzzy Hash: E451B33760495082F7628777D454FEA22D4A78D7E4F669201FF9A83AF0DF38C8849750

Function 0000000140097219 Relevance: 21.1, APIs: 14, Instructions: 137windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 0000000140097288
SendMessageW.USER32 ref: 00000001400972C8
SendMessageW.USER32 ref: 0000000140097305
GetWindowRect.USER32 ref: 0000000140097332
SendMessageW.USER32 ref: 000000014009737B
SetLastError.KERNEL32 ref: 0000000140097383
SetWindowLongW.USER32 ref: 0000000140097394
GetLastError.KERNEL32 ref: 000000014009739E
GetWindowLongW.USER32 ref: 00000001400973B0
GetWindowLongW.USER32 ref: 00000001400973D1
SetLastError.KERNEL32 ref: 00000001400973FB
SetWindowLongW.USER32 ref: 000000014009740C
GetLastError.KERNEL32 ref: 0000000140097416
GetWindowLongW.USER32 ref: 0000000140097428
SendMessageW.USER32 ref: 000000014009745B
SendMessageW.USER32 ref: 0000000140097485
SendMessageW.USER32 ref: 0000000140097499

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: MessageSend$Window$Long$ErrorLast$Rect
String ID:
API String ID: 986955251-0
Opcode ID: e19550fe67db181aeb470707920506b65ae695e47400da7eb5c08a9a8c94b327
Instruction ID: 1df80e03fba35d513f2974025de2bfafa9bc9c2328690894e8429a780e39faa9
Opcode Fuzzy Hash: e19550fe67db181aeb470707920506b65ae695e47400da7eb5c08a9a8c94b327
Instruction Fuzzy Hash: 0A51B33760495082F7628777D454FEA22D4A78D7E4F669201FFAA83AF0EF38C8849750

Function 0000000140017240 Relevance: 19.9, APIs: 13, Instructions: 363threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000000014001728F

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 2368e6e2beea2748245229d6f63b1074d97eb7c61fae3b98091d0fc456dafc55
Instruction ID: d16959d0936be5cddac07b6c47536e7fcb1159c0c4d36ed28bd6f08170dce804
Opcode Fuzzy Hash: 2368e6e2beea2748245229d6f63b1074d97eb7c61fae3b98091d0fc456dafc55
Instruction Fuzzy Hash: 6DF1C0321186908AF76B8B27A444BE93AF1F74D798F544116FB8A0BAF5CB3EC844D711

Function 000000014008E1E0 Relevance: 19.8, APIs: 9, Strings: 2, Instructions: 506COMMON

Download Yara Rule

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 000000014008E364, 000000014008ECC3
Out of memory., xrefs: 000000014008E61F, 000000014008F110, 000000014008F120

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID:
String ID: Memory limit reached (see #MaxMem in the help file).$Out of memory.
API String ID: 0-457448710
Opcode ID: 12232ada3b8d623f987c6ca85692442ef7fd75572e59ac8aca0b6975a51bee98
Instruction ID: 0bca324407d045662cd63ac92765200540e1d4394f93a57ec394a406a546441d
Opcode Fuzzy Hash: 12232ada3b8d623f987c6ca85692442ef7fd75572e59ac8aca0b6975a51bee98
Instruction Fuzzy Hash: 0E32BE33204B8081EB27CB27E4447EA67A1F74DBD8F545212EB5A17BB5EB38C696D700

Function 00000001400993D0 Relevance: 18.0, APIs: 6, Strings: 4, Instructions: 453COMMON

Download Yara Rule

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 000000014009ACF0
Text, xrefs: 0000000140099F17
Submit, xrefs: 00000001400993FC
Out of memory., xrefs: 000000014009AF01

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: Memory limit reached (see #MaxMem in the help file).$Out of memory.$Submit$Text
API String ID: 2959964966-2602533059
Opcode ID: a4f5612e0c03c7cc6acded0b8ad398a76075edf0ac57e18db0b15bcf24eced0a
Instruction ID: 97a7e9a50630956f72d39171c059fbfd4cf4572b18903744004427e0363890a8
Opcode Fuzzy Hash: a4f5612e0c03c7cc6acded0b8ad398a76075edf0ac57e18db0b15bcf24eced0a
Instruction Fuzzy Hash: F112EF72209B8081EB26DB26D5543EE67A1FB4EBE4F558212FB5A077F9DB38C445C380

Function 00000001400672D0 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 283timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 0000000140067314
GetLastError.KERNEL32 ref: 0000000140067320
FindClose.KERNEL32 ref: 0000000140067340
FileTimeToLocalFileTime.KERNEL32 ref: 0000000140067388
FileTimeToSystemTime.KERNEL32 ref: 00000001400673C0

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 00000001400674BF
%04d%02d%02d%02d%02d%02d, xrefs: 00000001400673F6
Out of memory., xrefs: 00000001400676FD

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: FileTime$Find$CloseErrorFirstLastLocalSystem
String ID: %04d%02d%02d%02d%02d%02d$Memory limit reached (see #MaxMem in the help file).$Out of memory.
API String ID: 3800350769-3698116793
Opcode ID: f3713e2c57f3e66316d76b69488437579b00b003424ee968ee0f96ab75fec5c3
Instruction ID: 8c6f25a595f206b9dc050db86c14bab021700c033f59c415a096e0aecec4a942
Opcode Fuzzy Hash: f3713e2c57f3e66316d76b69488437579b00b003424ee968ee0f96ab75fec5c3
Instruction Fuzzy Hash: 35C1C272204B4085EB669B26E8047E963A2F74DBE8F604612FB5E077F9DB78C985C740

Function 00000001400BE0C0 Relevance: 17.2, Strings: 13, Instructions: 941COMMON

Download Yara Rule

Strings

NO_START_OPT), xrefs: 00000001400BE2AA
CRLF), xrefs: 00000001400BE3CD
ANY), xrefs: 00000001400BE43B
Error text not found (please report), xrefs: 00000001400BEE98
ANYCRLF), xrefs: 00000001400BE49D
LF), xrefs: 00000001400BE36B
UCP), xrefs: 00000001400BE24D
UTF16), xrefs: 00000001400BE1EA
CR), xrefs: 00000001400BE2FE
$, xrefs: 00000001400BECB7
BSR_UNICODE), xrefs: 00000001400BE550
no error, xrefs: 00000001400BEE6F
BSR_ANYCRLF), xrefs: 00000001400BE50B

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID:
String ID: $$ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$Error text not found (please report)$LF)$NO_START_OPT)$UCP)$UTF16)$no error
API String ID: 0-3688278424
Opcode ID: 33d343a0d8d9eb0a9fab28d6d21af677664b37192003fe34fcf9508b46e49389
Instruction ID: f6a331eb084333d806aee9149bdeeb885d6ea38ec262f3a354d7ea3ccd50694f
Opcode Fuzzy Hash: 33d343a0d8d9eb0a9fab28d6d21af677664b37192003fe34fcf9508b46e49389
Instruction Fuzzy Hash: CB829C72614B908AE766CFA6D4403EE3BF4F758798F504126FB498B7A4EB78C944CB00

Function 000000014005D3B0 Relevance: 16.3, APIs: 6, Strings: 3, Instructions: 562COMMON

Download Yara Rule

APIs

_wcstoi64.LIBCMT ref: 000000014005DAE6

Part of subcall function 00000001400B1E90: malloc.LIBCMT ref: 00000001400B1EB3

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 000000014005D4F0, 000000014005D7E9
, xrefs: 000000014005D5D3
Out of memory., xrefs: 000000014005D75A, 000000014005DB1E

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: _wcstoi64malloc
String ID: $Memory limit reached (see #MaxMem in the help file).$Out of memory.
API String ID: 4111414685-1193006554
Opcode ID: cdbae4f3ce25a9a4cce6ed508733af80f1213151cac81626803f5e2c3bf69721
Instruction ID: 3e5d3eba2846e0de6a201ff80701ddb959896699979624e8650980289ce5c2fd
Opcode Fuzzy Hash: cdbae4f3ce25a9a4cce6ed508733af80f1213151cac81626803f5e2c3bf69721
Instruction Fuzzy Hash: 4E32BC72604B8486EB76DB26D5143EA73A2F74CBD8F594203EB5A077E9DB3AC845C340

Function 00000001400110D0 Relevance: 16.3, APIs: 5, Strings: 4, Instructions: 555COMMON

Download Yara Rule

APIs

GetKeyboardLayout.USER32 ref: 0000000140011198

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 000000014001126C, 0000000140011609
"%s" is not a valid key name., xrefs: 000000014001186C
"%s" is not allowed as a prefix key., xrefs: 0000000140011491
Out of memory., xrefs: 000000014001146D, 000000014001147D, 0000000140011825

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: KeyboardLayout
String ID: "%s" is not a valid key name.$"%s" is not allowed as a prefix key.$Memory limit reached (see #MaxMem in the help file).$Out of memory.
API String ID: 194098044-3611355349
Opcode ID: 3622fd0739d8be3aff94471d87839d543190a132c98ca22be4e72d4503e9cc8b
Instruction ID: 95249991710123cf20388be561c76b02cf063fc6c899445c4c1649df59cbb59c
Opcode Fuzzy Hash: 3622fd0739d8be3aff94471d87839d543190a132c98ca22be4e72d4503e9cc8b
Instruction Fuzzy Hash: 3332E232204A5192FB6B9B27D1103E963A1F79D7D8F884512FB5A0FAF6DB3AC595C300

Function 00000001400570D0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00000001400571ED
IsWindowVisible.USER32 ref: 00000001400571FA
ShowWindow.USER32(?,0000000140037B6E), ref: 000000014005720E
IsIconic.USER32 ref: 000000014005721B
ShowWindow.USER32(?,0000000140037B6E), ref: 0000000140057231
GetForegroundWindow.USER32(?,0000000140037B6E), ref: 0000000140057237
SetForegroundWindow.USER32(?,0000000140037B6E), ref: 0000000140057249
SendMessageW.USER32 ref: 0000000140057279

Strings

Script info will not be shown because the "Menu, Tray, MainWindow"command option was not enabled in the original script., xrefs: 000000014005710C

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Window$ForegroundMessageSendShow$IconicVisible
String ID: Script info will not be shown because the "Menu, Tray, MainWindow"command option was not enabled in the original script.
API String ID: 631031280-1556141417
Opcode ID: 79fe8a5b091500552ebc8169623915eb08e2c14fdec9d382d513c9221960e628
Instruction ID: b7d9f164e73cfbf817a1132ff8461a06a1203a6d2661dc15ef612809bc5fef06
Opcode Fuzzy Hash: 79fe8a5b091500552ebc8169623915eb08e2c14fdec9d382d513c9221960e628
Instruction Fuzzy Hash: C3515E3122494081FA77DB5BF850BE922A0FB9C7D4F840025FB4E479F6DA3AC944AB49

Function 000000014009D420 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 307COMMON

Download Yara Rule

APIs

wcsncpy.LIBCMT ref: 000000014009D51D

Part of subcall function 0000000140004980: SetCurrentDirectoryW.KERNEL32 ref: 0000000140004A20

GetTickCount.KERNEL32 ref: 000000014009D83D
free.LIBCMT ref: 000000014009D8F7

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 000000014009D5CF
Out of memory., xrefs: 000000014009D7E2
call, xrefs: 000000014009D89E

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountCurrentDirectoryTickfreewcsncpy
String ID: Memory limit reached (see #MaxMem in the help file).$Out of memory.$call
API String ID: 782406583-3963558559
Opcode ID: f102e685979a01a8e33d2449d977a07489cbf06aeee870abef9322bdebf746bd
Instruction ID: b714db8ed9f80be2baa0864a130e15b997dd5fee670f11c2dd3be97bebb24934
Opcode Fuzzy Hash: f102e685979a01a8e33d2449d977a07489cbf06aeee870abef9322bdebf746bd
Instruction Fuzzy Hash: 63E19D72248B8082EB62DB26E4443E9B3A1F79CBD4F554117EB9E477B9EB38C481C740

Function 00000001400201C3 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 309timeCOMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNEL32 ref: 0000000140020317
GetSystemTimeAsFileTime.KERNEL32 ref: 0000000140020672

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 0000000140020482
ErrorLevel, xrefs: 00000001400203D5
Out of memory., xrefs: 00000001400206AA

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Time$CurrentDirectoryFileSystem
String ID: ErrorLevel$Memory limit reached (see #MaxMem in the help file).$Out of memory.
API String ID: 2903961910-844184505
Opcode ID: 2810ee7d07e3f91f7d7af5e877f731afefc6c27dea3b98fccd464bed97545885
Instruction ID: 9e3cb2f553ede8efab173d78332db090ae6bd55484888d087a95391fc8f66fe9
Opcode Fuzzy Hash: 2810ee7d07e3f91f7d7af5e877f731afefc6c27dea3b98fccd464bed97545885
Instruction Fuzzy Hash: 56E19C71201B5482FB669B27E4987E963A1F78CBD8F48411AEF4E1B7B6DB78C841C700

Function 0000000140063180 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 298COMMON

Download Yara Rule

APIs

_wcstoi64.LIBCMT ref: 00000001400631F0
waveOutSetVolume.WINMM ref: 00000001400632B9

Part of subcall function 0000000140062100: _wcstoi64.LIBCMT ref: 00000001400621A6
Part of subcall function 0000000140062100: CoCreateInstance.OLE32 ref: 0000000140062241

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 0000000140063368
Out of memory., xrefs: 00000001400635A3

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: _wcstoi64$CreateInstanceVolumewave
String ID: Memory limit reached (see #MaxMem in the help file).$Out of memory.
API String ID: 2637947298-457448710
Opcode ID: 22f65e08f296c3b0c8ca66a3cb99f585648a28a04bf4dc78fe5f64e552cab95a
Instruction ID: 8c19f16e6dc8ca844ad1d897f452bf0c76c17ee66a3d1f9c2780c1fe5e6c46cc
Opcode Fuzzy Hash: 22f65e08f296c3b0c8ca66a3cb99f585648a28a04bf4dc78fe5f64e552cab95a
Instruction Fuzzy Hash: 9BC1A572604B4182EB179B27E8103E9A792EB4DBD4F644A12FB5E577B5DB38C483C780

Function 00000001400D63D0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 288COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400CA794: _getptd.LIBCMT ref: 00000001400CA7A6

_errno.LIBCMT ref: 00000001400D6420
_invalid_parameter_noinfo.LIBCMT ref: 00000001400D642A
_errno.LIBCMT ref: 00000001400D644C
_invalid_parameter_noinfo.LIBCMT ref: 00000001400D6458
_errno.LIBCMT ref: 00000001400D6480
_cftoe_l.LIBCMT ref: 00000001400D64C4

Strings

gfffffff, xrefs: 00000001400D674F

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo$_cftoe_l_getptd
String ID: gfffffff
API String ID: 1282097019-1523873471
Opcode ID: 8bfec8f4effaedea1a1cb1219e30dd48b273e96fc3afd06b771b3d8695ea29a2
Instruction ID: cc0ceb34bfd40c70bfadf2dc8b1a449d2b21289b3b5e9ac471473ca9f7151275
Opcode Fuzzy Hash: 8bfec8f4effaedea1a1cb1219e30dd48b273e96fc3afd06b771b3d8695ea29a2
Instruction Fuzzy Hash: 27B166737087C886EB12CB36D6453DD6BA5EB197D8F048621EF59077EAEA38D416C320

Function 000000014003F1C0 Relevance: 12.4, APIs: 4, Strings: 4, Instructions: 353COMMON

Download Yara Rule

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 000000014003F268
, xrefs: 000000014003F5D1
, xrefs: 000000014003F331
Out of memory., xrefs: 000000014003F490

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID:
String ID: $ $Memory limit reached (see #MaxMem in the help file).$Out of memory.
API String ID: 0-4280895764
Opcode ID: ed83b2958b0e83fe6cd725dade945639a77b351f2e6ad5f48bc1eae467f1a0a1
Instruction ID: 7c034145604c88201603fcd7dc4384495e66ce72dab27bffb086c87cb70081f4
Opcode Fuzzy Hash: ed83b2958b0e83fe6cd725dade945639a77b351f2e6ad5f48bc1eae467f1a0a1
Instruction Fuzzy Hash: A2E1EF72204A4096FA67AB23E5113FB63A1FB5D7D0F484612FB9A1B6F1DB78C491E340

Function 00000001400501F8 Relevance: 10.9, APIs: 4, Strings: 3, Instructions: 436COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 00000001400507E5
malloc.LIBCMT ref: 00000001400507F7

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 000000014005028A, 0000000140050646
%s1, xrefs: 0000000140050503
Out of memory., xrefs: 00000001400504B2, 0000000140050865

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: freemalloc
String ID: %s1$Memory limit reached (see #MaxMem in the help file).$Out of memory.
API String ID: 3061335427-3843752144
Opcode ID: 3f514d22eca492697ad6796379104b0b282f18c79c99a9e2c4bc0dc7031427ad
Instruction ID: 317b041f9b34c7787d65f0f4b9d2edcbe05b9ff6930c8689c2c7ba1a9f14de7f
Opcode Fuzzy Hash: 3f514d22eca492697ad6796379104b0b282f18c79c99a9e2c4bc0dc7031427ad
Instruction Fuzzy Hash: 1512FE72604A4482FB63DF22D1153EE63A1B74DBD8F584512FB4A172F5EB7AC981C780

Function 000000014005B290 Relevance: 10.8, APIs: 3, Strings: 4, Instructions: 350COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 000000014005B3B3

Part of subcall function 00000001400B1BB0: free.LIBCMT ref: 00000001400B1C50

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 000000014005B585
UseErrorLevel, xrefs: 000000014005B2C6
1aA, xrefs: 000000014005B300
Out of memory., xrefs: 000000014005B42F, 000000014005B7AF

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: free
String ID: 1aA$Memory limit reached (see #MaxMem in the help file).$Out of memory.$UseErrorLevel
API String ID: 1294909896-1816934842
Opcode ID: 9d9844013896876395a003a2e1cf17a0860c7db06111750f4c8d9c7cd6d04c20
Instruction ID: 21af7aa01a4d1a9cdf9ae0d0eb3ca1d2f56a7247cfe29225193f22a2f569d97e
Opcode Fuzzy Hash: 9d9844013896876395a003a2e1cf17a0860c7db06111750f4c8d9c7cd6d04c20
Instruction Fuzzy Hash: 29E1FF72208B94C1EB27DB2791513E967A1FB8CBE4F444202FB99176F6DB39E841C340

Function 00000001400393D9 Relevance: 9.5, APIs: 2, Strings: 4, Instructions: 512COMMON

Download Yara Rule

Strings

., xrefs: 00000001400395FD
, xrefs: 0000000140039780
., xrefs: 0000000140039792
, xrefs: 00000001400395EA

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID:
String ID: $ $.$.
API String ID: 0-1066414380
Opcode ID: b28e865c725036669516a9e33d9ea9b827d3a689475c6b179583a32b18edcd6f
Instruction ID: ffcb88003b91ebe48f5864756d13e0f4571e1e71b80e62f9893ad62d76856b8a
Opcode Fuzzy Hash: b28e865c725036669516a9e33d9ea9b827d3a689475c6b179583a32b18edcd6f
Instruction Fuzzy Hash: ED129072A1565141FAB76B1B94513FB6391A79DBC0F848126FF9A47BF5EA38CC82C300

Function 000000014003A0A5 Relevance: 9.4, APIs: 2, Strings: 4, Instructions: 448COMMON

Download Yara Rule

Strings

, xrefs: 000000014003A344
, xrefs: 000000014003A1BA
., xrefs: 000000014003A35D
., xrefs: 000000014003A1CD

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: $ $.$.
API String ID: 2959964966-1066414380
Opcode ID: 9dbaa2750c01e854354486858f5dd62ce9b662767f66054c3fdfd5a84dd89eeb
Instruction ID: ddb0a5007798117db278d20b3b9832ae053dcee10a0c380da9f2785bbe707b2e
Opcode Fuzzy Hash: 9dbaa2750c01e854354486858f5dd62ce9b662767f66054c3fdfd5a84dd89eeb
Instruction Fuzzy Hash: EF029035A0165081FEBB5A1BA4513FB63D1A79FBC0F448026FF9A577F5EA3DC8828210

Function 000000014004C410 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 313windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140067BD0: GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,0000000140048B02), ref: 0000000140067C03
Part of subcall function 0000000140067BD0: IsWindowVisible.USER32 ref: 0000000140067C24

SendMessageTimeoutW.USER32 ref: 000000014004C48E

Part of subcall function 0000000140006150: GlobalAlloc.KERNEL32(?,?,?,00000001400060F5), ref: 0000000140006178

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 000000014004C559
Out of memory., xrefs: 000000014004C75E

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Window$AllocForegroundGlobalMessageSendTimeoutVisible
String ID: Memory limit reached (see #MaxMem in the help file).$Out of memory.
API String ID: 2992753689-457448710
Opcode ID: 4b8c11ff9414561d058b4d90c955651d97e8e0e3a6c8c8ccae2dd621bea36da5
Instruction ID: eeeb4a49b101f38dc8a859a60ff30b39799abdb97ff51e6c48fe8a822efb52b7
Opcode Fuzzy Hash: 4b8c11ff9414561d058b4d90c955651d97e8e0e3a6c8c8ccae2dd621bea36da5
Instruction Fuzzy Hash: 43D10172624B8082FBA78F23D104BE967A1A74DBD4F568225EF4D077F9DB38C8458708

Function 000000014004C070 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 240windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140067BD0: GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,0000000140048B02), ref: 0000000140067C03
Part of subcall function 0000000140067BD0: IsWindowVisible.USER32 ref: 0000000140067C24

SendMessageTimeoutW.USER32 ref: 000000014004C0ED

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 000000014004C1AF
Out of memory., xrefs: 000000014004C3E8

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Window$ForegroundMessageSendTimeoutVisible
String ID: Memory limit reached (see #MaxMem in the help file).$Out of memory.
API String ID: 578228273-457448710
Opcode ID: 206a8b320df605913402dee927e3fc4c34e1f148e2cd8900c12461ea67957036
Instruction ID: 87576be7f3668b39d699dab9602887bc1bb3fc6b238abe50dfbaf210042ebf74
Opcode Fuzzy Hash: 206a8b320df605913402dee927e3fc4c34e1f148e2cd8900c12461ea67957036
Instruction Fuzzy Hash: FFA12272614B4082EBA39F27E004BE963A1E74DBD8F558222FB4E177B9DA78C841C344

Function 000000014004A010 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 269COMMON

Download Yara Rule

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 000000014004A14A
ahk_parent, xrefs: 000000014004A054
Out of memory., xrefs: 000000014004A3BA

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Window$ForegroundVisible_errno_invalid_parameter_noinfo
String ID: Memory limit reached (see #MaxMem in the help file).$Out of memory.$ahk_parent
API String ID: 1550069138-3360053881
Opcode ID: cd926120bef3842384914a3d2408a64406e1e8dbdacc24a496c4a25c59385d21
Instruction ID: 05a3c042f1a00e0dd6de62e2c7af3eba40ef928d340a51d0751eb1e6144aff9c
Opcode Fuzzy Hash: cd926120bef3842384914a3d2408a64406e1e8dbdacc24a496c4a25c59385d21
Instruction Fuzzy Hash: 0AB1B072704B4081EB129F2BE4003E9A391E78EBD4F594122FF5D577A9EA7CC882C744

Function 00000001400D4140 Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000001400D4177
GetCurrentProcessId.KERNEL32 ref: 00000001400D4182
GetCurrentThreadId.KERNEL32 ref: 00000001400D418E
GetTickCount.KERNEL32 ref: 00000001400D419A
QueryPerformanceCounter.KERNEL32 ref: 00000001400D41AB

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 0970cab9c5be77d9a39cdc5d48b36c61e8207fb72ec45b32786bebe28e3c87fc
Instruction ID: 3af3064ba5592bf335494bce85be6d48570a468d73a99406de20778f5bec8ec9
Opcode Fuzzy Hash: 0970cab9c5be77d9a39cdc5d48b36c61e8207fb72ec45b32786bebe28e3c87fc
Instruction Fuzzy Hash: 9E016D36325A0086EB828F22E8443996360F74DBE0F446621EF9E57BB0DB38CDD58740

Function 00000001400AE180 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32 ref: 00000001400AE203
FindFirstFileW.KERNEL32 ref: 00000001400AE235
FindClose.KERNEL32 ref: 00000001400AE244

Strings

\\?\, xrefs: 00000001400AE1A6

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID: \\?\
API String ID: 48322524-4282027825
Opcode ID: d4e52f6d08b75a674ab8acda50374d4abab3f09d2fd8cf008a1539c545d14897
Instruction ID: 5059126414bbf14c0c8412e0e1d29896b2d441993a7729747f630cad7dae4bbc
Opcode Fuzzy Hash: d4e52f6d08b75a674ab8acda50374d4abab3f09d2fd8cf008a1539c545d14897
Instruction Fuzzy Hash: 9421C57660469181EF668F56E4443E923A1E768BE4F484320EF69076E4EB38CDC4CB00

Function 00000001400B4320 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00000001400B4343
GetProcAddress.KERNEL32 ref: 00000001400B4353

Strings

DwmGetWindowAttribute, xrefs: 00000001400B4349
dwmapi.dll, xrefs: 00000001400B4336

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: DwmGetWindowAttribute$dwmapi.dll
API String ID: 2574300362-1753671286
Opcode ID: 5c42b44d3bd11502840503fb3a9a7e556bde06c569d05dd72d793f96ad82625a
Instruction ID: 84c9776bb610b245565895121c5e0d34377812e601fbec750f1f3dc3743fab98
Opcode Fuzzy Hash: 5c42b44d3bd11502840503fb3a9a7e556bde06c569d05dd72d793f96ad82625a
Instruction Fuzzy Hash: EC014C72614F8186EF46CFE6B9803D977A0F78CB94F441425EB4A47A74EA38D685CB40

Function 0000000140017FF0 Relevance: 4.6, APIs: 3, Instructions: 140keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32 ref: 00000001400180E1
free.LIBCMT ref: 0000000140018225
BlockInput.USER32 ref: 0000000140018244

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: BlockInput$free
String ID:
API String ID: 984266599-0
Opcode ID: cc07ff5b0a7ab586d9090d4978c8951e65fb49b64582b6e74e059618cef89eee
Instruction ID: 589f30f9c845b92306a9957eca63cfad6c462d12bc7dc9edb27c3ca065958e4e
Opcode Fuzzy Hash: cc07ff5b0a7ab586d9090d4978c8951e65fb49b64582b6e74e059618cef89eee
Instruction Fuzzy Hash: 3361AB311082C48AE7BB8B17A8447EA7BA1F35D794F40411AEF954B6B5CB7DCA44CF10

Function 000000014001F420 Relevance: 4.6, APIs: 3, Instructions: 56clipboardwindowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32 ref: 000000014001F47F
SetClipboardViewer.USER32 ref: 000000014001F49D
ChangeClipboardChain.USER32 ref: 000000014001F4F9

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Clipboard$ChainChangeMessagePostViewer
String ID:
API String ID: 1822368796-0
Opcode ID: 4d2639be15d289644b7e00e38bf24626c38f1a4f6cbd3b3f866b6a4a7de71f6d
Instruction ID: 7af564547c66976fcf599a45886754f0e41598ee9a5c9986cc78b71697be81c6
Opcode Fuzzy Hash: 4d2639be15d289644b7e00e38bf24626c38f1a4f6cbd3b3f866b6a4a7de71f6d
Instruction Fuzzy Hash: 7D214C31615A80C2EB9A8B17F8807E92791FB9CBE4F581011EB5D0B7B5CE38C4D5C701

Function 00000001400693F0 Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32 ref: 0000000140069415
GetUserNameW.ADVAPI32 ref: 000000014006941D

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Name$ComputerUser
String ID:
API String ID: 4229901323-0
Opcode ID: f4f50debfc151e7c1126dc1dd43a38d7796c7dee54f646407ef832135c12787f
Instruction ID: f8b8f737a0549dbc17ccbdf42e00f8d7d5370dc9c363184f7e44db896d439c6a
Opcode Fuzzy Hash: f4f50debfc151e7c1126dc1dd43a38d7796c7dee54f646407ef832135c12787f
Instruction Fuzzy Hash: 7501622130458096EF628B65E5557AA6375FB48BE8F604312F7AC43AE4EF3CC68AC750

Function 000000014004624B Relevance: 1.5, Strings: 1, Instructions: 267COMMON

Download Yara Rule

Strings

0, xrefs: 0000000140046419

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: _wcstoi64
String ID: 0
API String ID: 1512447906-4108050209
Opcode ID: e09ceef80edcdc023dd6ec69a41145e40283d9eada8d169eda9f00c5d7b1367a
Instruction ID: 24b4e164b160f00da4b982d5e6d294841971849d2e9e470880d43ff4a7bf4db8
Opcode Fuzzy Hash: e09ceef80edcdc023dd6ec69a41145e40283d9eada8d169eda9f00c5d7b1367a
Instruction Fuzzy Hash: 1CA18F76A0459141FFBA2A3B91113FA2191EB9DBC5F868036FF82531F4F6748C82990F

Function 00000001400BC1B0 Relevance: .6, Instructions: 584COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718d620fb34a8c7fae20ded747aad93edac20b88f11f9b353b7bd6387dd95983
Instruction ID: 49311328bee6fefa73093c8f33784ead408e8bafd88b2471741b6c2d76bc17f8
Opcode Fuzzy Hash: 718d620fb34a8c7fae20ded747aad93edac20b88f11f9b353b7bd6387dd95983
Instruction Fuzzy Hash: 18329136B10A91CAE7618FAAD440BED37B1F358BD8F554126EF6997BA8DB34C841C700

Function 000000014005C100 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e477b23f3ecea56f461c696358fb7c9bd269ae031a8591b9aea2e73004fd9bb
Instruction ID: 773602da423cf50f9cb545c6fe22bdc6a6bd62315a039e0ff8e125dbdb88a9e5
Opcode Fuzzy Hash: 2e477b23f3ecea56f461c696358fb7c9bd269ae031a8591b9aea2e73004fd9bb
Instruction Fuzzy Hash: FCD1DC72221B8489EB66CF679454BE923E1FB4DBD4F448116EF0A477E5EB3AC881C340

Function 000000014000A400 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85789c11792fc48d90b6161d011240e4be3dc5371aebc8dd8522116747c55a3f
Instruction ID: b50798b4cb4ab5291e4b2f33cd493b45a05c835d173190d7a8d1219bc1277c7c
Opcode Fuzzy Hash: 85789c11792fc48d90b6161d011240e4be3dc5371aebc8dd8522116747c55a3f
Instruction Fuzzy Hash: 5141E3979149A04BFB068623A4E23F577E1E365BA3F894416B7C4436C7D16CC68FEB20

Function 00000001400D41F4 Relevance: 107.7, APIs: 86, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 00000001400D4209

Part of subcall function 00000001400CB13C: HeapFree.KERNEL32(?,?,00000000,00000001400CE860,?,?,00000000,00000001400CE883,?,?,?,00000001400CA7AB,?,?,00000000,00000001400CFD3B), ref: 00000001400CB152
Part of subcall function 00000001400CB13C: _errno.LIBCMT ref: 00000001400CB15C
Part of subcall function 00000001400CB13C: GetLastError.KERNEL32(?,?,00000000,00000001400CE860,?,?,00000000,00000001400CE883,?,?,?,00000001400CA7AB,?,?,00000000,00000001400CFD3B), ref: 00000001400CB164

free.LIBCMT ref: 00000001400D4212
free.LIBCMT ref: 00000001400D421B
free.LIBCMT ref: 00000001400D4224
free.LIBCMT ref: 00000001400D422D
free.LIBCMT ref: 00000001400D4236
free.LIBCMT ref: 00000001400D423E
free.LIBCMT ref: 00000001400D4247
free.LIBCMT ref: 00000001400D4250
free.LIBCMT ref: 00000001400D4259
free.LIBCMT ref: 00000001400D4262
free.LIBCMT ref: 00000001400D426B
free.LIBCMT ref: 00000001400D4274
free.LIBCMT ref: 00000001400D427D
free.LIBCMT ref: 00000001400D4286
free.LIBCMT ref: 00000001400D428F
free.LIBCMT ref: 00000001400D429B
free.LIBCMT ref: 00000001400D42A7
free.LIBCMT ref: 00000001400D42B3
free.LIBCMT ref: 00000001400D42BF
free.LIBCMT ref: 00000001400D42CB
free.LIBCMT ref: 00000001400D42D7
free.LIBCMT ref: 00000001400D42E3
free.LIBCMT ref: 00000001400D42EF
free.LIBCMT ref: 00000001400D42FB
free.LIBCMT ref: 00000001400D4307
free.LIBCMT ref: 00000001400D4313
free.LIBCMT ref: 00000001400D431F
free.LIBCMT ref: 00000001400D432B
free.LIBCMT ref: 00000001400D4337
free.LIBCMT ref: 00000001400D4343
free.LIBCMT ref: 00000001400D434F
free.LIBCMT ref: 00000001400D435B
free.LIBCMT ref: 00000001400D4367
free.LIBCMT ref: 00000001400D4373
free.LIBCMT ref: 00000001400D437F
free.LIBCMT ref: 00000001400D438B
free.LIBCMT ref: 00000001400D4397
free.LIBCMT ref: 00000001400D43A3
free.LIBCMT ref: 00000001400D43AF
free.LIBCMT ref: 00000001400D43BB
free.LIBCMT ref: 00000001400D43C7
free.LIBCMT ref: 00000001400D43D3
free.LIBCMT ref: 00000001400D43DF
free.LIBCMT ref: 00000001400D43EB
free.LIBCMT ref: 00000001400D43F7
free.LIBCMT ref: 00000001400D4403
free.LIBCMT ref: 00000001400D440F
free.LIBCMT ref: 00000001400D441B
free.LIBCMT ref: 00000001400D4427
free.LIBCMT ref: 00000001400D4433
free.LIBCMT ref: 00000001400D443F
free.LIBCMT ref: 00000001400D444B
free.LIBCMT ref: 00000001400D4457
free.LIBCMT ref: 00000001400D4463
free.LIBCMT ref: 00000001400D446F
free.LIBCMT ref: 00000001400D447B
free.LIBCMT ref: 00000001400D4487
free.LIBCMT ref: 00000001400D4493
free.LIBCMT ref: 00000001400D449F
free.LIBCMT ref: 00000001400D44AB
free.LIBCMT ref: 00000001400D44B7
free.LIBCMT ref: 00000001400D44C3
free.LIBCMT ref: 00000001400D44CF
free.LIBCMT ref: 00000001400D44DB
free.LIBCMT ref: 00000001400D44E7
free.LIBCMT ref: 00000001400D44F3
free.LIBCMT ref: 00000001400D44FF
free.LIBCMT ref: 00000001400D450B
free.LIBCMT ref: 00000001400D4517
free.LIBCMT ref: 00000001400D4523
free.LIBCMT ref: 00000001400D452F
free.LIBCMT ref: 00000001400D453B
free.LIBCMT ref: 00000001400D4547
free.LIBCMT ref: 00000001400D4553
free.LIBCMT ref: 00000001400D455F
free.LIBCMT ref: 00000001400D456B
free.LIBCMT ref: 00000001400D4577
free.LIBCMT ref: 00000001400D4583
free.LIBCMT ref: 00000001400D458F
free.LIBCMT ref: 00000001400D459B
free.LIBCMT ref: 00000001400D45A7
free.LIBCMT ref: 00000001400D45B3
free.LIBCMT ref: 00000001400D45BF
free.LIBCMT ref: 00000001400D45CB
free.LIBCMT ref: 00000001400D45D7

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: 466021e10641f46c777374750456f6931892017341f90ec9393ac2dada329de8
Instruction ID: 65aa7e1f3f58e04b665c3b67e795055deab772522dea627dc095263361e34d18
Opcode Fuzzy Hash: 466021e10641f46c777374750456f6931892017341f90ec9393ac2dada329de8
Instruction Fuzzy Hash: B5A1553129574485EA4ABB32CCA53EC2361ABCAB84FC84132BF4D5B677DE31C9468354

Function 000000014009F000 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 157libraryloaderwindowCOMMON

Download Yara Rule

APIs

GetPropW.USER32 ref: 000000014009F04B
RemovePropW.USER32 ref: 000000014009F063
DeleteObject.GDI32 ref: 000000014009F06C
GetParent.USER32 ref: 000000014009F0A2
GetWindowLongPtrW.USER32 ref: 000000014009F109
GetModuleHandleW.KERNEL32 ref: 000000014009F13F
GetProcAddress.KERNEL32 ref: 000000014009F158
GetPropW.USER32 ref: 000000014009F17B
SetPropW.USER32 ref: 000000014009F1AD
GetSysColor.USER32 ref: 000000014009F1C9
SetTextColor.GDI32 ref: 000000014009F1D4
MapWindowPoints.USER32 ref: 000000014009F1F4
SetBrushOrgEx.GDI32 ref: 000000014009F209
SetBkMode.GDI32 ref: 000000014009F217
SendMessageW.USER32 ref: 000000014009F24C
SetWindowLongPtrW.USER32 ref: 000000014009F265

Strings

IsAppThemed, xrefs: 000000014009F14E
uxtheme, xrefs: 000000014009F138

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Prop$Window$ColorLong$AddressBrushDeleteHandleMessageModeModuleObjectParentPointsProcRemoveSendText
String ID: IsAppThemed$uxtheme
API String ID: 2418046611-1805297701
Opcode ID: 615567465c6646be8ec2aa6e0cede64e0193fcae8ce1256dd4dcba1851c25ccd
Instruction ID: 4d315be8ca49740bfe0a7e7d97e314376389fd55b0b53697bf6d1ddc51acb0f2
Opcode Fuzzy Hash: 615567465c6646be8ec2aa6e0cede64e0193fcae8ce1256dd4dcba1851c25ccd
Instruction Fuzzy Hash: FE519F74305B4081EA6ADB57AA443F96392BB8CFD4F444015EF4A17BB5DE7CC886D740

Function 00000001400763E0 Relevance: 28.5, APIs: 8, Strings: 8, Instructions: 451windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00000001400764AA
SendMessageW.USER32 ref: 000000014007697B
SendMessageW.USER32 ref: 00000001400769C6
SendMessageW.USER32 ref: 00000001400769EB
SendMessageW.USER32 ref: 0000000140076A0C
SendMessageW.USER32 ref: 0000000140076A2B

Strings

First, xrefs: 0000000140076639, 00000001400767FC
Sort, xrefs: 00000001400767A5
Bold, xrefs: 000000014007666A
Vis, xrefs: 0000000140076620
Check, xrefs: 0000000140076717
Select, xrefs: 00000001400765F5
Icon, xrefs: 0000000140076769
Expand, xrefs: 00000001400766B3

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: MessageSend
String ID: Bold$Check$Expand$First$Icon$Select$Sort$Vis
API String ID: 3850602802-3745070880
Opcode ID: 3b7b51b1c6f3c011e9194161d7ee2e27de6e7c3318f560449a79c28f48c8d378
Instruction ID: 8f838d434c88a088b380fe20e5f036ac38e36cd56ec22c4d960ab948dda1ef89
Opcode Fuzzy Hash: 3b7b51b1c6f3c011e9194161d7ee2e27de6e7c3318f560449a79c28f48c8d378
Instruction Fuzzy Hash: 7F12CA3270464189FBA6AB37D4503EE26A5E74DBC8F884015FF4A576F9EB38C842C341

Function 00000001400090A0 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 401threadkeyboardwindowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32 ref: 0000000140009197
GetForegroundWindow.USER32(?,?,000000014000721D), ref: 0000000140009226
GetWindowThreadProcessId.USER32 ref: 000000014000923D
GetGUIThreadInfo.USER32 ref: 0000000140009252
GetWindowThreadProcessId.USER32 ref: 0000000140009267
GetKeyboardLayout.USER32 ref: 0000000140009271
GetClassNameW.USER32 ref: 000000014000929C
ToUnicodeEx.USER32 ref: 0000000140009364
ToUnicodeEx.USER32 ref: 0000000140009397
GetKeyState.USER32 ref: 00000001400093C0
ToUnicodeEx.USER32 ref: 0000000140009431
ToUnicodeEx.USER32 ref: 000000014000953B
ToUnicodeEx.USER32 ref: 0000000140009645
ToUnicodeEx.USER32 ref: 000000014000967D
ToUnicodeEx.USER32 ref: 0000000140009705

Strings

ApplicationFrameWindow, xrefs: 00000001400092A2

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Unicode$ThreadWindow$Process$ClassForegroundInfoKeyboardLayoutMessageNamePostState
String ID: ApplicationFrameWindow
API String ID: 4050567146-3747838517
Opcode ID: 08e79724d6d757f305a48704243ed7e87a528b6258428db456a95d65cf121206
Instruction ID: f6165acdba985ad87adc3d91926bde904afb6367531fa7f8e101a89f2ab0b5a1
Opcode Fuzzy Hash: 08e79724d6d757f305a48704243ed7e87a528b6258428db456a95d65cf121206
Instruction Fuzzy Hash: 3312C17220879186EB66CF27B8407EA7BA1F78DB94F480116FB89076B8DB3DC545CB10

Function 000000014008C160 Relevance: 28.3, APIs: 11, Strings: 5, Instructions: 338COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000000014008C3FC
malloc.LIBCMT ref: 000000014008C443
malloc.LIBCMT ref: 000000014008C466

Strings

Could not create window., xrefs: 000000014008C551
Invalid Gui name., xrefs: 000000014008C1C1
+LastFoundExist, xrefs: 000000014008C35C
Parameter #1 invalid., xrefs: 000000014008C1EB
Out of memory., xrefs: 000000014008C4CA

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: malloc
String ID: +LastFoundExist$Could not create window.$Invalid Gui name.$Out of memory.$Parameter #1 invalid.
API String ID: 2803490479-3585094845
Opcode ID: bee27aa427894d5c9c4fb5885959b5ae286c0f25a8b147dc762b0e1190f1eb8b
Instruction ID: 4653871446c5d13017409fdd587a9e3dac0e7c3ce0b6be9add1e22e2c0005e97
Opcode Fuzzy Hash: bee27aa427894d5c9c4fb5885959b5ae286c0f25a8b147dc762b0e1190f1eb8b
Instruction Fuzzy Hash: ADE18A72215B4581EA5BDF17A490BE923B4F78DBD4F484425EB4A0B7B6EF38CA498300

Function 0000000140093218 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 000000014009329A
SendMessageW.USER32 ref: 00000001400932C9
GetWindowRect.USER32 ref: 00000001400932FA
MapWindowPoints.USER32 ref: 000000014009330F
GetWindowRect.USER32 ref: 000000014009333D
MapWindowPoints.USER32 ref: 0000000140093352
MoveWindow.USER32 ref: 0000000140093394
MoveWindow.USER32 ref: 00000001400933CA
SendMessageW.USER32 ref: 0000000140093480
SendMessageW.USER32 ref: 00000001400934AC
SelectObject.GDI32 ref: 00000001400938AC
ReleaseDC.USER32 ref: 00000001400938BD

Strings

Can't create control., xrefs: 00000001400938D0
msctls_updown32, xrefs: 000000014009328F

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Window$MessageSend$MovePointsRect$CreateObjectReleaseSelect
String ID: Can't create control.$msctls_updown32
API String ID: 2453842347-2413529272
Opcode ID: 0189b6f047dbad8c36edf6a30534c2244e2d65400a43a21192ad93d24fb40338
Instruction ID: 6b08d038255340a76557b47bb83cb2fa20bba41763ef86b0d39871dcf97f43d0
Opcode Fuzzy Hash: 0189b6f047dbad8c36edf6a30534c2244e2d65400a43a21192ad93d24fb40338
Instruction Fuzzy Hash: 8BA136766047808AE762CF6AD8447DD3BB1F348B98F148116EF4957BB8DB38D985CB40

Function 0000000140092343 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 131windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 00000001400923A4
SendMessageW.USER32 ref: 00000001400923EB
SendMessageW.USER32 ref: 0000000140092412
MulDiv.KERNEL32 ref: 0000000140092442
MulDiv.KERNEL32 ref: 0000000140092476
MoveWindow.USER32 ref: 00000001400924C0
SelectObject.GDI32 ref: 00000001400938AC
ReleaseDC.USER32 ref: 00000001400938BD

Strings

Can't create control., xrefs: 00000001400938D0
Combobox, xrefs: 0000000140092399

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: MessageSendWindow$CreateMoveObjectReleaseSelect
String ID: Can't create control.$Combobox
API String ID: 3127342912-1217126716
Opcode ID: e8d4538bd071f692524f900d37c87bd01975b62eb79d80b9a622cba2655c3d26
Instruction ID: 6aaaec5869fa5c8e3721ba17681c14f8b31eeaeda5bfd8c0b21ac692d7fc27e0
Opcode Fuzzy Hash: e8d4538bd071f692524f900d37c87bd01975b62eb79d80b9a622cba2655c3d26
Instruction Fuzzy Hash: 5D518B72604B40CAEB52CF26E4907DE77A1F74CB98F148125EB4957BB4DB38D986CB40

Function 00000001400AA1F0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 95registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00000001400AA254
RegCloseKey.ADVAPI32 ref: 00000001400AA27E
GetModuleHandleW.KERNEL32 ref: 00000001400AA2A6
GetProcAddress.KERNEL32 ref: 00000001400AA2B6
RegDeleteKeyW.ADVAPI32 ref: 00000001400AA2FD
RegDeleteValueW.ADVAPI32 ref: 00000001400AA30A
RegCloseKey.ADVAPI32 ref: 00000001400AA317
GetLastError.KERNEL32 ref: 00000001400AA322

Strings

RegDeleteKeyExW, xrefs: 00000001400AA2AC
advapi32, xrefs: 00000001400AA299

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CloseDelete$AddressErrorHandleLastModuleOpenProcValue
String ID: RegDeleteKeyExW$advapi32
API String ID: 1329167188-3857959575
Opcode ID: f12804048b18ccdf25c577746a5236d4afa9e580c06cbbeae97f95c006cfb154
Instruction ID: 4b2f74d67cedbfbe38514e54e626765ccfb345fa00649e44f5e728a7272b3c6e
Opcode Fuzzy Hash: f12804048b18ccdf25c577746a5236d4afa9e580c06cbbeae97f95c006cfb154
Instruction Fuzzy Hash: AF414C32700B4185EE569F67A8447E967A0BB6EFE0F044621FF4A47BB1DB7DC9858B00

Function 00000001400A9210 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 244COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,?,000000014003870B), ref: 00000001400A9269
GetPrivateProfileStringW.KERNEL32 ref: 00000001400A92A5
GetPrivateProfileSectionW.KERNEL32 ref: 00000001400A92FC
GetPrivateProfileSectionNamesW.KERNEL32 ref: 00000001400A9316

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 00000001400A93BC
ERROR, xrefs: 00000001400A923B
Out of memory., xrefs: 00000001400A95FF

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: PrivateProfile$Section$FullNameNamesPathString
String ID: ERROR$Memory limit reached (see #MaxMem in the help file).$Out of memory.
API String ID: 4060383694-2798329188
Opcode ID: 50cbd1345f6eae290aa0e331215d1b2769cb6f01cba9ea33091c187d6b0fe672
Instruction ID: 36e0c3c49935bf4af2eac06470458e86ecd97b25278878f328ed38177b905060
Opcode Fuzzy Hash: 50cbd1345f6eae290aa0e331215d1b2769cb6f01cba9ea33091c187d6b0fe672
Instruction Fuzzy Hash: 19B10432705B8085EB239FA2E0513E96361F76CBD4F544212FB9A176E8DB78C9C6CB40

Function 000000014003332C Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 241windowclipboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00000001400CBD60: malloc.LIBCMT ref: 00000001400CBD7A

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659
free.LIBCMT ref: 00000001400333D5
free.LIBCMT ref: 00000001400333E1

Strings

Out of memory., xrefs: 0000000140033407

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTickfree$ClipboardCloseGlobalMessagePeekUnlockmalloc
String ID: Out of memory.
API String ID: 2261973038-4087320997
Opcode ID: 9d6f0bf57e7fdf7351c8508e6c249e6bdef568ad4bd8798a7fdc5fc8cb5ce37b
Instruction ID: 4f35984bdacec5c1c9fe8739b4f1d8ce1f6db9fbd92a5740a22ee401ca8d0a64
Opcode Fuzzy Hash: 9d6f0bf57e7fdf7351c8508e6c249e6bdef568ad4bd8798a7fdc5fc8cb5ce37b
Instruction Fuzzy Hash: E7C18D72604B408AEB6BCB26E8803EA77A1F74DBD4F140116EB9947BB5DF38D881C700

Function 0000000140038249 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 238windowclipboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00000001400CAB94: _errno.LIBCMT ref: 00000001400CABB2
Part of subcall function 00000001400CAB94: _invalid_parameter_noinfo.LIBCMT ref: 00000001400CABBD

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659

Strings

Integer, xrefs: 000000014003833C
%%%s%s%s, xrefs: 0000000140038325
Float, xrefs: 000000014003824F

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock_errno_invalid_parameter_noinfo
String ID: %%%s%s%s$Float$Integer
API String ID: 130734711-2931010843
Opcode ID: 240c7d56f43ea74b65e58d77b9d6e8acc20fb47bbf599287c6609ea3b7af78b7
Instruction ID: b463e45ca59adde006ff25223be624469cbf681a637fbf406e2a6bc45ff005eb
Opcode Fuzzy Hash: 240c7d56f43ea74b65e58d77b9d6e8acc20fb47bbf599287c6609ea3b7af78b7
Instruction Fuzzy Hash: 59C17931205B4086FB6B8B27E8847EA67A2B74DBD4F540126FB5A877F5DB38C881C740

Function 0000000140044002 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 198COMMON

Download Yara Rule

APIs

wcsncpy.LIBCMT ref: 0000000140044050
CreateSolidBrush.GDI32 ref: 0000000140044124
CreateDCW.GDI32 ref: 00000001400443E7
GetDeviceCaps.GDI32 ref: 00000001400443F8
GetStockObject.GDI32 ref: 0000000140044406
SelectObject.GDI32 ref: 0000000140044415
GetTextFaceW.GDI32 ref: 000000014004442E
GetTextMetricsW.GDI32 ref: 000000014004443E

Strings

DISPLAY, xrefs: 00000001400443D8

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CreateObjectText$BrushCapsDeviceFaceMetricsSelectSolidStockwcsncpy
String ID: DISPLAY
API String ID: 1918898772-865373369
Opcode ID: 64acbd78b8afa826982a18a1dc5bfd3beeb8ba4160218508d2ae081d29aa437d
Instruction ID: 7b711a298caa5ca98f0b38c72c14a300ed993a05eeca2533c277b9e5c745c53b
Opcode Fuzzy Hash: 64acbd78b8afa826982a18a1dc5bfd3beeb8ba4160218508d2ae081d29aa437d
Instruction Fuzzy Hash: 6481123260069186FB2A8F2294503ED37E0F798BDDF524629FB5617AF8DB38C991C744

Function 00000001400442E2 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400CAB94: _errno.LIBCMT ref: 00000001400CABB2
Part of subcall function 00000001400CAB94: _invalid_parameter_noinfo.LIBCMT ref: 00000001400CABBD

MulDiv.KERNEL32 ref: 000000014004432C
CreateDCW.GDI32 ref: 00000001400443E7
GetDeviceCaps.GDI32 ref: 00000001400443F8
GetStockObject.GDI32 ref: 0000000140044406
SelectObject.GDI32 ref: 0000000140044415
GetTextFaceW.GDI32 ref: 000000014004442E
GetTextMetricsW.GDI32 ref: 000000014004443E

Strings

Hide, xrefs: 00000001400442E2
DISPLAY, xrefs: 00000001400443D8

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: ObjectText$CapsCreateDeviceFaceMetricsSelectStock_errno_invalid_parameter_noinfo
String ID: DISPLAY$Hide
API String ID: 2877261776-1671811882
Opcode ID: 7ca45cc382354c7eda3d27ee10c9f2f2cc6684681f3a52a492581d037a7252b8
Instruction ID: f8bb59ca9c972b1cb3cb0cfca10ede274a6419cdc77d5765a149c999ff38b83f
Opcode Fuzzy Hash: 7ca45cc382354c7eda3d27ee10c9f2f2cc6684681f3a52a492581d037a7252b8
Instruction Fuzzy Hash: 9341B23160178186FB6A8F2294503E937A0F38DBDDF514029EF4A57BB8DB39C981CB84

Function 00000001400921BC Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 95windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 000000014009220A
GetWindowLongW.USER32 ref: 000000014009224B
SendMessageW.USER32 ref: 0000000140092275
SendMessageW.USER32 ref: 0000000140092291
SendMessageW.USER32 ref: 00000001400922AE
SelectObject.GDI32 ref: 00000001400938AC
ReleaseDC.USER32 ref: 00000001400938BD

Strings

Can't create control., xrefs: 00000001400938D0
button, xrefs: 00000001400921FF

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: MessageSend$Window$CreateLongObjectReleaseSelect
String ID: Can't create control.$button
API String ID: 841324528-1804316079
Opcode ID: a05c52d3d54e6efae770d1f2596ec72e6be64b93865aa0dffd4c1bdcd55146de
Instruction ID: 6e3a4506b1df561b7e5899ce8ebd38ea4a0091c3c24feb1f06ddd8c7866cc20f
Opcode Fuzzy Hash: a05c52d3d54e6efae770d1f2596ec72e6be64b93865aa0dffd4c1bdcd55146de
Instruction Fuzzy Hash: B5411876705A8086EB62CF2AE48479973B0F78CB98F144122EF4957B78DF39C985CB40

Function 000000014004F342 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32 ref: 000000014004F362
SetLastError.KERNEL32 ref: 000000014004F3BC
SetWindowLongW.USER32 ref: 000000014004F3CB
GetLastError.KERNEL32 ref: 000000014004F3D5
GetWindowLongW.USER32 ref: 000000014004F3E5
SetWindowPos.USER32 ref: 000000014004F40C
InvalidateRect.USER32 ref: 000000014004F41A

Strings

7, xrefs: 000000014004F3F1
+-^, xrefs: 000000014004F36B

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Window$Long$ErrorLast$InvalidateRect
String ID: +-^$7
API String ID: 189950902-219994616
Opcode ID: 617337d7036434c2a9ecc605b48b5d0ad4ee05d507f2ec36b386c03962299483
Instruction ID: 733cb986ad0821ed767a84d679ad93982106c3db35482fe4a1adeb95f2768207
Opcode Fuzzy Hash: 617337d7036434c2a9ecc605b48b5d0ad4ee05d507f2ec36b386c03962299483
Instruction Fuzzy Hash: 4F31E43230094082FA679B27A8943FA6291B7CCBE9F554135FF0A876B5DF3CD885A604

Function 00000001400D13E4 Relevance: 15.2, APIs: 10, Instructions: 206COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,00000001400D1721), ref: 00000001400D147E
malloc.LIBCMT ref: 00000001400D14E7
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,00000001400D1721), ref: 00000001400D151B
LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,00000001400D1721), ref: 00000001400D1542
LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,00000001400D1721), ref: 00000001400D158A
malloc.LIBCMT ref: 00000001400D15E7

Part of subcall function 00000001400CA9C4: _FF_MSGBANNER.LIBCMT ref: 00000001400CA9F4
Part of subcall function 00000001400CA9C4: HeapAlloc.KERNEL32(?,?,00000000,00000001400D0AC0,?,?,00000000,00000001400CF2FD,?,?,?,00000001400CF3A7,?,?,00000000,00000001400CE795), ref: 00000001400CAA19
Part of subcall function 00000001400CA9C4: _callnewh.LIBCMT ref: 00000001400CAA32
Part of subcall function 00000001400CA9C4: _errno.LIBCMT ref: 00000001400CAA3D
Part of subcall function 00000001400CA9C4: _errno.LIBCMT ref: 00000001400CAA48

LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,00000001400D1721), ref: 00000001400D161C
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,00000001400D1721), ref: 00000001400D165C
free.LIBCMT ref: 00000001400D1670
free.LIBCMT ref: 00000001400D1681

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: ByteCharMultiStringWide$_errnofreemalloc$AllocHeap_callnewh
String ID:
API String ID: 1080698880-0
Opcode ID: 8b94b1efe24bbeb5f9c2dae9d551b5dd8f74e24a509077e83292b00b0708575b
Instruction ID: 69e46fe6c586d9a651b93c21acb5ee76bc9a6d111528acf0d7c6efdcdb2198ab
Opcode Fuzzy Hash: 8b94b1efe24bbeb5f9c2dae9d551b5dd8f74e24a509077e83292b00b0708575b
Instruction Fuzzy Hash: C8816F32304780A6EB268F66D4407DD76A5FB8CBE8F584225FB5957BE4EF38C9428710

Function 00000001400D804C Relevance: 15.1, APIs: 10, Instructions: 123COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000001400D8093
_invalid_parameter_noinfo.LIBCMT ref: 00000001400D809F
_errno.LIBCMT ref: 00000001400D80E9
_errno.LIBCMT ref: 00000001400D80F4
_errno.LIBCMT ref: 00000001400D8126
_invalid_parameter_noinfo.LIBCMT ref: 00000001400D8130
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001400D821F), ref: 00000001400D81A2
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001400D821F), ref: 00000001400D81BF
_errno.LIBCMT ref: 00000001400D81E5
_invalid_parameter_noinfo.LIBCMT ref: 00000001400D81F1

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 2295021086-0
Opcode ID: 8d4ea634b2d2ada256a542e9dd5cc9de4b662ccb9a966e6639f0803ca8076cf5
Instruction ID: faf8b7c293f865d0e22efce0c883b9dc30b4706e007303f431fa4a71f4cfeeef
Opcode Fuzzy Hash: 8d4ea634b2d2ada256a542e9dd5cc9de4b662ccb9a966e6639f0803ca8076cf5
Instruction Fuzzy Hash: 4651B7326047808AFBB79B62D8403EC3AB4AF497E4F184110FF1507AF5CB38888B8721

Function 0000000140001142 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 236COMMON

Download Yara Rule

APIs

_i64tow.LIBCMT ref: 00000001400011A4

Part of subcall function 00000001400CA74C: x64tow.LIBCMT ref: 00000001400CA769

_i64tow.LIBCMT ref: 00000001400011E2
CharUpperW.USER32 ref: 00000001400011FB

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 00000001400012B0
, xrefs: 0000000140001376
Out of memory., xrefs: 00000001400014D9

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: _i64tow$CharUpperx64tow
String ID: $Memory limit reached (see #MaxMem in the help file).$Out of memory.
API String ID: 789761669-1193006554
Opcode ID: ad393062bd0669106b5458e5e2cb539dd6922c9950858116007e2932a900667d
Instruction ID: 97b0f747ee716e8ac0c6a42fd28bf3b44786591152b7124e93d5cede32e92a26
Opcode Fuzzy Hash: ad393062bd0669106b5458e5e2cb539dd6922c9950858116007e2932a900667d
Instruction Fuzzy Hash: EAB19DB2208B8085EB66CF22F5543EA63A1F78DBD8F544202FB5A57AF9DB38C555C340

Function 000000014003635D Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 182windowtimeclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659
GetTickCount.KERNEL32 ref: 0000000140032737
SendMessageTimeoutW.USER32 ref: 000000014003638C

Strings

Environment, xrefs: 0000000140036379

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$Message$ClipboardCloseGlobalPeekSendTimeoutUnlock
String ID: Environment
API String ID: 3716859204-3233436149
Opcode ID: a4277965e5af97a245481dad8bb0a6286528eb68b5c713a57f54c85a136f801b
Instruction ID: a352cdda06138efb39d9baf7b6950f852ba629cafca0125f62967e2953884633
Opcode Fuzzy Hash: a4277965e5af97a245481dad8bb0a6286528eb68b5c713a57f54c85a136f801b
Instruction Fuzzy Hash: EF916E32205B4486FB6B8B26E8847EA37A1F74DBD4F540116EB5947AF5DB38D880CB40

Function 00000001400812B0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 169COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 0000000140081318
GetFullPathNameW.KERNEL32 ref: 000000014008135B
GetFileAttributesW.KERNEL32 ref: 0000000140081399

Strings

\, xrefs: 0000000140081336
\*.*, xrefs: 000000014008148A
:, xrefs: 00000001400813F7

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: FullNamePath$AttributesFile
String ID: :$\$\*.*
API String ID: 2214166259-1634566093
Opcode ID: ea9ee2eac927e62cff7dee933299914b5664a47733676ef8a6449d018e4ea75c
Instruction ID: 8287bc34fd43579edcb1be05949d17706ae5b2effbb521ca0842c933f0217dbc
Opcode Fuzzy Hash: ea9ee2eac927e62cff7dee933299914b5664a47733676ef8a6449d018e4ea75c
Instruction Fuzzy Hash: A9718133508A8086EB628B75A4003EA63E5FBC87B4F541316F7A9579F8EB78C685C740

Function 000000014004F18E Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32 ref: 000000014004F19A

Part of subcall function 00000001400CA93C: _errno.LIBCMT ref: 00000001400CA954
Part of subcall function 00000001400CA93C: _invalid_parameter_noinfo.LIBCMT ref: 00000001400CA95F

SetWindowLongW.USER32 ref: 000000014004F1C4
SetWindowLongW.USER32 ref: 000000014004F208
SetLayeredWindowAttributes.USER32 ref: 000000014004F21D

Strings

Off, xrefs: 000000014004F1A0

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Window$Long$AttributesLayered_errno_invalid_parameter_noinfo
String ID: Off
API String ID: 9511289-334568355
Opcode ID: bc572507185fcd48d6bee78820c775b7f3f79346e26528645059c8f0ca57d472
Instruction ID: d7d921a05befdc21490f10f967540a2e2d982f9a5b2dcd13f01930adb07f3559
Opcode Fuzzy Hash: bc572507185fcd48d6bee78820c775b7f3f79346e26528645059c8f0ca57d472
Instruction Fuzzy Hash: 1851F23A70416182EB729B2BA4003FAA290F798BD8F864131FF46876F5DE78C845A744

Function 0000000140044257 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32 ref: 000000014004429B
CreateDCW.GDI32 ref: 00000001400443E7
GetDeviceCaps.GDI32 ref: 00000001400443F8
GetStockObject.GDI32 ref: 0000000140044406
SelectObject.GDI32 ref: 0000000140044415
GetTextFaceW.GDI32 ref: 000000014004442E
GetTextMetricsW.GDI32 ref: 000000014004443E
GetIconInfo.USER32 ref: 0000000140044527
GetObjectW.GDI32 ref: 000000014004454E
DeleteObject.GDI32 ref: 0000000140044627
DeleteObject.GDI32 ref: 0000000140044631
MulDiv.KERNEL32 ref: 0000000140044650
SetRect.USER32 ref: 000000014004468B
MulDiv.KERNEL32 ref: 00000001400446BB

Strings

DISPLAY, xrefs: 00000001400443D8

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Object$DeleteText$CapsCreateDeviceFaceIconInfoMetricsRectSelectStock
String ID: DISPLAY
API String ID: 2624006087-865373369
Opcode ID: 7f75e93dc04f375c431505c4f7255d9deb99c393e07adf6a370a8fcfe1cfa7f0
Instruction ID: 57279c7950419f1c45b904bd17f0ddbe79ea1e2287f7a97d93df353362d8a338
Opcode Fuzzy Hash: 7f75e93dc04f375c431505c4f7255d9deb99c393e07adf6a370a8fcfe1cfa7f0
Instruction Fuzzy Hash: 3851A3726017818AFB6A8F2394903ED37A0F78DB99F514029EF4557BB4DB39C981CB44

Function 000000014008A1C0 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 315COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 000000014008A296
malloc.LIBCMT ref: 000000014008A2AE

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 000000014008A234
Out of memory., xrefs: 000000014008A2CC

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: freemalloc
String ID: Memory limit reached (see #MaxMem in the help file).$Out of memory.
API String ID: 3061335427-457448710
Opcode ID: 3952aaeb542630f8eed55199ef17d6245a48a0f40f4df9c499f2dc1fe48f7096
Instruction ID: bea7a777fb31d1cbd55591d04112391db0f51e2147ef09d2eb0260febcbbf838
Opcode Fuzzy Hash: 3952aaeb542630f8eed55199ef17d6245a48a0f40f4df9c499f2dc1fe48f7096
Instruction Fuzzy Hash: AEE19F72605B8481FB628B16A4047EA77A5FB4EBD8F440116EB9907BB8DB7CC695C700

Function 000000014005F060 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 238COMMON

Download Yara Rule

APIs

wcsncpy.LIBCMT ref: 000000014005F0A4
GetDiskFreeSpaceExW.KERNEL32 ref: 000000014005F105

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 000000014005F1C4
\, xrefs: 000000014005F0C6
Out of memory., xrefs: 000000014005F415

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: DiskFreeSpacewcsncpy
String ID: Memory limit reached (see #MaxMem in the help file).$Out of memory.$\
API String ID: 340609953-3887087261
Opcode ID: a57039f876d61874456d7c3df9fcb96f8092fcb0b5444c862aeb547096fe15b2
Instruction ID: b5b8dbeab608ca898f4adede869faa9a51234a4995db989feeb7c27570bb5004
Opcode Fuzzy Hash: a57039f876d61874456d7c3df9fcb96f8092fcb0b5444c862aeb547096fe15b2
Instruction Fuzzy Hash: E1A1EC72604A8092FB62DB23E5443E963A1F78CBD4F444222EB5A1BBF5DB7DC595E300

Function 00000001400330D8 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 225windowclipboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00000001400CA93C: _errno.LIBCMT ref: 00000001400CA954
Part of subcall function 00000001400CA93C: _invalid_parameter_noinfo.LIBCMT ref: 00000001400CA95F

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659

Strings

CSV, xrefs: 00000001400330D8

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock_errno_invalid_parameter_noinfo
String ID: CSV
API String ID: 130734711-2651001053
Opcode ID: 2571c6cd75cca247666939278f462bfbbf6cca7ea84cc96d71b33113f93168c2
Instruction ID: e3a4817ddb17f0a0565de77c4a27dfc75c71579afeb289edebabff1b708afb2a
Opcode Fuzzy Hash: 2571c6cd75cca247666939278f462bfbbf6cca7ea84cc96d71b33113f93168c2
Instruction Fuzzy Hash: 1AB16E76604B4486EB678B27E8807DA77A1F74DBD4F140116EB9D87BB8DB38D881C740

Function 00000001400371C0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 219windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659

Strings

Target label does not exist., xrefs: 000000014003721E

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
String ID: Target label does not exist.
API String ID: 1623861271-2507343300
Opcode ID: cf08b72a1f85ef528d4b876a264b641fef72119f9f906f0e8bf8fc7b2ae7870a
Instruction ID: aace4068658c82635329fa8fc78d7488498a5df07afcc4a8738732627e58b01e
Opcode Fuzzy Hash: cf08b72a1f85ef528d4b876a264b641fef72119f9f906f0e8bf8fc7b2ae7870a
Instruction Fuzzy Hash: CFB16B32205B4485FB6B8B2BE8847EA27A1FB4DBE4F540116EB9D476F5DB38D881C740

Function 0000000140083010 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 197COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 0000000140083249
SysFreeString.OLEAUT32 ref: 0000000140083264
StringFromGUID2.OLE32(?,?,?,?,?,?,?,00000001400828B9), ref: 00000001400832A5

Strings

class, xrefs: 0000000140083188
iid, xrefs: 00000001400831CE, 000000014008326C
clsid, xrefs: 00000001400831BB
name, xrefs: 000000014008319B, 000000014008320D

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: String$FreeFrom
String ID: class$clsid$iid$name
API String ID: 2678186706-3724380462
Opcode ID: 3e8e12931563aef98b3a42a4bb7d5856e4da5e6590fd0fb3d232fcfcee604ea7
Instruction ID: 1381a9711b17c7dcfaacef3f86432853d6837ad83d27059a8dc87ff0e196a8ba
Opcode Fuzzy Hash: 3e8e12931563aef98b3a42a4bb7d5856e4da5e6590fd0fb3d232fcfcee604ea7
Instruction Fuzzy Hash: 1D917C36204B4082EB669B2BE4503AA67A0F7CDBD8F546116FF8A477B9DF38C555C700

Function 00000001400381D1 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 183windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659

Strings

Parameter #1 invalid., xrefs: 0000000140038A55

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
String ID: Parameter #1 invalid.
API String ID: 1623861271-1208927624
Opcode ID: 07e6a40e08aac53d5fd7d628a088f45312c2f44835cafe26ad10f286e764194c
Instruction ID: 30d188d6ab8ac60033a158e048a00c4180f0f62e663e2c38c7cb11da4888db4d
Opcode Fuzzy Hash: 07e6a40e08aac53d5fd7d628a088f45312c2f44835cafe26ad10f286e764194c
Instruction Fuzzy Hash: 95917F72205B4486FB6B8B27E9847EA37A1F74DBE4F540116EB59876F5CB38C881C740

Function 00000001400380ED Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 177windowclipboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00000001400CA93C: _errno.LIBCMT ref: 00000001400CA954
Part of subcall function 00000001400CA93C: _invalid_parameter_noinfo.LIBCMT ref: 00000001400CA95F

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659
GetTickCount.KERNEL32 ref: 0000000140032737

Strings

Play, xrefs: 00000001400380ED

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock_errno_invalid_parameter_noinfo
String ID: Play
API String ID: 130734711-4273697156
Opcode ID: 3fd01e4027b3d9650c6466650cf8e3ab190afa939c549a132e297a51e6705630
Instruction ID: 1747f8b5322398b0e1493671b2351a7ebaeb0362ff10759a50ced827d42cfff3
Opcode Fuzzy Hash: 3fd01e4027b3d9650c6466650cf8e3ab190afa939c549a132e297a51e6705630
Instruction Fuzzy Hash: 87918D32604B4086FB6B8B27E8847EA37A1F74DBE4F540116EB5A876F5DB38D881C740

Function 000000014007D36C Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 177windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 000000014007D37C
SendMessageTimeoutW.USER32 ref: 000000014007D418
SendMessageTimeoutW.USER32 ref: 000000014007D474
SendMessageTimeoutW.USER32 ref: 000000014007D515

Part of subcall function 000000014004C8B0: SendMessageTimeoutW.USER32 ref: 000000014004C903

Strings

Combo, xrefs: 000000014007D3B0
SysListView32, xrefs: 000000014007D386
List, xrefs: 000000014007D3D2

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: MessageSendTimeout$ClassName
String ID: Combo$List$SysListView32
API String ID: 639069792-371123625
Opcode ID: 7de485ba91aa5027f2a1d50c9b93aaee24f09d49bb42ee2803a20293ff77a702
Instruction ID: e7c10ea6e444e9311a5984f2a3343e0db309b8b53552d069bf3c98c5a2967718
Opcode Fuzzy Hash: 7de485ba91aa5027f2a1d50c9b93aaee24f09d49bb42ee2803a20293ff77a702
Instruction Fuzzy Hash: 8C719B72204B8086EB628F2698447E977A1F74DBECF481617FB5E17BE9DB38C6458700

Function 000000014004435A Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 112windowCOMMON

Download Yara Rule

APIs

CreateDCW.GDI32 ref: 00000001400443E7
GetDeviceCaps.GDI32 ref: 00000001400443F8
GetStockObject.GDI32 ref: 0000000140044406
SelectObject.GDI32 ref: 0000000140044415
GetTextFaceW.GDI32 ref: 000000014004442E
GetTextMetricsW.GDI32 ref: 000000014004443E
GetIconInfo.USER32 ref: 0000000140044527
GetObjectW.GDI32 ref: 000000014004454E
DeleteObject.GDI32 ref: 0000000140044627
DeleteObject.GDI32 ref: 0000000140044631
MulDiv.KERNEL32 ref: 0000000140044650
SetRect.USER32 ref: 000000014004468B
MulDiv.KERNEL32 ref: 00000001400446BB

Strings

DISPLAY, xrefs: 00000001400443D8

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Object$DeleteText$CapsCreateDeviceFaceIconInfoMetricsRectSelectStock
String ID: DISPLAY
API String ID: 2624006087-865373369
Opcode ID: 007506d76ac344f2e3b66a4e33841752d8411c0504c85668f831f219e3872546
Instruction ID: 5377500f95dacf339b2644e87d777914b115cb7502a944bac2daf7022b9f2fde
Opcode Fuzzy Hash: 007506d76ac344f2e3b66a4e33841752d8411c0504c85668f831f219e3872546
Instruction Fuzzy Hash: 504192726016818AFB6ACF2294513ED37A0F39DBDDF514025EB4657BB8DB38C981C784

Function 00000001400441F6 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100windowCOMMON

Download Yara Rule

APIs

CreateDCW.GDI32 ref: 00000001400443E7
GetDeviceCaps.GDI32 ref: 00000001400443F8
GetStockObject.GDI32 ref: 0000000140044406
SelectObject.GDI32 ref: 0000000140044415
GetTextFaceW.GDI32 ref: 000000014004442E
GetTextMetricsW.GDI32 ref: 000000014004443E
GetIconInfo.USER32 ref: 0000000140044527
GetObjectW.GDI32 ref: 000000014004454E
DeleteObject.GDI32 ref: 0000000140044627
DeleteObject.GDI32 ref: 0000000140044631
MulDiv.KERNEL32 ref: 0000000140044650
SetRect.USER32 ref: 000000014004468B
MulDiv.KERNEL32 ref: 00000001400446BB
CreateFontW.GDI32 ref: 0000000140044737

Strings

DISPLAY, xrefs: 00000001400443D8

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Object$CreateDeleteText$CapsDeviceFaceFontIconInfoMetricsRectSelectStock
String ID: DISPLAY
API String ID: 3544818348-865373369
Opcode ID: a1d7a25d5e06a9988a7b028382f00c7053b5d89d882773703802621f1868f8c3
Instruction ID: 7bd8496eb3f8e331928d6969a3b62b30f35a169dbc2732244e4f3777f54f1151
Opcode Fuzzy Hash: a1d7a25d5e06a9988a7b028382f00c7053b5d89d882773703802621f1868f8c3
Instruction Fuzzy Hash: 4941D4326017818AFB6A8F2290513ED37E0F38DB9DF524029EF4957BA4DB39C985C744

Function 0000000140084160 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 93windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(?,000000014008258D), ref: 0000000140084236
SysFreeString.OLEAUT32 ref: 00000001400842D2
SysFreeString.OLEAUT32 ref: 00000001400842DC
SysFreeString.OLEAUT32 ref: 00000001400842E6

Strings

Source:%wsDescription:%wsHelpFile:%wsHelpContext:%d, xrefs: 0000000140084280
0x%08X - , xrefs: 00000001400841E3
No valid COM object!, xrefs: 00000001400841D7

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: FreeString$FormatMessage
String ID: Source:%wsDescription:%wsHelpFile:%wsHelpContext:%d$0x%08X - $No valid COM object!
API String ID: 1522831054-3028990165
Opcode ID: 184dd49d8221f6094194c858502fe487139c0727381068df04108684fdb01643
Instruction ID: 3e574229208271e0652739833001e61f0b6b993698a75bfe69a30d5957325b13
Opcode Fuzzy Hash: 184dd49d8221f6094194c858502fe487139c0727381068df04108684fdb01643
Instruction Fuzzy Hash: B141D272218B9081EB759B26E8443E9B3A5FB9CBC8F484115EB8817BB9DF3CC595C740

Function 00000001400441B2 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

CreateDCW.GDI32 ref: 00000001400443E7
GetDeviceCaps.GDI32 ref: 00000001400443F8
GetStockObject.GDI32 ref: 0000000140044406
SelectObject.GDI32 ref: 0000000140044415
GetTextFaceW.GDI32 ref: 000000014004442E
GetTextMetricsW.GDI32 ref: 000000014004443E

Strings

DISPLAY, xrefs: 00000001400443D8

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: ObjectText$CapsCreateDeviceFaceMetricsSelectStock
String ID: DISPLAY
API String ID: 2440455471-865373369
Opcode ID: db2c7b62caa1502c90c4692a64aad69af234af233acf7d5f76a536d283ef3c19
Instruction ID: 54469ac6916066de2ddc44dadd6764576386d4ad38e7a6b39ee952ac9e894666
Opcode Fuzzy Hash: db2c7b62caa1502c90c4692a64aad69af234af233acf7d5f76a536d283ef3c19
Instruction Fuzzy Hash: C541D4356017818AFB7A8F2694503E933A0F39DB9DF524029EF4617BB8DB39C981C784

Function 00000001400441DC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

CreateDCW.GDI32 ref: 00000001400443E7
GetDeviceCaps.GDI32 ref: 00000001400443F8
GetStockObject.GDI32 ref: 0000000140044406
SelectObject.GDI32 ref: 0000000140044415
GetTextFaceW.GDI32 ref: 000000014004442E
GetTextMetricsW.GDI32 ref: 000000014004443E
GetIconInfo.USER32 ref: 0000000140044527
GetObjectW.GDI32 ref: 000000014004454E
DeleteObject.GDI32 ref: 0000000140044627
DeleteObject.GDI32 ref: 0000000140044631
MulDiv.KERNEL32 ref: 0000000140044650
SetRect.USER32 ref: 000000014004468B
MulDiv.KERNEL32 ref: 00000001400446BB
CreateFontW.GDI32 ref: 0000000140044737
MulDiv.KERNEL32 ref: 000000014004475C
CreateFontW.GDI32 ref: 00000001400447C3
SelectObject.GDI32 ref: 00000001400447DE
DrawTextW.USER32 ref: 0000000140044815
MulDiv.KERNEL32 ref: 0000000140044851
CreateFontW.GDI32 ref: 000000014004489D
MulDiv.KERNEL32 ref: 00000001400448C1
CreateFontW.GDI32 ref: 000000014004490F
SelectObject.GDI32 ref: 000000014004496A
DrawTextW.USER32 ref: 000000014004499D
SelectObject.GDI32 ref: 00000001400449BE
DeleteDC.GDI32 ref: 00000001400449C7

Strings

DISPLAY, xrefs: 00000001400443D8

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Object$Create$FontSelectText$Delete$Draw$CapsDeviceFaceIconInfoMetricsRectStock
String ID: DISPLAY
API String ID: 287169048-865373369
Opcode ID: 79cc43e1e6b7c5b56ba145ab2fa071fb583259bd71ecbb3b2d6f0637a8729805
Instruction ID: 02ce41ec8f36144a1fcafbfded04e66a7fd84603d954e2f6789a5b5be7dde9ab
Opcode Fuzzy Hash: 79cc43e1e6b7c5b56ba145ab2fa071fb583259bd71ecbb3b2d6f0637a8729805
Instruction Fuzzy Hash: AF31B4316017818AFB6A8F2294503ED37A0F39DB9DF514029EF4A57BB8DB39C881C784

Function 000000014004433A Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83windowCOMMON

Download Yara Rule

APIs

CreateDCW.GDI32 ref: 00000001400443E7
GetDeviceCaps.GDI32 ref: 00000001400443F8
GetStockObject.GDI32 ref: 0000000140044406
SelectObject.GDI32 ref: 0000000140044415
GetTextFaceW.GDI32 ref: 000000014004442E
GetTextMetricsW.GDI32 ref: 000000014004443E
GetIconInfo.USER32 ref: 0000000140044527
GetObjectW.GDI32 ref: 000000014004454E
DeleteObject.GDI32 ref: 0000000140044627
DeleteObject.GDI32 ref: 0000000140044631
MulDiv.KERNEL32 ref: 0000000140044650
SetRect.USER32 ref: 000000014004468B
MulDiv.KERNEL32 ref: 00000001400446BB
CreateFontW.GDI32 ref: 0000000140044737
MulDiv.KERNEL32 ref: 000000014004475C
CreateFontW.GDI32 ref: 00000001400447C3
SelectObject.GDI32 ref: 00000001400447DE
DrawTextW.USER32 ref: 0000000140044815
MulDiv.KERNEL32 ref: 0000000140044851
CreateFontW.GDI32 ref: 000000014004489D
MulDiv.KERNEL32 ref: 00000001400448C1
CreateFontW.GDI32 ref: 000000014004490F
SelectObject.GDI32 ref: 000000014004496A
DrawTextW.USER32 ref: 000000014004499D
SelectObject.GDI32 ref: 00000001400449BE
DeleteDC.GDI32 ref: 00000001400449C7

Strings

DISPLAY, xrefs: 00000001400443D8

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Object$Create$FontSelectText$Delete$Draw$CapsDeviceFaceIconInfoMetricsRectStock
String ID: DISPLAY
API String ID: 287169048-865373369
Opcode ID: 8c94b54f97151126f6a3dbc8e35f525c2f7b06ba765cb74cd4d01cb4ef1739de
Instruction ID: 574bf68584c60e5c647a62c336327c5122b78c94baca402dbd1a45f3a61bd061
Opcode Fuzzy Hash: 8c94b54f97151126f6a3dbc8e35f525c2f7b06ba765cb74cd4d01cb4ef1739de
Instruction Fuzzy Hash: 9631A4316017818AFB7A8F2294513E933A0F39DB9DF514029EF4A57BB8DB39C981C784

Function 0000000140044348 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83windowCOMMON

Download Yara Rule

APIs

CreateDCW.GDI32 ref: 00000001400443E7
GetDeviceCaps.GDI32 ref: 00000001400443F8
GetStockObject.GDI32 ref: 0000000140044406
SelectObject.GDI32 ref: 0000000140044415
GetTextFaceW.GDI32 ref: 000000014004442E
GetTextMetricsW.GDI32 ref: 000000014004443E
GetIconInfo.USER32 ref: 0000000140044527
GetObjectW.GDI32 ref: 000000014004454E
DeleteObject.GDI32 ref: 0000000140044627
DeleteObject.GDI32 ref: 0000000140044631
MulDiv.KERNEL32 ref: 0000000140044650
SetRect.USER32 ref: 000000014004468B
MulDiv.KERNEL32 ref: 00000001400446BB
CreateFontW.GDI32 ref: 0000000140044737
MulDiv.KERNEL32 ref: 000000014004475C
CreateFontW.GDI32 ref: 00000001400447C3
SelectObject.GDI32 ref: 00000001400447DE
DrawTextW.USER32 ref: 0000000140044815
MulDiv.KERNEL32 ref: 0000000140044851
CreateFontW.GDI32 ref: 000000014004489D
MulDiv.KERNEL32 ref: 00000001400448C1
CreateFontW.GDI32 ref: 000000014004490F
SelectObject.GDI32 ref: 000000014004496A
DrawTextW.USER32 ref: 000000014004499D
SelectObject.GDI32 ref: 00000001400449BE
DeleteDC.GDI32 ref: 00000001400449C7

Strings

DISPLAY, xrefs: 00000001400443D8

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Object$Create$FontSelectText$Delete$Draw$CapsDeviceFaceIconInfoMetricsRectStock
String ID: DISPLAY
API String ID: 287169048-865373369
Opcode ID: 93dfc2e08d65218b920f8a286016c4f413a753766af2ec05e16299fae07c7944
Instruction ID: 6ad6f091a518b6764e5f923eff79435a75e8f0d1c80be343dc921ce39c708716
Opcode Fuzzy Hash: 93dfc2e08d65218b920f8a286016c4f413a753766af2ec05e16299fae07c7944
Instruction Fuzzy Hash: 9F31A4316017818AFB7A8F2294513E933A0F39DB9DF514029EF4A57BB8DB39C981C784

Function 0000000140044249 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

CreateDCW.GDI32 ref: 00000001400443E7
GetDeviceCaps.GDI32 ref: 00000001400443F8
GetStockObject.GDI32 ref: 0000000140044406
SelectObject.GDI32 ref: 0000000140044415
GetTextFaceW.GDI32 ref: 000000014004442E
GetTextMetricsW.GDI32 ref: 000000014004443E
GetIconInfo.USER32 ref: 0000000140044527
GetObjectW.GDI32 ref: 000000014004454E
DeleteObject.GDI32 ref: 0000000140044627
DeleteObject.GDI32 ref: 0000000140044631
MulDiv.KERNEL32 ref: 0000000140044650
SetRect.USER32 ref: 000000014004468B
MulDiv.KERNEL32 ref: 00000001400446BB
CreateFontW.GDI32 ref: 0000000140044737
MulDiv.KERNEL32 ref: 000000014004475C
CreateFontW.GDI32 ref: 00000001400447C3
SelectObject.GDI32 ref: 00000001400447DE
DrawTextW.USER32 ref: 0000000140044815
MulDiv.KERNEL32 ref: 0000000140044851
CreateFontW.GDI32 ref: 000000014004489D
MulDiv.KERNEL32 ref: 00000001400448C1
CreateFontW.GDI32 ref: 000000014004490F
SelectObject.GDI32 ref: 000000014004496A
DrawTextW.USER32 ref: 000000014004499D
SelectObject.GDI32 ref: 00000001400449BE
DeleteDC.GDI32 ref: 00000001400449C7

Strings

DISPLAY, xrefs: 00000001400443D8

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Object$Create$FontSelectText$Delete$Draw$CapsDeviceFaceIconInfoMetricsRectStock
String ID: DISPLAY
API String ID: 287169048-865373369
Opcode ID: b58c7a80ffbae7d0a77c10089ad137fb5fb82dc478809a4d40b45f9db5b76e13
Instruction ID: c2ee0f9b6322619961a75c4894c09fe7c31f050da9442a91dd70dabf2c36835d
Opcode Fuzzy Hash: b58c7a80ffbae7d0a77c10089ad137fb5fb82dc478809a4d40b45f9db5b76e13
Instruction Fuzzy Hash: B031A53160178186EB7A8F2294507E937E0F39DB9DF514028EF4957BB8DB39C981C784

Function 0000000140093161 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 00000001400931AF
SendMessageW.USER32 ref: 00000001400931EA
SendMessageW.USER32 ref: 000000014009320D
SelectObject.GDI32 ref: 00000001400938AC
ReleaseDC.USER32 ref: 00000001400938BD

Strings

Can't create control., xrefs: 00000001400938D0
msctls_hotkey32, xrefs: 00000001400931A4

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: MessageSend$CreateObjectReleaseSelectWindow
String ID: Can't create control.$msctls_hotkey32
API String ID: 3196501506-3973893855
Opcode ID: 2301e64a71ee3aa2c1bfefc54c5068a70f0baefa7c0a93070309763d01877511
Instruction ID: e90e5f1733ab73a77ab6744f97fdb76dbf7be91986c7bca6f702f49f029a746e
Opcode Fuzzy Hash: 2301e64a71ee3aa2c1bfefc54c5068a70f0baefa7c0a93070309763d01877511
Instruction Fuzzy Hash: F6310476605B4086EB52CF2AE8447DA73A1F74CB94F004026EF4D57B78EB39C9858B40

Function 00000001400CF29C Relevance: 12.1, APIs: 8, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 00000001400CF2C3

Part of subcall function 00000001400CF0A0: _set_error_mode.LIBCMT ref: 00000001400CF0A9
Part of subcall function 00000001400CF0A0: _set_error_mode.LIBCMT ref: 00000001400CF0B8

Part of subcall function 00000001400CEE40: _set_error_mode.LIBCMT ref: 00000001400CEE85
Part of subcall function 00000001400CEE40: _set_error_mode.LIBCMT ref: 00000001400CEE96
Part of subcall function 00000001400CEE40: GetModuleFileNameW.KERNEL32 ref: 00000001400CEEF8

Part of subcall function 00000001400CAC68: ExitProcess.KERNEL32 ref: 00000001400CAC77

Part of subcall function 00000001400D0A90: malloc.LIBCMT ref: 00000001400D0ABB
Part of subcall function 00000001400D0A90: Sleep.KERNEL32(?,?,00000000,00000001400CF2FD,?,?,?,00000001400CF3A7,?,?,00000000,00000001400CE795,?,?,00000000,00000001400CE84C), ref: 00000001400D0ACE

_errno.LIBCMT ref: 00000001400CF305
_lock.LIBCMT ref: 00000001400CF319
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,00000001400CF3A7,?,?,00000000,00000001400CE795,?,?,00000000,00000001400CE84C,?,?,00000000,00000001400CE883), ref: 00000001400CF32F
free.LIBCMT ref: 00000001400CF33C
_errno.LIBCMT ref: 00000001400CF341
LeaveCriticalSection.KERNEL32(?,?,?,00000001400CF3A7,?,?,00000000,00000001400CE795,?,?,00000000,00000001400CE84C,?,?,00000000,00000001400CE883), ref: 00000001400CF364

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: _set_error_mode$CriticalSection_errno$CountExitFileInitializeLeaveModuleNameProcessSleepSpin_lockfreemalloc
String ID:
API String ID: 113790786-0
Opcode ID: 9d2ad0cb5c3aa132dad9e8f2cd8e9d540916b23bcb062c7166a64acad54b91c9
Instruction ID: 70ea712b3aa96bde6a20baaca860df2a5f9cd2f9b9615de6e2662fdcb8acb3ee
Opcode Fuzzy Hash: 9d2ad0cb5c3aa132dad9e8f2cd8e9d540916b23bcb062c7166a64acad54b91c9
Instruction Fuzzy Hash: 77216A3160978092F66BAB63E4447FE62A4E78DBC4F584024BB4B476F2CF38C840A352

Function 000000014003C120 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 353COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 000000014003C1C5

Part of subcall function 00000001400CB13C: HeapFree.KERNEL32(?,?,00000000,00000001400CE860,?,?,00000000,00000001400CE883,?,?,?,00000001400CA7AB,?,?,00000000,00000001400CFD3B), ref: 00000001400CB152
Part of subcall function 00000001400CB13C: _errno.LIBCMT ref: 00000001400CB15C
Part of subcall function 00000001400CB13C: GetLastError.KERNEL32(?,?,00000000,00000001400CE860,?,?,00000000,00000001400CE883,?,?,?,00000001400CA7AB,?,?,00000000,00000001400CFD3B), ref: 00000001400CB164

Part of subcall function 0000000140032530: GlobalUnlock.KERNEL32 ref: 00000001400325F1
Part of subcall function 0000000140032530: CloseClipboard.USER32 ref: 00000001400325FE
Part of subcall function 0000000140032530: GetTickCount.KERNEL32 ref: 0000000140032611
Part of subcall function 0000000140032530: PeekMessageW.USER32 ref: 0000000140032645
Part of subcall function 0000000140032530: GetTickCount.KERNEL32 ref: 0000000140032659

free.LIBCMT ref: 000000014003C283
free.LIBCMT ref: 000000014003C511

Strings

Next, xrefs: 000000014003C2AA
_NewEnum, xrefs: 000000014003C245

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: free$CountTick$ClipboardCloseErrorFreeGlobalHeapLastMessagePeekUnlock_errno
String ID: Next$_NewEnum
API String ID: 837015515-2558596721
Opcode ID: a915b90e06ef80db93b94624eabc9a832a7ceb1fc68cb4a4a75ee571b4c7e0ae
Instruction ID: f673d8de0596612d9df3e71b8a84b1e73f218a0612a7808c57e5157c685c8a0b
Opcode Fuzzy Hash: a915b90e06ef80db93b94624eabc9a832a7ceb1fc68cb4a4a75ee571b4c7e0ae
Instruction Fuzzy Hash: 00F17C32225B4086EB678B66E490BEA73A0F78CBC4F104116FB8A87BB4DB38C555C700

Function 0000000140033194 Relevance: 10.8, APIs: 7, Instructions: 261clipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
GetCPInfo.KERNEL32 ref: 00000001400331E0

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: ClipboardCloseCountGlobalInfoTickUnlock
String ID:
API String ID: 3668674636-0
Opcode ID: c582d519fab311d654f38cffc0f10be5404751ce0c511796446b2bfb4ece11d5
Instruction ID: e036c066776a3bb8ad3e7c7ecc3197cb02cda619ffb32ceca40dca7c2bf38de4
Opcode Fuzzy Hash: c582d519fab311d654f38cffc0f10be5404751ce0c511796446b2bfb4ece11d5
Instruction Fuzzy Hash: 52D15C72605B8489EB778F26E8807DA37A1F74DB98F140216EB594BBF8DB38C585C740

Function 000000014003342D Relevance: 10.7, APIs: 7, Instructions: 231registrywindowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659
RegCloseKey.ADVAPI32 ref: 00000001400334D4

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CloseCountTick$ClipboardGlobalMessagePeekUnlock
String ID:
API String ID: 4107439908-0
Opcode ID: 31e9dbe00c167eb086e47e98f41aae961fee4f32809cdf6f03e109c25ba99e43
Instruction ID: 036ddfd78b5369459cc7606da6939e5f1cbf79a038acaaaa356241006e3216a0
Opcode Fuzzy Hash: 31e9dbe00c167eb086e47e98f41aae961fee4f32809cdf6f03e109c25ba99e43
Instruction Fuzzy Hash: 90C17C32605B848AEB678B27E8803DA77A1F74DBD4F140116EB9D47BB9DB38D881C740

Function 0000000140036335 Relevance: 10.7, APIs: 7, Instructions: 176windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659
GetTickCount.KERNEL32 ref: 0000000140032737
SetEnvironmentVariableW.KERNEL32 ref: 0000000140036343

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseEnvironmentGlobalMessagePeekUnlockVariable
String ID:
API String ID: 2791281230-0
Opcode ID: 20a08d5f949345fa6a2ffb47ef86632a8ceddeee645a111e3fd5a67181b52d70
Instruction ID: 890309bedc1a62689f78676692d84190fb97ff4fcbc2eee27db7e42531541b00
Opcode Fuzzy Hash: 20a08d5f949345fa6a2ffb47ef86632a8ceddeee645a111e3fd5a67181b52d70
Instruction Fuzzy Hash: 2F917E32205B4486FB6B8B27E9847EA37A1F74DBE4F140116EB59876F5CB38C881C740

Function 0000000140012330 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 155sleepCOMMON

Download Yara Rule

APIs

CharUpperW.USER32(?,?,00000000,0000000140002C32), ref: 0000000140012433
CharUpperW.USER32(?,?,00000000,0000000140002C32), ref: 0000000140012443
Sleep.KERNEL32 ref: 000000014001252F

Strings

%s%c, xrefs: 00000001400124A5
{Text}, xrefs: 000000014001248A
{Raw}, xrefs: 0000000140012476, 000000014001249E

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CharUpper$Sleep
String ID: %s%c${Raw}${Text}
API String ID: 3503790639-2444501380
Opcode ID: 4a69ece173c122f29f30c6244c732ff2e1cb9200d53ce880c7de8c75735feae2
Instruction ID: 290e6ca51a4438a4e51793e6a76c297ed545bf9ca9ec17b9afdb8059faadc4e6
Opcode Fuzzy Hash: 4a69ece173c122f29f30c6244c732ff2e1cb9200d53ce880c7de8c75735feae2
Instruction Fuzzy Hash: 0161E6762046A086EBA2DF26A0503ED77E5F74CBD8F449206EF99176E4DB39C5A2C700

Function 000000014007D14D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 144windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 000000014007D15D
SendMessageTimeoutW.USER32 ref: 000000014007D1CF
SendMessageTimeoutW.USER32 ref: 000000014007D20D
SendMessageTimeoutW.USER32 ref: 000000014007D27D

Strings

Combo, xrefs: 000000014007D167
List, xrefs: 000000014007D189

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: MessageSendTimeout$ClassName
String ID: Combo$List
API String ID: 639069792-1246219895
Opcode ID: ef34387278649e0a9e3090b024ebc4a9cda159660c225d96397582d42d10a6e9
Instruction ID: 1171324b8003e5d6b66f89a91c7b67f486758408702dbb99bc1053b83e97d334
Opcode Fuzzy Hash: ef34387278649e0a9e3090b024ebc4a9cda159660c225d96397582d42d10a6e9
Instruction Fuzzy Hash: 3561AD72204B8085EB628F22A8547E93B61F74DBE8F481717EB6917AE6CB7CC546C740

Function 000000014008D0CD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 118COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 000000014008D0D5
free.LIBCMT ref: 000000014008D39A
SetWindowTextW.USER32 ref: 000000014008D709

Strings

*, xrefs: 000000014008D10A
*, xrefs: 000000014008D1C8
Icon, xrefs: 000000014008D14E

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: ClientRectTextWindowfree
String ID: *$*$Icon
API String ID: 2069302144-1089620501
Opcode ID: a8d24be868176e6fccca1b2e79c796d3fcd5aca649af1eb40841a52a45553679
Instruction ID: a2bdb3aecaf9a529164ee71dc03c76f05c5d70ab16559ea24ed4d896a9f9ebc6
Opcode Fuzzy Hash: a8d24be868176e6fccca1b2e79c796d3fcd5aca649af1eb40841a52a45553679
Instruction Fuzzy Hash: 40419B7361064091EB229F27A4447EA77A0FB4DBD4F444213FF5A076F5EB38CA808341

Function 000000014009D0A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 000000014009D0FF
CallWindowProcW.USER32 ref: 000000014009D14A
CallWindowProcW.USER32 ref: 000000014009D1B2
GetClipBox.GDI32 ref: 000000014009D1EB
FillRect.USER32 ref: 000000014009D200

Strings

G, xrefs: 000000014009D18C

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CallProcWindow$ClipFillParentRect
String ID: G
API String ID: 2087348582-985283518
Opcode ID: c4665897967729e916852879166124e0a89fe792a3a6f193528a72de363e4987
Instruction ID: 6da50deb0444ec1dfe4370dd1496a6be5560bacb1a1a81d5764b524f10b4ae77
Opcode Fuzzy Hash: c4665897967729e916852879166124e0a89fe792a3a6f193528a72de363e4987
Instruction Fuzzy Hash: 8A416B32244B8096EB228F17E944799B7A1F79DFC4F884016EB8957BA9CF3CD492C740

Function 000000014008D09C Relevance: 10.6, APIs: 7, Instructions: 97windowCOMMON

Download Yara Rule

APIs

free.LIBCMT ref: 000000014008D39A
SendMessageW.USER32 ref: 000000014008D6FD
SetWindowTextW.USER32 ref: 000000014008D709

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: MessageSendTextWindowfree
String ID:
API String ID: 1940615249-0
Opcode ID: f0b39ff7a4c28e5b1fdfe792067065d9acff5515c104baa729600cdfd527192d
Instruction ID: 4bee30611761156c8798d0a7da4842659b3641d1f09ae16251bd38757665d3ad
Opcode Fuzzy Hash: f0b39ff7a4c28e5b1fdfe792067065d9acff5515c104baa729600cdfd527192d
Instruction Fuzzy Hash: 4B41A07660464082FB668B17E454BEE7362F38DBE4F504217EFA907AF5DE38CA848741

Function 000000014008D432 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 000000014008D36A
free.LIBCMT ref: 000000014008D39A
GetWindowLongW.USER32 ref: 000000014008D488
SetWindowLongW.USER32 ref: 000000014008D4BC

Part of subcall function 00000001400ACCD0: wcsncpy.LIBCMT ref: 00000001400ACD11
Part of subcall function 00000001400ACCD0: wcsncpy.LIBCMT ref: 00000001400ACD41
Part of subcall function 00000001400ACCD0: wcsncpy.LIBCMT ref: 00000001400ACD75
Part of subcall function 00000001400ACCD0: wcsncpy.LIBCMT ref: 00000001400ACDA9
Part of subcall function 00000001400ACCD0: wcsncpy.LIBCMT ref: 00000001400ACDDC
Part of subcall function 00000001400ACCD0: wcsncpy.LIBCMT ref: 00000001400ACE0F

Strings

LongDate, xrefs: 000000014008D49B
Time, xrefs: 000000014008D4DB

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: wcsncpy$LongWindow$MessageSendfree
String ID: LongDate$Time
API String ID: 3861369536-1184810688
Opcode ID: f131f44946ca2faca27cde7eb1b1c0c99926b2dc73491f76e2e0a9f24068757a
Instruction ID: b974b46f52c4f13ae4eb666a5d379edbf1e9fd90c3fd6ad36df029d6ec87be13
Opcode Fuzzy Hash: f131f44946ca2faca27cde7eb1b1c0c99926b2dc73491f76e2e0a9f24068757a
Instruction Fuzzy Hash: 7B319A36301A0082FA22CB17A4147DA73A1B79EBE0F945213FF6947AF4EA7CC684C641

Function 00000001400D3244 Relevance: 10.6, APIs: 7, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00000001400D3267
_errno.LIBCMT ref: 00000001400D326F

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: ad545a7a5eb9d23abb68cf3b12463611f57dc2d6637280295658be55f9464df7
Instruction ID: ec6dacf67ef8c237a30f63c2e458a0bc4d95c248734e0a6a7e4581654313df3e
Opcode Fuzzy Hash: ad545a7a5eb9d23abb68cf3b12463611f57dc2d6637280295658be55f9464df7
Instruction Fuzzy Hash: F421AE3271868086F61B6F67E9413EE7661AB8DBE1F094115BF150B3F2CBBC8842C761

Function 00000001400922B9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 0000000140092307
SendMessageW.USER32 ref: 0000000140092338
SelectObject.GDI32 ref: 00000001400938AC
ReleaseDC.USER32 ref: 00000001400938BD
SendMessageW.USER32 ref: 00000001400939BB
SendMessageW.USER32 ref: 00000001400939D7
GetClientRect.USER32 ref: 0000000140093A15
SetWindowLongW.USER32 ref: 0000000140093A3F
SendMessageW.USER32 ref: 0000000140093A61

Strings

Can't create control., xrefs: 00000001400938D0
button, xrefs: 00000001400922FC

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: MessageSend$Window$ClientCreateLongObjectRectReleaseSelect
String ID: Can't create control.$button
API String ID: 2656910855-1804316079
Opcode ID: 50f25d0ea784d3a1144de906f5d81eb5a4215fa7e32e3f6438b99134fd7a1411
Instruction ID: 9e45261d2f1b510f2a73e4d2978b169b6d92b1913de311270dde9a9ecedbd82c
Opcode Fuzzy Hash: 50f25d0ea784d3a1144de906f5d81eb5a4215fa7e32e3f6438b99134fd7a1411
Instruction Fuzzy Hash: 4C310776605B418AEB52CF6AE8447DA73A0F74C794F044026EF4D57B78DB38C9858B40

Function 00000001400610DD Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM ref: 0000000140061107
mciSendStringW.WINMM ref: 000000014006112C
mciSendStringW.WINMM ref: 0000000140061143

Strings

close cd wait, xrefs: 0000000140061132
status cd mode, xrefs: 000000014006111C
open %s type cdaudio alias cd wait shareable, xrefs: 00000001400610DD

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: SendString
String ID: close cd wait$open %s type cdaudio alias cd wait shareable$status cd mode
API String ID: 890592661-1182961480
Opcode ID: b623008924e6aa41acf57bcff2d582ea6a37b8a727334a20b9c3bc4becfc83f0
Instruction ID: 413c981e9c5f973b78b4bf7a5a7af0ff5cea8937b5b9c5e84bddf9f7d0e327a8
Opcode Fuzzy Hash: b623008924e6aa41acf57bcff2d582ea6a37b8a727334a20b9c3bc4becfc83f0
Instruction Fuzzy Hash: 2F117C727149C184F7329BA6EC10BDA2351F79C7F8F801212ABAD4BDE5AE38C685C750

Function 0000000140037359 Relevance: 9.3, APIs: 6, Instructions: 271windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
String ID:
API String ID: 1623861271-0
Opcode ID: 11f1efa6304c6e14f19f0f5e0f5bc303de5e70dc929964bb0bc86006a2ce64c0
Instruction ID: 256026de99d9cf3ff002d92b8d3527f4485dda61e8902aabdc844707c29aa2bd
Opcode Fuzzy Hash: 11f1efa6304c6e14f19f0f5e0f5bc303de5e70dc929964bb0bc86006a2ce64c0
Instruction Fuzzy Hash: 14C1C031604B4086EB678B27A4907EA7792BB8DBD4F544216FB5A877F5CB38D881C740

Function 0000000140037104 Relevance: 9.2, APIs: 6, Instructions: 209windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659
GetTickCount.KERNEL32 ref: 0000000140032737

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
String ID:
API String ID: 1623861271-0
Opcode ID: 4f9453b816e19bcec56ecb85bb6a6c256d7ede63f7291ba5723efc997ddce093
Instruction ID: 3062a13442cdb81b198be0dc333b27c03537e0049c1c2e0fc2dee1fafefcf519
Opcode Fuzzy Hash: 4f9453b816e19bcec56ecb85bb6a6c256d7ede63f7291ba5723efc997ddce093
Instruction Fuzzy Hash: 98A15E32604B4086FB6B8B27E9847EA37A2F78DBD4F540116EB594B6F5DB38D881C740

Function 000000014003301F Relevance: 9.2, APIs: 6, Instructions: 204windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659
GetTickCount.KERNEL32 ref: 0000000140032737

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
String ID:
API String ID: 1623861271-0
Opcode ID: 4d605923c47389e9cc02143b470628ecc5b39cb261d8f93954f228e6492b11c4
Instruction ID: a4602782116666506e0fd3a0ad5bfefcd1b9966ea6b24ed31e46a5ebd05d8295
Opcode Fuzzy Hash: 4d605923c47389e9cc02143b470628ecc5b39cb261d8f93954f228e6492b11c4
Instruction Fuzzy Hash: CFA18E32605B448AEB6B8B27E8807EA37A1F74DBD4F140116EB9947BF5DB38C885C740

Function 0000000140033032 Relevance: 9.2, APIs: 6, Instructions: 200windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659
GetTickCount.KERNEL32 ref: 0000000140032737

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
String ID:
API String ID: 1623861271-0
Opcode ID: 235567b4a539b84e1b81d919603877acefeee53b2943336f8ebd81acfbe19734
Instruction ID: 93c240c575e31bc1aedfd5c41dd4c06a756d8b00d4753da70155ebfec874e4fa
Opcode Fuzzy Hash: 235567b4a539b84e1b81d919603877acefeee53b2943336f8ebd81acfbe19734
Instruction Fuzzy Hash: D8A17E72605B448AEB6B8B27E8807EA37A1F74DBD4F140116EB9947BF5DB38C885C740

Function 00000001400372B7 Relevance: 9.2, APIs: 6, Instructions: 199windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659

Part of subcall function 00000001400CA93C: _errno.LIBCMT ref: 00000001400CA954
Part of subcall function 00000001400CA93C: _invalid_parameter_noinfo.LIBCMT ref: 00000001400CA95F

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock_errno_invalid_parameter_noinfo
String ID:
API String ID: 130734711-0
Opcode ID: 9f07d58d0d4aa81e37f2da7414d3382a665a53c98a9daa0cc3974cca9eea0101
Instruction ID: b7b6c6495f5e1853da77f15ece4a05a12a4ddb9dbf7fed96c9a9668c7ed4089e
Opcode Fuzzy Hash: 9f07d58d0d4aa81e37f2da7414d3382a665a53c98a9daa0cc3974cca9eea0101
Instruction Fuzzy Hash: 95A18E32205B4086FB6B8B27E9947EA27A2F74DBD4F540116FB5A47AF5DB38C881C740

Function 00000001400330A4 Relevance: 9.2, APIs: 6, Instructions: 196windowclipboardCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014003C120: free.LIBCMT ref: 000000014003C1C5
Part of subcall function 000000014003C120: free.LIBCMT ref: 000000014003C283

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659
GetTickCount.KERNEL32 ref: 0000000140032737

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$free$ClipboardCloseGlobalMessagePeekUnlock
String ID:
API String ID: 2285768414-0
Opcode ID: 5b17608751a2a164f42a96357fd4133f88a9332afe6b4f15cb5daf2bf8fbab40
Instruction ID: 52f847c03b826b23b247fa03328dac30ee99f23286bbf4326b9fc937114cde34
Opcode Fuzzy Hash: 5b17608751a2a164f42a96357fd4133f88a9332afe6b4f15cb5daf2bf8fbab40
Instruction Fuzzy Hash: 31A17E72605B448AEB6B8B27E8807EA37A1F74DBD4F140116EB5947BF5DB38C881C740

Function 0000000140033075 Relevance: 9.2, APIs: 6, Instructions: 195windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659
GetTickCount.KERNEL32 ref: 0000000140032737

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
String ID:
API String ID: 1623861271-0
Opcode ID: c2121accbc250d7c23e7a0c62bfa4c0ccf5337ab98f8c4eae53243ba9920d64c
Instruction ID: adc9ad99e7b5c9d920b62b5e1cd2f392e971b6f5eb3158599f56def3a74d26cf
Opcode Fuzzy Hash: c2121accbc250d7c23e7a0c62bfa4c0ccf5337ab98f8c4eae53243ba9920d64c
Instruction Fuzzy Hash: CCA17D72605B448AEB6B8B27E8807EA37A1F74DBE4F140116EB5947BF5DB38C881C740

Function 0000000140037081 Relevance: 9.2, APIs: 6, Instructions: 193windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659

Part of subcall function 00000001400CA93C: _errno.LIBCMT ref: 00000001400CA954
Part of subcall function 00000001400CA93C: _invalid_parameter_noinfo.LIBCMT ref: 00000001400CA95F

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock_errno_invalid_parameter_noinfo
String ID:
API String ID: 130734711-0
Opcode ID: fda96e2a8a9bc7cc17e84f70c67a8b7b9356e97c7db0b368c7509fb5501b6c3c
Instruction ID: 1b0914023163c2e64a45956e7af399aa0c4867361e990f590feb0060999324e5
Opcode Fuzzy Hash: fda96e2a8a9bc7cc17e84f70c67a8b7b9356e97c7db0b368c7509fb5501b6c3c
Instruction Fuzzy Hash: 37A18232205B4486FB6B8B27E8847DA77A1F74DBE4F140216EBA9476F5DB38D881C740

Function 00000001400383AB Relevance: 9.2, APIs: 6, Instructions: 189windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659
GetTickCount.KERNEL32 ref: 0000000140032737

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
String ID:
API String ID: 1623861271-0
Opcode ID: 6e4b562abde269d2ffce79ad3eb3f33088fa22258cb07a6ee9b7c19f147c17d9
Instruction ID: 16975150cb37f0c415594a513e949aeede9941befb4e18578397c8f657ba842e
Opcode Fuzzy Hash: 6e4b562abde269d2ffce79ad3eb3f33088fa22258cb07a6ee9b7c19f147c17d9
Instruction Fuzzy Hash: F9A15B72205B4486EB6B8B27E8947EA37A1F74DB94F540116EB9A877F5DB38C880C740

Function 000000014003725C Relevance: 9.2, APIs: 6, Instructions: 187windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
String ID:
API String ID: 1623861271-0
Opcode ID: 29d46daecfd6c1ab94754c8e42f08b483b4b7ad33dcc187a5e2b26371c78edb2
Instruction ID: 0e045dce7a7ac05f1727797ea70e3533dc301ca18eb65ea9c70cbd7f7ed64eab
Opcode Fuzzy Hash: 29d46daecfd6c1ab94754c8e42f08b483b4b7ad33dcc187a5e2b26371c78edb2
Instruction Fuzzy Hash: 02917C32205B4486FB6B8B27E9847EA27A2F74DBE4F540116FB5947AF5DB38C881C740

Function 0000000140036127 Relevance: 9.2, APIs: 6, Instructions: 183windowclipboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00000001400B24A0: GetForegroundWindow.USER32 ref: 00000001400B24F8
Part of subcall function 00000001400B24A0: IsWindowVisible.USER32 ref: 00000001400B2512
Part of subcall function 00000001400B24A0: IsIconic.USER32 ref: 00000001400B252B
Part of subcall function 00000001400B24A0: ShowWindow.USER32 ref: 00000001400B253D

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659
GetTickCount.KERNEL32 ref: 0000000140032737

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTickWindow$ClipboardCloseForegroundGlobalIconicMessagePeekShowUnlockVisible
String ID:
API String ID: 1891409732-0
Opcode ID: 474db3361d6cb00c851422da59491b9fe19f6d6e608f2924dd988dc52ddf978d
Instruction ID: 108dd4720717dc297064358b89f323d10a91c8bb459f775f1ed9779adc1728a3
Opcode Fuzzy Hash: 474db3361d6cb00c851422da59491b9fe19f6d6e608f2924dd988dc52ddf978d
Instruction Fuzzy Hash: 1B915B32605B4486FB6B8B26E9847EA27A1F74DBE4F140216EB59477F5DB38C881C740

Function 0000000140038450 Relevance: 9.2, APIs: 6, Instructions: 178windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659
GetTickCount.KERNEL32 ref: 0000000140032737

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
String ID:
API String ID: 1623861271-0
Opcode ID: 7282b611e91975fc39ddc2a89ade70938e04e85031ca618922a3173ec0b826eb
Instruction ID: 78785c3cbe08bfba237a871a8be01342995a798ea286aa3158a64a0582c0db41
Opcode Fuzzy Hash: 7282b611e91975fc39ddc2a89ade70938e04e85031ca618922a3173ec0b826eb
Instruction Fuzzy Hash: 8D916E72605B4486FB6B8B27E8847EA37A1F74DBD4F140116EB99876F5DB38C880C740

Function 000000014003841E Relevance: 9.2, APIs: 6, Instructions: 176windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659
GetTickCount.KERNEL32 ref: 0000000140032737

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
String ID:
API String ID: 1623861271-0
Opcode ID: 097400ee377d71015732fe70d44ad5a25a5464047df3ee7aac297d07749a10d9
Instruction ID: 24258ca19ae4cc376ea46207ffc257fe1ddea7c0f722d8a74cb40f6ec1306204
Opcode Fuzzy Hash: 097400ee377d71015732fe70d44ad5a25a5464047df3ee7aac297d07749a10d9
Instruction Fuzzy Hash: 37916C32605B4486FB6B8B27E9847EA37A1F74DBE4F140116EB99876F5DB38C881C740

Function 0000000140038486 Relevance: 9.2, APIs: 6, Instructions: 174windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659
GetTickCount.KERNEL32 ref: 0000000140032737

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
String ID:
API String ID: 1623861271-0
Opcode ID: 20937d07b7ec443d1290ccb3687e343834777417b315d4c58962611b6f3c9465
Instruction ID: 9ede9284b01ad9c54fa9553e724d8f5eaf42f20ea0b45159e10fb819c5f11bf2
Opcode Fuzzy Hash: 20937d07b7ec443d1290ccb3687e343834777417b315d4c58962611b6f3c9465
Instruction Fuzzy Hash: 0F916D32605B4486FB6B8B27E9847EA37A1F74DBE4F540116EB59876F5CB38C881C740

Function 0000000140037FEE Relevance: 9.2, APIs: 6, Instructions: 173windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659
GetTickCount.KERNEL32 ref: 0000000140032737

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
String ID:
API String ID: 1623861271-0
Opcode ID: 89bed825c10a8107c2bdd71ce8bdbcd5eda30dcc88ab4f522c63f73569ed4c61
Instruction ID: 8d5b52684aa429c7ee70d31da494f3550016cab0babc622c643ff50bf017b42f
Opcode Fuzzy Hash: 89bed825c10a8107c2bdd71ce8bdbcd5eda30dcc88ab4f522c63f73569ed4c61
Instruction Fuzzy Hash: C8819232604B4486FB6B8B27E9847EA37A1F74DBD4F540116EB59876F5CB38C881C740

Function 00000001400381A6 Relevance: 9.2, APIs: 6, Instructions: 173windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659
GetTickCount.KERNEL32 ref: 0000000140032737

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
String ID:
API String ID: 1623861271-0
Opcode ID: 13c65b8809adb2771ee3ee3802194ef110178492ea5e1fd7a7bb93b5b5393b89
Instruction ID: 44bea928dbf1d718e2dcfe6261f4a1a9470d8100de863f413b05a363a9f97bca
Opcode Fuzzy Hash: 13c65b8809adb2771ee3ee3802194ef110178492ea5e1fd7a7bb93b5b5393b89
Instruction Fuzzy Hash: 9E819F32605B4486FB6B8B27E9847EA37A1F74DBE4F140116EB5987AF5CB38C881C740

Function 00000001400363A7 Relevance: 9.2, APIs: 6, Instructions: 173windowclipboardCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014007E4B0: _wcstoi64.LIBCMT ref: 000000014007E514
Part of subcall function 000000014007E4B0: InternetOpenW.WININET ref: 000000014007E589
Part of subcall function 000000014007E4B0: InternetOpenUrlW.WININET ref: 000000014007E5AC
Part of subcall function 000000014007E4B0: InternetCloseHandle.WININET ref: 000000014007E5BD

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659
GetTickCount.KERNEL32 ref: 0000000140032737

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountInternetTick$CloseOpen$ClipboardGlobalHandleMessagePeekUnlock_wcstoi64
String ID:
API String ID: 2751744677-0
Opcode ID: 294336bac3d7c789dc46a71d9fc15464a765e6c2eabe80b3a43f82402f17de1c
Instruction ID: 59822f3d5b07b7ced912f3e283c707f6eeb56b668b6f5dfc93c5f8bd2cf687a7
Opcode Fuzzy Hash: 294336bac3d7c789dc46a71d9fc15464a765e6c2eabe80b3a43f82402f17de1c
Instruction Fuzzy Hash: E0817E72605B4486FB6B8B27E9847EA37A1F74DBE4F140116EB59876F5CB38C881C740

Function 0000000140035FE9 Relevance: 9.2, APIs: 6, Instructions: 172windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659
GetTickCount.KERNEL32 ref: 0000000140032737

Part of subcall function 0000000140015000: CloseHandle.KERNEL32 ref: 00000001400150CE
Part of subcall function 0000000140015000: CreateMutexW.KERNEL32 ref: 00000001400150DF
Part of subcall function 0000000140015000: GetLastError.KERNEL32 ref: 00000001400150E8
Part of subcall function 0000000140015000: GetWindowThreadProcessId.USER32 ref: 00000001400151A4

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$Close$ClipboardCreateErrorGlobalHandleLastMessageMutexPeekProcessThreadUnlockWindow
String ID:
API String ID: 4284707085-0
Opcode ID: efb604493175c8fb7e7ff0e03cb91f20f8723b5744976cdd8e6ada504cb0779b
Instruction ID: 36d95e66d007a8a1702a47698cd9b2a5230d39607dfe82fb474ea644de980a3e
Opcode Fuzzy Hash: efb604493175c8fb7e7ff0e03cb91f20f8723b5744976cdd8e6ada504cb0779b
Instruction Fuzzy Hash: 1B818E32605B4086FB6B8B27E9847EA37A1F74DBE4F540116EB5947AF5CB38C881C740

Function 0000000140038237 Relevance: 9.2, APIs: 6, Instructions: 172windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659
GetTickCount.KERNEL32 ref: 0000000140032737

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
String ID:
API String ID: 1623861271-0
Opcode ID: 123a06987ecf8c68c36598631fe68ac086bdb585f4291db41096250623765460
Instruction ID: d372c14478e038978bf52c0b34d9c52277e846fd01df17490c32a7e7b1a393da
Opcode Fuzzy Hash: 123a06987ecf8c68c36598631fe68ac086bdb585f4291db41096250623765460
Instruction Fuzzy Hash: A0819F32605B4486FB6B8B27E8847EA37A1F74DBE4F540116EB5A876F5CB38C881C740

Function 0000000140037341 Relevance: 9.2, APIs: 6, Instructions: 172windowclipboardCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014005E970: GetKeyboardLayout.USER32 ref: 000000014005E998

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659
GetTickCount.KERNEL32 ref: 0000000140032737

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalKeyboardLayoutMessagePeekUnlock
String ID:
API String ID: 2243892272-0
Opcode ID: 1901fdd2645866d56a98b11b3b4c0bb1e7609c20aa904f69cdda5b055c0becaf
Instruction ID: c96983479b17fdde475b0f50e44497174fa8529c2231265a3e3e9b4271bfab20
Opcode Fuzzy Hash: 1901fdd2645866d56a98b11b3b4c0bb1e7609c20aa904f69cdda5b055c0becaf
Instruction Fuzzy Hash: 6C817E32605B4486FB6B8B27E9847EA37A1F74DBE4F140116EB59876F5CB38C881C740

Function 0000000140038393 Relevance: 9.2, APIs: 6, Instructions: 172windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659
GetTickCount.KERNEL32 ref: 0000000140032737

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
String ID:
API String ID: 1623861271-0
Opcode ID: 6d056b46ac2f48d444ca0ef7efcdfc88a25621fc441d703d756864a16657adbd
Instruction ID: 5cf0ce040c48bd4e97a3c20b0c30d7139442da201f03fc45af4066b4fa01dbfd
Opcode Fuzzy Hash: 6d056b46ac2f48d444ca0ef7efcdfc88a25621fc441d703d756864a16657adbd
Instruction Fuzzy Hash: 60817E32605B4486FB6B8B27E9847EA37A1F74DBE4F140116EB5987AF5CB38C881C740

Function 000000014003820B Relevance: 9.2, APIs: 6, Instructions: 167windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659
GetTickCount.KERNEL32 ref: 0000000140032737

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
String ID:
API String ID: 1623861271-0
Opcode ID: cfb7359b5f75b4019ebd8be0a8b89bbec5e4653d2b16b609817c35d838be6548
Instruction ID: 5e2923f897fe513f2e3a7ab9933315d18b27bae760ae73d00eaa2373f2707fc5
Opcode Fuzzy Hash: cfb7359b5f75b4019ebd8be0a8b89bbec5e4653d2b16b609817c35d838be6548
Instruction Fuzzy Hash: F6819032604B4486FB6B8B27E9847EA37A1F74DBE4F140116EB5947AF5CB38C881C740

Function 000000014003821B Relevance: 9.2, APIs: 6, Instructions: 167windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659
GetTickCount.KERNEL32 ref: 0000000140032737

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
String ID:
API String ID: 1623861271-0
Opcode ID: 8bd50bdc9f44a6e81e26301daec8a8591ef9c6b9d41d691b31a5051d0f2cbb18
Instruction ID: a8d325e737a768574cd6545b6052048c37d5ca1428fe52325d3bd1e965384067
Opcode Fuzzy Hash: 8bd50bdc9f44a6e81e26301daec8a8591ef9c6b9d41d691b31a5051d0f2cbb18
Instruction Fuzzy Hash: 6481AF32604B4486FB6B8B27E8847EA37A1F74DBE4F140116EB5987AF5CB38C881C740

Function 0000000140038224 Relevance: 9.2, APIs: 6, Instructions: 167windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659
GetTickCount.KERNEL32 ref: 0000000140032737

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
String ID:
API String ID: 1623861271-0
Opcode ID: 10b5a820dcae4762e7fec9a5713a5cc860debfb8a06dee147a4ccc748156b657
Instruction ID: cab89d96ecfced6d3122158effd6b8ee9174d2f78fc40e5ec4ef27a80affa3ab
Opcode Fuzzy Hash: 10b5a820dcae4762e7fec9a5713a5cc860debfb8a06dee147a4ccc748156b657
Instruction Fuzzy Hash: 4D818032605B4486FB6B8B27E9847EA37A1F74DBE4F140116EB5947AF5CB38D881C740

Function 00000001400381FE Relevance: 9.2, APIs: 6, Instructions: 166windowclipboardCOMMON

Download Yara Rule

APIs

GlobalUnlock.KERNEL32 ref: 00000001400325F1
CloseClipboard.USER32 ref: 00000001400325FE
GetTickCount.KERNEL32 ref: 0000000140032611
PeekMessageW.USER32 ref: 0000000140032645
GetTickCount.KERNEL32 ref: 0000000140032659
GetTickCount.KERNEL32 ref: 0000000140032737

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
String ID:
API String ID: 1623861271-0
Opcode ID: 5310c27edf3264255273b9b238ebac3364617d6b5671075f11a92825f77b75ae
Instruction ID: 9352bc3e8c24dcb03e778793e608d2337ff5949a586c76a5c309c754917cbfc7
Opcode Fuzzy Hash: 5310c27edf3264255273b9b238ebac3364617d6b5671075f11a92825f77b75ae
Instruction Fuzzy Hash: 65818032605B4486FB6B8B27E9847EA37A1F74DBE4F140116EB5947AF5CB38D881C740

Function 00000001400CE184 Relevance: 9.1, APIs: 6, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000001400CE1A3

Part of subcall function 00000001400CE878: _amsg_exit.LIBCMT ref: 00000001400CE88E

Part of subcall function 00000001400CDDC0: _getptd.LIBCMT ref: 00000001400CDDCA
Part of subcall function 00000001400CDDC0: _amsg_exit.LIBCMT ref: 00000001400CDE67

Part of subcall function 00000001400CDE7C: GetOEMCP.KERNEL32 ref: 00000001400CDEA6

Part of subcall function 00000001400D0A90: malloc.LIBCMT ref: 00000001400D0ABB
Part of subcall function 00000001400D0A90: Sleep.KERNEL32(?,?,00000000,00000001400CF2FD,?,?,?,00000001400CF3A7,?,?,00000000,00000001400CE795,?,?,00000000,00000001400CE84C), ref: 00000001400D0ACE

free.LIBCMT ref: 00000001400CE22E

Part of subcall function 00000001400CB13C: HeapFree.KERNEL32(?,?,00000000,00000001400CE860,?,?,00000000,00000001400CE883,?,?,?,00000001400CA7AB,?,?,00000000,00000001400CFD3B), ref: 00000001400CB152
Part of subcall function 00000001400CB13C: _errno.LIBCMT ref: 00000001400CB15C
Part of subcall function 00000001400CB13C: GetLastError.KERNEL32(?,?,00000000,00000001400CE860,?,?,00000000,00000001400CE883,?,?,?,00000001400CA7AB,?,?,00000000,00000001400CFD3B), ref: 00000001400CB164

_lock.LIBCMT ref: 00000001400CE25E
free.LIBCMT ref: 00000001400CE301
free.LIBCMT ref: 00000001400CE32D
_errno.LIBCMT ref: 00000001400CE332

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: free$_amsg_exit_errno_getptd$ErrorFreeHeapLastSleep_lockmalloc
String ID:
API String ID: 3894533514-0
Opcode ID: 109706b8a66771fc516ae501ca6e0cea2c3d92e95fc340ac98deb16d56ffc451
Instruction ID: ce9c465b5f9671af8fabbfb1ec33ac92ab35e6e81bac7191a63f217f3f5ab8f5
Opcode Fuzzy Hash: 109706b8a66771fc516ae501ca6e0cea2c3d92e95fc340ac98deb16d56ffc451
Instruction Fuzzy Hash: E7516A326087C086E76A9B26A4503ED7BA5F78CBD4F584116EB5A477F6CB38C442C701

Function 000000014009F310 Relevance: 9.1, APIs: 6, Instructions: 78windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 000000014009F36A
SendMessageW.USER32 ref: 000000014009F399
SendMessageW.USER32 ref: 000000014009F3C5
SendMessageW.USER32 ref: 000000014009F3E1
GetWindowRect.USER32(?,?,?,?,?,?,?,?,?,?,00000001400032E4), ref: 000000014009F3F9
MapWindowPoints.USER32 ref: 000000014009F411

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: MessageSend$Window$PointsRect
String ID:
API String ID: 467674420-0
Opcode ID: 0b0b22af914a2d0afc4da98d83331fd535dbec743a4d1b94c18d9b66846e12a3
Instruction ID: 59eaf44d3465d8b35417c64751a2ed678019201740f9ddbd26216175fbe25e1a
Opcode Fuzzy Hash: 0b0b22af914a2d0afc4da98d83331fd535dbec743a4d1b94c18d9b66846e12a3
Instruction Fuzzy Hash: B2316F7221458486E7658B26E454BE96361F38CBA8F248315EBB947EE4CB3CC985DB00

Function 0000000140053347 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 244COMMON

Download Yara Rule

APIs

EnumDisplayMonitors.USER32 ref: 0000000140053363

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 0000000140053423
Out of memory., xrefs: 000000014005366D

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: DisplayEnumMonitors
String ID: Memory limit reached (see #MaxMem in the help file).$Out of memory.
API String ID: 2950131505-457448710
Opcode ID: a6169deb700a0e06f37d64f9ab29cc62b220a76634873c38644ab5e33e9c4608
Instruction ID: 96d1a0763dbeee97bcac7c2d280f6e143df5d11a56b7374a967e5be6b0df98fa
Opcode Fuzzy Hash: a6169deb700a0e06f37d64f9ab29cc62b220a76634873c38644ab5e33e9c4608
Instruction Fuzzy Hash: 0C910333704A4485FB53CB26E5053E963A5E74CBE8F944226EF1D076E5EB7AC986C340

Function 0000000140052FED Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 215COMMON

Download Yara Rule

APIs

EnumDisplayMonitors.USER32 ref: 0000000140053283

Strings

%sTop, xrefs: 00000001400530B7
%sRight, xrefs: 000000014005314D
%sLeft, xrefs: 000000014005301D
%sBottom, xrefs: 00000001400531DB

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: DisplayEnumMonitors
String ID: %sBottom$%sLeft$%sRight$%sTop
API String ID: 2950131505-791481470
Opcode ID: 1b9fb7368a7a5ec7767aa46219a4a426b4fea46ff8534c9f762eca01c8b13fa5
Instruction ID: 6104fbdd180b1ebbca2dd57d5ea3ef4db4be125a42b8e785361d8841bedf7361
Opcode Fuzzy Hash: 1b9fb7368a7a5ec7767aa46219a4a426b4fea46ff8534c9f762eca01c8b13fa5
Instruction Fuzzy Hash: E991C232315A4596EB26DF62A8503EE67A0F78CBC8F84411AFB4D177A9DB38CA05C740

Function 00000001400B0330 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 206COMMON

Download Yara Rule

APIs

_ui64tow.LIBCMT ref: 00000001400B0363

Part of subcall function 00000001400CA778: x64tow.LIBCMT ref: 00000001400CA784

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 00000001400B040B
Out of memory., xrefs: 00000001400B0652

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: _ui64towx64tow
String ID: Memory limit reached (see #MaxMem in the help file).$Out of memory.
API String ID: 1462570195-457448710
Opcode ID: 7c0da6fabf652102797557f9628538cc1f138ae57cd20c1162d02663d21464b3
Instruction ID: e1e60c201c17dd59cff7637964c0dd54fa8a0926c9b49d58692abcb5b6801267
Opcode Fuzzy Hash: 7c0da6fabf652102797557f9628538cc1f138ae57cd20c1162d02663d21464b3
Instruction Fuzzy Hash: 2091DFB2604F8081EB62DF66D4443D963B2E79CBD8F548212EB5E17AE9DB78C842C700

Function 000000014009B300 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

Strings

0, xrefs: 000000014009B36D

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: ecd6a1a0488ee25ef857c356cbce38797bf3ad880ef3e3f6284c6a284c5b08ce
Instruction ID: df47dac0959f8134fbde6b7bf792d9b721d089bc68ee7e9e8f38af09b3997321
Opcode Fuzzy Hash: ecd6a1a0488ee25ef857c356cbce38797bf3ad880ef3e3f6284c6a284c5b08ce
Instruction Fuzzy Hash: 7571DE32601A1582EF669B1796987FE6395F78CBE4F898025FF49477F5DB38C8828304

Function 000000014007E07E Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32 ref: 000000014007E086

Part of subcall function 00000001400CAFEC: _errno.LIBCMT ref: 00000001400CB024
Part of subcall function 00000001400CAFEC: _invalid_parameter_noinfo.LIBCMT ref: 00000001400CB02F

Strings

Memory limit reached (see #MaxMem in the help file)., xrefs: 000000014007CD16
0x%08X, xrefs: 000000014007E08C

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: LongWindow_errno_invalid_parameter_noinfo
String ID: 0x%08X$Memory limit reached (see #MaxMem in the help file).
API String ID: 2099978093-1054076255
Opcode ID: e4935590cbc62a702f174648dc692bf73cee3755c9a1e52cea24068a89b4d623
Instruction ID: af5fdc5f26cf2f9e228e43a7565cac3d066cbcd2e19132fa692e3dbde0dfaddd
Opcode Fuzzy Hash: e4935590cbc62a702f174648dc692bf73cee3755c9a1e52cea24068a89b4d623
Instruction Fuzzy Hash: 0061B132205AC085EB239F26D4153E86762F74DBE8F544212FB6E176FADB78C985C341

Function 00000001400DD334 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 143COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000001400DD365

Part of subcall function 00000001400CE878: _amsg_exit.LIBCMT ref: 00000001400CE88E

_getptd.LIBCMT ref: 00000001400DD383
_CallSETranslator.LIBCMT ref: 00000001400DD3CB

Part of subcall function 00000001400DAF04: _getptd.LIBCMT ref: 00000001400DAF2B

Strings

MOC, xrefs: 00000001400DD399
RCC, xrefs: 00000001400DD3A1

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: _getptd$CallTranslator_amsg_exit
String ID: MOC$RCC
API String ID: 1374396951-2084237596
Opcode ID: f0490d82c3152d226713c68da8ad3ed72ecbe5da1afd90ea43171ad09c610d99
Instruction ID: 618cddc3978ddaf1eda6e7762d9c092d86c6106030b4caabdf5e1d2aa95b0d50
Opcode Fuzzy Hash: f0490d82c3152d226713c68da8ad3ed72ecbe5da1afd90ea43171ad09c610d99
Instruction Fuzzy Hash: 2E61AF72204AC196EF21DF06E1843EDB3A1FB89BD8F444526FB8E436A9DB78C156C710

Function 000000014008D208 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 000000014008D36A
free.LIBCMT ref: 000000014008D39A
SetWindowTextW.USER32 ref: 000000014008D709

Strings

., xrefs: 000000014008D299
, xrefs: 000000014008D286

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: MessageSendTextWindowfree
String ID: $.
API String ID: 1940615249-3929174939
Opcode ID: ef4354657f3a90f0dddbe7cf17e695981790e630a7beee99e456c061524a9924
Instruction ID: d88c4c12fb166030a45d8ba9f873245aa0f10129152134ecffbe905dc60b18a5
Opcode Fuzzy Hash: ef4354657f3a90f0dddbe7cf17e695981790e630a7beee99e456c061524a9924
Instruction Fuzzy Hash: E651AD77A0565081FBBA5B07A6907FA73A1B72D7E0F544317FF66076F4EA38CA818201

Function 00000001400401C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 000000014004022D
CloseHandle.KERNEL32 ref: 0000000140040310
free.LIBCMT ref: 000000014004032B

Strings

%s (%d) : ==> Warning: %s, xrefs: 00000001400401C3
This variable has not been assigned a value., xrefs: 00000001400401C4

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CloseHandleInfofree
String ID: %s (%d) : ==> Warning: %s$This variable has not been assigned a value.
API String ID: 3828278840-1383411024
Opcode ID: 1e6362a6c0a85336ba1fe3f2ae1b3fbafeb69316f478db661aee68edd0b1e3fc
Instruction ID: fb0eac697b5f55007fa4abc33d582baeb4f189838cc25100ec0d8e8fa4020945
Opcode Fuzzy Hash: 1e6362a6c0a85336ba1fe3f2ae1b3fbafeb69316f478db661aee68edd0b1e3fc
Instruction Fuzzy Hash: 0B413636B10B608AE711DFA6D8447DD37B5F708BB8F150319EE6927AE8CB74894AC740

Function 00000001400572A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00000001400572E5
RegQueryValueExW.ADVAPI32 ref: 000000014005732A
RegCloseKey.ADVAPI32 ref: 000000014005733A

Strings

SOFTWARE\AutoHotkey, xrefs: 00000001400572CB
InstallDir, xrefs: 0000000140057303

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: InstallDir$SOFTWARE\AutoHotkey
API String ID: 3677997916-1488329376
Opcode ID: b466d426b49704074212477563699983142115fa842fe7501527ebdb8d9179d4
Instruction ID: c4cef63d70eccadabbb6e46286a49b338ab0521d67edae509f39682bae8ba37a
Opcode Fuzzy Hash: b466d426b49704074212477563699983142115fa842fe7501527ebdb8d9179d4
Instruction Fuzzy Hash: 2131B772718B8581EB75CB16F0947AE7360F788BA4F445218EF4D03B68EB79C544EB44

Function 00000001400920FC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 0000000140092168
SelectObject.GDI32 ref: 00000001400938AC
ReleaseDC.USER32 ref: 00000001400938BD

Part of subcall function 0000000140097B20: SendMessageW.USER32 ref: 0000000140097B8E
Part of subcall function 0000000140097B20: DestroyIcon.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000014008D1F8), ref: 0000000140097B97

SendMessageW.USER32 ref: 00000001400939BB
SendMessageW.USER32 ref: 00000001400939D7
GetClientRect.USER32 ref: 0000000140093A15
SetWindowLongW.USER32 ref: 0000000140093A3F
SendMessageW.USER32 ref: 0000000140093A61

Strings

Can't create control., xrefs: 00000001400938D0
static, xrefs: 000000014009215D

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: MessageSend$Window$ClientCreateDestroyIconLongObjectRectReleaseSelect
String ID: Can't create control.$static
API String ID: 95896621-3511495095
Opcode ID: b9c9e5cf28bbfc12fa7f1ded94f36d5b7ba181e00f6f085c62c93e8a6c72827b
Instruction ID: 586b41cfcac70b225bb06d45e52b89bd9bc2ab7f57b92327c33eb7e6637d0895
Opcode Fuzzy Hash: b9c9e5cf28bbfc12fa7f1ded94f36d5b7ba181e00f6f085c62c93e8a6c72827b
Instruction Fuzzy Hash: 4D311872705B808AEB52CF2AE8807D977A1F78C798F148026EF4D57B68DB38C945CB00

Function 00000001400920F3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 00000001400920E0
SelectObject.GDI32 ref: 00000001400938AC
ReleaseDC.USER32 ref: 00000001400938BD
SendMessageW.USER32 ref: 00000001400939BB
SendMessageW.USER32 ref: 00000001400939D7
GetClientRect.USER32 ref: 0000000140093A15
SetWindowLongW.USER32 ref: 0000000140093A3F
SendMessageW.USER32 ref: 0000000140093A61

Strings

Can't create control., xrefs: 00000001400938D0
SysLink, xrefs: 00000001400920F3

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: MessageSend$Window$ClientCreateLongObjectRectReleaseSelect
String ID: Can't create control.$SysLink
API String ID: 2656910855-3028581624
Opcode ID: 187dacbb8b5fff3ff1a32d70668f6491b4fea5f9171416759f30824f2cabf329
Instruction ID: 2cfabf15e7c1e96764ab6fee26cfd8654ef4d23826f6ae420ef9f437b0e89eaa
Opcode Fuzzy Hash: 187dacbb8b5fff3ff1a32d70668f6491b4fea5f9171416759f30824f2cabf329
Instruction Fuzzy Hash: 9B21F576615B448AE752CF2AE8847D9B3A0F74C798F144026EF4D97B78DB38C985CB00

Function 0000000140092092 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 00000001400920E0
SelectObject.GDI32 ref: 00000001400938AC
ReleaseDC.USER32 ref: 00000001400938BD
SendMessageW.USER32 ref: 00000001400939BB
SendMessageW.USER32 ref: 00000001400939D7
GetClientRect.USER32 ref: 0000000140093A15
SetWindowLongW.USER32 ref: 0000000140093A3F
SendMessageW.USER32 ref: 0000000140093A61

Strings

Can't create control., xrefs: 00000001400938D0
static, xrefs: 0000000140092092

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: MessageSend$Window$ClientCreateLongObjectRectReleaseSelect
String ID: Can't create control.$static
API String ID: 2656910855-3511495095
Opcode ID: 74a460700f89ba3631fccc509e9a503001f12f21eafbafbeaf1e3d31e356fc6d
Instruction ID: 24443537530292a5bba8a5bbc44f5f6151a38f243848a12f11cb1f8d14d4f26f
Opcode Fuzzy Hash: 74a460700f89ba3631fccc509e9a503001f12f21eafbafbeaf1e3d31e356fc6d
Instruction Fuzzy Hash: 9521F576605B448AE752CF2AE8847D9B3A0F74C7A4F044026EF4D57B78DB38C985CB40

Function 0000000140006150 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(?,?,?,00000001400060F5), ref: 0000000140006178
GlobalLock.KERNEL32 ref: 00000001400061B1
GlobalFree.KERNEL32 ref: 00000001400061C4

Strings

GlobalLock, xrefs: 00000001400061D1
GlobalAlloc, xrefs: 000000014000618E

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Global$AllocFreeLock
String ID: GlobalAlloc$GlobalLock
API String ID: 1811133220-3672399903
Opcode ID: 8f22c79f6ff120e713cba6eef59eb92bb55781e15e9997acd70aed08b5eb5b7b
Instruction ID: cfcc7725783d3f4ebcc837005b3bde5563758961b10d454640ff62f38f04c752
Opcode Fuzzy Hash: 8f22c79f6ff120e713cba6eef59eb92bb55781e15e9997acd70aed08b5eb5b7b
Instruction Fuzzy Hash: 1B117CB1601B4180EF4ACF2AF4953D963A1EB5CBD4F488026EB0D57375EE38C895C780

Function 00000001400B4270 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,00000001400B275B), ref: 00000001400B42A0
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,00000001400B275B), ref: 00000001400B42B0

Strings

user32, xrefs: 00000001400B4293
IsHungAppWindow, xrefs: 00000001400B42A6

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsHungAppWindow$user32
API String ID: 1646373207-934392274
Opcode ID: 79ec18cd1f680e3375ba6980ca63f5e8a7abe44e8477829b0f09d8bf2ef3148d
Instruction ID: f93818421c4755a5979725df5a17ac61cb9549587fe780a3e60af5a008abf7a4
Opcode Fuzzy Hash: 79ec18cd1f680e3375ba6980ca63f5e8a7abe44e8477829b0f09d8bf2ef3148d
Instruction Fuzzy Hash: 85116171611B4082FF56CFA6B85179A27A0AB8C795F481024FF0E57770EB3CC9949740

Function 00000001400823E0 Relevance: 7.6, APIs: 5, Instructions: 125comCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32 ref: 0000000140082429
CLSIDFromString.OLE32 ref: 0000000140082486
CLSIDFromString.OLE32 ref: 00000001400824AA
CoCreateInstance.OLE32 ref: 00000001400824D5
CoCreateInstance.OLE32 ref: 0000000140082519

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: From$CreateInstanceString$Prog
String ID:
API String ID: 3834119650-0
Opcode ID: 61031ba02ab02c2ce1f3a224b7187c486455ee52ea18fdb3234dfc2014831d33
Instruction ID: 23b2d654c57cc6e0fc67192e4f5bcbdb9c33aa0a897bf8a07065a27dbdc390f4
Opcode Fuzzy Hash: 61031ba02ab02c2ce1f3a224b7187c486455ee52ea18fdb3234dfc2014831d33
Instruction Fuzzy Hash: 3A516A37215B4586EB66CF27E0147E937A1F788BC4F849026EB4907BA9EF78C644CB50

Function 000000014009F440 Relevance: 7.6, APIs: 5, Instructions: 117windowstringCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 000000014009F491
SendMessageW.USER32 ref: 000000014009F4B3
SendMessageW.USER32 ref: 000000014009F4EB
SendMessageW.USER32 ref: 000000014009F50E
lstrcmpiW.KERNEL32 ref: 000000014009F55F

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: MessageSend$lstrcmpi
String ID:
API String ID: 2977491028-0
Opcode ID: 9bce079cc20f1bcf9d1422d9de44bf83f4e7d442afdd32916aa2e3bbe7eec63d
Instruction ID: 9d4538e7ea393475f8f0eca14e56e09922df181b40cfccdc9911cea4f57f5e8e
Opcode Fuzzy Hash: 9bce079cc20f1bcf9d1422d9de44bf83f4e7d442afdd32916aa2e3bbe7eec63d
Instruction Fuzzy Hash: 02512D76608E8087E7729F36E4003FA63A1F7897E4F654212EBA747AE4DF78D4459700

Function 0000000140048230 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000000014004826C

Part of subcall function 00000001400CA9C4: _FF_MSGBANNER.LIBCMT ref: 00000001400CA9F4
Part of subcall function 00000001400CA9C4: HeapAlloc.KERNEL32(?,?,00000000,00000001400D0AC0,?,?,00000000,00000001400CF2FD,?,?,?,00000001400CF3A7,?,?,00000000,00000001400CE795), ref: 00000001400CAA19
Part of subcall function 00000001400CA9C4: _callnewh.LIBCMT ref: 00000001400CAA32
Part of subcall function 00000001400CA9C4: _errno.LIBCMT ref: 00000001400CAA3D
Part of subcall function 00000001400CA9C4: _errno.LIBCMT ref: 00000001400CAA48

free.LIBCMT ref: 00000001400482A4
malloc.LIBCMT ref: 00000001400482AF

Strings

,, xrefs: 0000000140048302
Out of memory., xrefs: 00000001400482C7

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: _errnomalloc$AllocHeap_callnewhfree
String ID: ,$Out of memory.
API String ID: 801159779-2084262015
Opcode ID: 39c7bdd641382003473a023146e476accbbc6efc536198e0aabeaef59b00f238
Instruction ID: f0bdb3a6ac0edf0eb3f6e3df36ed78b83a06a650254888ccf9f0234c1c38cfc0
Opcode Fuzzy Hash: 39c7bdd641382003473a023146e476accbbc6efc536198e0aabeaef59b00f238
Instruction Fuzzy Hash: 16516772A01B41CAEB66DF16D0803AD37B1F748F88F458526EF49033A9EB79D891C748

Function 00000001400592E0 Relevance: 7.6, APIs: 5, Instructions: 108windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00000001400592EE
IsWindowEnabled.USER32 ref: 0000000140059305
GetWindowRect.USER32 ref: 000000014005931B
pow.LIBCMT ref: 00000001400593AD
pow.LIBCMT ref: 00000001400593EB

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Window$EnabledRectVisible
String ID:
API String ID: 2297660776-0
Opcode ID: aa785951e507a372b261fe4d728c313563e9fb9c58a45a18e7f7726c26542c96
Instruction ID: 8da9e8644e730bf84fe4861cbdc8a0aaf3f88b09ab2c37935d7e747201010214
Opcode Fuzzy Hash: aa785951e507a372b261fe4d728c313563e9fb9c58a45a18e7f7726c26542c96
Instruction Fuzzy Hash: 84416072514B408AE713DF36D400789B3A9FB99BC4F148316FB8567579D735D892CA40

Function 0000000140077400 Relevance: 7.6, APIs: 5, Instructions: 103windowCOMMON

Download Yara Rule

APIs

ImageList_GetIconSize.COMCTL32 ref: 000000014007749F
ImageList_AddMasked.COMCTL32 ref: 0000000140077516
DeleteObject.GDI32 ref: 0000000140077527
ImageList_ReplaceIcon.COMCTL32 ref: 0000000140077538
DestroyIcon.USER32 ref: 0000000140077549

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: IconImageList_$DeleteDestroyMaskedObjectReplaceSize
String ID:
API String ID: 1613341713-0
Opcode ID: cc46fdd3826f36c433099d306a1208928640b41f1a1c1845d98bba346ec6dff1
Instruction ID: beb1e7f1496934889a74a1e9d72987837c3f345f5f5bd178a284d4fdbb5ccdc2
Opcode Fuzzy Hash: cc46fdd3826f36c433099d306a1208928640b41f1a1c1845d98bba346ec6dff1
Instruction Fuzzy Hash: CE31B032204B8082EB66DF17A4547AAB2A1F789BD0F044124FF9E57BA5DF3CC895CB40

Function 0000000140066310 Relevance: 7.6, APIs: 5, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00000001400663E4
WriteFile.KERNEL32 ref: 0000000140066417
GetLastError.KERNEL32 ref: 0000000140066429
CloseHandle.KERNEL32 ref: 0000000140066442
free.LIBCMT ref: 0000000140066450

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastWritefree
String ID:
API String ID: 2877028684-0
Opcode ID: 6d00a70b2e4780eefcc1c3f61eafca73d111171ff2b15f883417e8a98f270794
Instruction ID: cae7f3b278f804fd398ce67a8515daf625ebec1ccf9aa7c391d63a747e42341a
Opcode Fuzzy Hash: 6d00a70b2e4780eefcc1c3f61eafca73d111171ff2b15f883417e8a98f270794
Instruction Fuzzy Hash: 9841B17220465086E766CF27E9407DA6691B74CBE4F584229EF6D47BE5CF38C9498700

Function 0000000140085220 Relevance: 7.6, APIs: 5, Instructions: 79COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32 ref: 000000014008523E
SafeArrayGetUBound.OLEAUT32 ref: 0000000140085259
SafeArrayAccessData.OLEAUT32 ref: 0000000140085274
SafeArrayGetElemsize.OLEAUT32 ref: 00000001400852A4

Part of subcall function 00000001400CBD60: malloc.LIBCMT ref: 00000001400CBD7A

SafeArrayUnaccessData.OLEAUT32 ref: 0000000140085330

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: ArraySafe$BoundData$AccessElemsizeUnaccessmalloc
String ID:
API String ID: 3034385915-0
Opcode ID: a288e77af3a30e16dd64c0d593562bd2df9877f7609cf98968f937762e46a890
Instruction ID: c68ac87437bc80a01c2a5de600b48a5821ac1887ea8dee9998c1ffa3f6014606
Opcode Fuzzy Hash: a288e77af3a30e16dd64c0d593562bd2df9877f7609cf98968f937762e46a890
Instruction Fuzzy Hash: 39315C76304B4082E7169F16F5403AAABA5FB8CBD4F044125EF8A47B64DF38D595CB00

Function 00000001400CB1C0 Relevance: 7.6, APIs: 5, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(00000000,?,?,00000001400CB2D5,?,?,?,?,00000001400CBDDB), ref: 00000001400CB1E9
DecodePointer.KERNEL32(?,?,?,?,00000001400CBDDB), ref: 00000001400CB1F9

Part of subcall function 00000001400CD85C: _errno.LIBCMT ref: 00000001400CD865
Part of subcall function 00000001400CD85C: _invalid_parameter_noinfo.LIBCMT ref: 00000001400CD870

EncodePointer.KERNEL32(?,?,?,?,00000001400CBDDB), ref: 00000001400CB277

Part of subcall function 00000001400D0B94: Sleep.KERNEL32(?,?,?,?,?,?,00000000,00000001400CB267,?,?,?,?,00000001400CBDDB), ref: 00000001400D0BDB

EncodePointer.KERNEL32(?,?,?,?,00000001400CBDDB), ref: 00000001400CB287
EncodePointer.KERNEL32(?,?,?,?,00000001400CBDDB), ref: 00000001400CB294

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Pointer$Encode$Decode$Sleep_errno_invalid_parameter_noinfo
String ID:
API String ID: 3588582179-0
Opcode ID: 389e76b12a1bb8edd79487aaf6e67214a8ca23d3a200486bba08ca852d1ce5c5
Instruction ID: 294d77211481f233aaf18b32e2664592c98510119121c20d1f7562fd27639c63
Opcode Fuzzy Hash: 389e76b12a1bb8edd79487aaf6e67214a8ca23d3a200486bba08ca852d1ce5c5
Instruction Fuzzy Hash: DA215E7131AB4081EA4A9B53F9883D9A3A1B78CBD0F444825EB0E1B7B5EF3CC485C740

Function 00000001400AA0C0 Relevance: 7.6, APIs: 5, Instructions: 70registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32 ref: 00000001400AA0FD
RegOpenKeyExW.ADVAPI32 ref: 00000001400AA13D

Part of subcall function 00000001400AA0C0: RegCloseKey.ADVAPI32 ref: 00000001400AA164
Part of subcall function 00000001400AA0C0: RegDeleteKeyW.ADVAPI32 ref: 00000001400AA176
Part of subcall function 00000001400AA0C0: RegEnumKeyExW.ADVAPI32 ref: 00000001400AA1BB

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Enum$CloseDeleteOpen
String ID:
API String ID: 2095303065-0
Opcode ID: 0fd04eeb47e737fe728a8ef04234e80c67d53f31ee84a57d475950a7ca86ddd7
Instruction ID: 686ce5e9e7a5a1083982448075d12c01550f8405be44116c87185ecfb276fdf3
Opcode Fuzzy Hash: 0fd04eeb47e737fe728a8ef04234e80c67d53f31ee84a57d475950a7ca86ddd7
Instruction Fuzzy Hash: C4312332214B8592E7618F62F4847DA63A5F7897D4F500221FB8D43EA4EF3DC99ACB00

Function 00000001400041D0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 191timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140004EA0: GetTickCount.KERNEL32 ref: 0000000140004ED8

GetTickCount.KERNEL32 ref: 000000014000428C
wcsncpy.LIBCMT ref: 00000001400042CC
KillTimer.USER32 ref: 0000000140004415

Strings

call, xrefs: 0000000140004335

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: CountTick$KillTimerwcsncpy
String ID: call
API String ID: 2737708082-3431870270
Opcode ID: 9ba35ae6d852eab9cc4f5e2c017a26cf3e1cefcf921943f121d85382a6f7e51f
Instruction ID: f95e5607c05e947690bac7165b8c783dc35a94b9d358afc1e5d52d72a08c9308
Opcode Fuzzy Hash: 9ba35ae6d852eab9cc4f5e2c017a26cf3e1cefcf921943f121d85382a6f7e51f
Instruction Fuzzy Hash: 16914EF6205A8085EB6BDF23B5407EA77A4F74CBC8F584019EB4907ABACB38C954C745

Function 00000001400411A0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 86COMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNEL32(?,?,static,00000001400413DD), ref: 0000000140041297

Strings

%s (%d) : ==> Warning: %s, xrefs: 0000000140041227
Specifically: %s, xrefs: 0000000140041251
static, xrefs: 00000001400411AA

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: DebugOutputString
String ID: Specifically: %s$%s (%d) : ==> Warning: %s$static
API String ID: 1166629820-2897262835
Opcode ID: e8bf98ab860bfc104ec213d741de2fed6d7cb7235f427265240e90bdc4af1321
Instruction ID: a569e6c1d9b8b4a063e14540578c1636ce7e1f2ac5a1e0d1c6cd25646f5bf84e
Opcode Fuzzy Hash: e8bf98ab860bfc104ec213d741de2fed6d7cb7235f427265240e90bdc4af1321
Instruction Fuzzy Hash: 01310032314A9081EA629F13E540BEE6360F39CBC8F894032FF499B6A5DB7CC951CB44

Function 000000014007D0E2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32 ref: 000000014007D0AF
GetClassNameW.USER32 ref: 000000014007D0F2

Strings

Combo, xrefs: 000000014007D0FC
List, xrefs: 000000014007D121

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: ClassMessageNameSendTimeout
String ID: Combo$List
API String ID: 1632441287-1246219895
Opcode ID: 21cdfcbd7e9d3514e49a9d69b3896e6c74861b260b999655f644f05842b0c17d
Instruction ID: 8be66f84869190e859fe06f2c03a979eaae2e268e10ac28d2c71cebfdc21f0cc
Opcode Fuzzy Hash: 21cdfcbd7e9d3514e49a9d69b3896e6c74861b260b999655f644f05842b0c17d
Instruction Fuzzy Hash: 2C315E71204A8085EB228F26A8103E93761F74D7FCF482312AF7D1BAE9DB78D645D741

Function 0000000140019440 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0000000140019486
GetForegroundWindow.USER32 ref: 00000001400194CC
GetWindowTextW.USER32 ref: 0000000140019506

Strings

N/A, xrefs: 0000000140019542

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Window$CountForegroundTextTick
String ID: N/A
API String ID: 3416458291-2525114547
Opcode ID: a8c7e94dea92ce166af4baa1c13c7675e1374f56dd6da2e29878908e67691d45
Instruction ID: 0ff4e04d2c09255709d978ec1afe1c238b77e7ff07147b96e45302bd49f5d766
Opcode Fuzzy Hash: a8c7e94dea92ce166af4baa1c13c7675e1374f56dd6da2e29878908e67691d45
Instruction Fuzzy Hash: DD310872220A4486EB1B8B57E4903A4BBA2FB4DF91F859217EB4A1B774DB3CC955C700

Function 000000014007C40B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 66windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 000000014007C41B
SendMessageTimeoutW.USER32 ref: 000000014007C47B

Strings

Combo, xrefs: 000000014007C425
List, xrefs: 000000014007C440

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: ClassMessageNameSendTimeout
String ID: Combo$List
API String ID: 1632441287-1246219895
Opcode ID: acce48bc362dadf2973d1392184fb4927ab118aee4c695d91edc31ebb8035b55
Instruction ID: 0a9b2bd02132481ba659bfbcc8eb86b5e897211ae441ff3479110348ddbd53b8
Opcode Fuzzy Hash: acce48bc362dadf2973d1392184fb4927ab118aee4c695d91edc31ebb8035b55
Instruction Fuzzy Hash: 8E218932310A4486EB628B26A4507E93361E78CBF8F54131AAE7E17BE5CB38C9468750

Function 00000001400D844C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000001400D8465
_invalid_parameter_noinfo.LIBCMT ref: 00000001400D8471
_errno.LIBCMT ref: 00000001400D8498

Strings

1, xrefs: 00000001400D84E7

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID: 1
API String ID: 2819658684-2212294583
Opcode ID: b66b18a0ad2e5606eb3a2c2ce67122ce02e6b3723ecac1807372755083fef892
Instruction ID: 2a874c7145d78bbc8a20808d5612bedfd8fe2b9bc817f2ada25311b96d18bdda
Opcode Fuzzy Hash: b66b18a0ad2e5606eb3a2c2ce67122ce02e6b3723ecac1807372755083fef892
Instruction Fuzzy Hash: 1621D1322196D186F77B9F2694503EC6AA4AF0DBC4F99C051BB46072E3D6398942C331

Function 00000001400A3010 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30windowCOMMON

Download Yara Rule

APIs

SetMenuItemInfoW.USER32 ref: 00000001400A304D
DeleteObject.GDI32 ref: 00000001400A3060
DestroyIcon.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001400A1CA1), ref: 00000001400A3079

Strings

P, xrefs: 00000001400A3034

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: DeleteDestroyIconInfoItemMenuObject
String ID: P
API String ID: 2083505926-3110715001
Opcode ID: d302b8c7f35972131082b0032d13252aeb2466c1298656b786be5eaf2f3cf4d8
Instruction ID: c449cd8ef24ddf93437870978801a00ded9cbf335fcb4e69138917d6f148c5f9
Opcode Fuzzy Hash: d302b8c7f35972131082b0032d13252aeb2466c1298656b786be5eaf2f3cf4d8
Instruction Fuzzy Hash: CE0168B2605600C7F7668F11E454B5A3760F758F59F540204F7990B6A4DB7EC8D9CB80

Function 00000001400CC40C Relevance: 6.2, APIs: 4, Instructions: 195COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400CA794: _getptd.LIBCMT ref: 00000001400CA7A6

_errno.LIBCMT ref: 00000001400CC44C
_invalid_parameter_noinfo.LIBCMT ref: 00000001400CC457
iswctype.LIBCMT ref: 00000001400CC490
_errno.LIBCMT ref: 00000001400CC606

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: _errno$_getptd_invalid_parameter_noinfoiswctype
String ID:
API String ID: 2104083562-0
Opcode ID: 5f5cea9316339b8af21edcc742db5d28af49afbffbc74d08e007f4a513abdd7d
Instruction ID: 94f4c59394c95d84e7f7619928f4ba3920827baa7310f5e315ffdab792fd20d2
Opcode Fuzzy Hash: 5f5cea9316339b8af21edcc742db5d28af49afbffbc74d08e007f4a513abdd7d
Instruction Fuzzy Hash: 4E61E472A2879041FBBF9A17D505BFA61C0B70CBE4F549221FF66472E4E678D885D302

Function 00000001400AD420 Relevance: 6.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc6609f98a321d457719d17f248d254f1e515cd4716de93c8bfb96e4aad9c818
Instruction ID: 912611a06b7140c93094ae95e9d2ab4761e6273defb0a97a32100e0eb9b7f05b
Opcode Fuzzy Hash: dc6609f98a321d457719d17f248d254f1e515cd4716de93c8bfb96e4aad9c818
Instruction Fuzzy Hash: 4D51847260565086E7628B23A4443BA72A2F76CBD9F550317FF9A076F4D7B8C9C2CB00

Function 0000000140083420 Relevance: 6.2, APIs: 4, Instructions: 160COMMON

Download Yara Rule

APIs

_wcstoi64.LIBCMT ref: 0000000140083539
SafeArrayCreate.OLEAUT32 ref: 00000001400835BE
SafeArrayDestroy.OLEAUT32 ref: 000000014008362D

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: ArraySafe$CreateDestroy_wcstoi64
String ID:
API String ID: 2980161006-0
Opcode ID: a92a3b1dae550654e6899fed9ee5c30a56ef72f4ab902b8eb9e34a27a048be99
Instruction ID: 70fb15a203683e5e89c7b5be89388dc9d4cd4f6a1675ed924eda75c4c9fec99f
Opcode Fuzzy Hash: a92a3b1dae550654e6899fed9ee5c30a56ef72f4ab902b8eb9e34a27a048be99
Instruction Fuzzy Hash: 07516E73605B4582EB6A9F1794143EA77A1F7CCBC0F58A425EB4A077B1DB38CA91C340

Function 00000001400CF464 Relevance: 6.2, APIs: 4, Instructions: 159COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000001400CF4B2
_invalid_parameter_noinfo.LIBCMT ref: 00000001400CF4BD
DecodePointer.KERNEL32(?,?,?,?,?,00000001400D22F4), ref: 00000001400CF56C
_lock.LIBCMT ref: 00000001400CF597

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: DecodePointer_errno_invalid_parameter_noinfo_lock
String ID:
API String ID: 27599310-0
Opcode ID: fc451fa2b97929f991582e03dcc6565a7d1408add17b792135b44005ccd0b83b
Instruction ID: c7881b183dd333681dfb32222ecf5adabdc7b3d0edcf91fa4c5d4c0e17bf7bf1
Opcode Fuzzy Hash: fc451fa2b97929f991582e03dcc6565a7d1408add17b792135b44005ccd0b83b
Instruction Fuzzy Hash: 0D517D32608B4086FA6F9F17A5843FA76A1E78D7D4F64411AFB5B477B4CB38C841E602

Function 000000014009E110 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 000000014009E19C
GetWindowRect.USER32 ref: 000000014009E1B4
GetWindowRect.USER32 ref: 000000014009E1C3
IntersectRect.USER32 ref: 000000014009E1D8

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Rect$Window$IntersectParent
String ID:
API String ID: 3824346474-0
Opcode ID: 4163e854287d7cbbe7da3c3610b07b5988a1dd8210547b099a12a64f5cea7c80
Instruction ID: 6b9d86e798b214da7b80190168c11cf2d04dfbdc4b67f8a63cf84e121ea38342
Opcode Fuzzy Hash: 4163e854287d7cbbe7da3c3610b07b5988a1dd8210547b099a12a64f5cea7c80
Instruction Fuzzy Hash: 8B3182332186819ADA62CF36E44079EB7A1F788FC4F044311FB89579A9CB39DD52CB40

Function 000000014009E000 Relevance: 6.1, APIs: 4, Instructions: 77windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 000000014009E090
SendMessageW.USER32 ref: 000000014009E0AE
GetSysColor.USER32 ref: 000000014009E0DC
SendMessageW.USER32 ref: 000000014009E0F8

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: MessageSend$Color
String ID:
API String ID: 3922397608-0
Opcode ID: 90ca506bcc4f3a7fc2fe7924679c0295cbdaa10ad3c3741bfd465a38438a5401
Instruction ID: 9511c27309409c6a75130a34226e57c59c453d0376197965d87765e8dc615cf0
Opcode Fuzzy Hash: 90ca506bcc4f3a7fc2fe7924679c0295cbdaa10ad3c3741bfd465a38438a5401
Instruction Fuzzy Hash: 24318E3270058086FBB68B26D5507EA26A1E78CBE4F144221FB5987BF9DB76CCD1C740

Function 00000001400A30A0 Relevance: 6.1, APIs: 4, Instructions: 73windowCOMMON

Download Yara Rule

APIs

GetIconInfo.USER32 ref: 00000001400A3141
GetObjectW.GDI32 ref: 00000001400A3158
DeleteObject.GDI32 ref: 00000001400A317A
DeleteObject.GDI32 ref: 00000001400A3185

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Object$Delete$IconInfo
String ID:
API String ID: 507670407-0
Opcode ID: 730c27fdcce52354a3bc1d284028051d1f64c5cdcc607ba8388cf660ab0ce672
Instruction ID: 4aff32f9beea35d12e4bf2dfcb074e717c96d91b896d250f04c407ba4d6c7c9a
Opcode Fuzzy Hash: 730c27fdcce52354a3bc1d284028051d1f64c5cdcc607ba8388cf660ab0ce672
Instruction Fuzzy Hash: D5311CB230164487EF568F56E5807A9B7E1FBA9FC4F08A215FB0957664DB38C8D1CB40

Function 000000014008D3D9 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 000000014008D39A
GetWindowLongW.USER32 ref: 000000014008D3E6

Part of subcall function 00000001400AE0B0: malloc.LIBCMT ref: 00000001400AE109

SetWindowTextW.USER32 ref: 000000014008D40D
free.LIBCMT ref: 000000014008D428

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Windowfree$LongTextmalloc
String ID:
API String ID: 1796630370-0
Opcode ID: 8c33109241ee787565c54830d447b44589db6a645cdcfd2c4102219424397f47
Instruction ID: bcd6f01a33b12c44c436348fd04a0aa8f56ff1e8d3ff647d4178df68728b19a1
Opcode Fuzzy Hash: 8c33109241ee787565c54830d447b44589db6a645cdcfd2c4102219424397f47
Instruction Fuzzy Hash: 53118236305A4481FA678B07A5587E9B361B74CBE4F184217EF6D07BB8DE39C6848342

Function 00000001400A2180 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SetMenuItemInfoW.USER32 ref: 00000001400A22CE

Part of subcall function 00000001400A2350: malloc.LIBCMT ref: 00000001400A238C
Part of subcall function 00000001400A2350: free.LIBCMT ref: 00000001400A23A8

Strings

P, xrefs: 00000001400A220A

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: InfoItemMenufreemalloc
String ID: P
API String ID: 2847912382-3110715001
Opcode ID: 9e4dc5af44de59166f36d269e2cd61a9e01f1f36d6046bbace37f2e7ea0a9525
Instruction ID: 7603b72c84fbafec5b5317aec64b85d6f0775059242fc097d1520b8c29dce9fe
Opcode Fuzzy Hash: 9e4dc5af44de59166f36d269e2cd61a9e01f1f36d6046bbace37f2e7ea0a9525
Instruction Fuzzy Hash: F251A53230564086EB669B2BA4007AA62A1F79DBD4F144335FF5A47BE5DB3DC981CB40

Function 0000000140028160 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

wcsncpy.LIBCMT ref: 000000014002830C

Strings

{, xrefs: 00000001400281C4
This line does not contain a recognized action., xrefs: 00000001400282E2

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: wcsncpy
String ID: This line does not contain a recognized action.${
API String ID: 322933527-101845141
Opcode ID: 78744dfd9af17a6e3ba67543173e6e5efc6e7af8fc2d58f7abebf6389824d46a
Instruction ID: b839ceabcc494670c74d03b30e9105ac2ded656d5ecb838e657dee74d31672ee
Opcode Fuzzy Hash: 78744dfd9af17a6e3ba67543173e6e5efc6e7af8fc2d58f7abebf6389824d46a
Instruction Fuzzy Hash: 0441E52961968085E7318F5AE10036EB261EB5CBD0F54621AFF99C7BE8E73DCD41C709

Function 00000001400DB250 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000001400DB321

Strings

atan, xrefs: 00000001400DB2D8
!, xrefs: 00000001400DB2E6

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: _set_statfp
String ID: !$atan
API String ID: 1156100317-1342027943
Opcode ID: d1cffada53ad10265deae4f2fe55daa25edcc7d4d4d276b5a928eb95b7e0e825
Instruction ID: a7890210c86891647214b1f542aa41041c729023b3e3af1c8e5411bcbc6a564e
Opcode Fuzzy Hash: d1cffada53ad10265deae4f2fe55daa25edcc7d4d4d276b5a928eb95b7e0e825
Instruction Fuzzy Hash: F65180B1A15F50C9E6A3DB3798213EA6768AF5A7D4F408303EB5B22E71DB78D0438204

Function 00000001400792B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

joyGetDevCapsW.WINMM ref: 0000000140079309
joyGetPosEx.WINMM ref: 0000000140079361

Strings

4, xrefs: 0000000140079351

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Caps
String ID: 4
API String ID: 130273448-4088798008
Opcode ID: 12358aba9ce78f40959dd8e9d12ac1e2c88cbe73b8fa400dce645dd726b32cd5
Instruction ID: d25c8e2c0ba6728fba8cc23f5b386ffbda2ec32888b89444d184945559d76d21
Opcode Fuzzy Hash: 12358aba9ce78f40959dd8e9d12ac1e2c88cbe73b8fa400dce645dd726b32cd5
Instruction Fuzzy Hash: 5841B53271464086E72ACF26E4443AE73A5FB9D7D8F458116EB4D176E8EB7CC545CB00

Function 00000001400AC229 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

_itow.LIBCMT ref: 00000001400AC2D0

Strings

UTF-8, xrefs: 00000001400AC2E9
UTF-16, xrefs: 00000001400AC2FF

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: _itow
String ID: UTF-16$UTF-8
API String ID: 1169376501-557455392
Opcode ID: 7b1403d5914d4530fe47a8f82c8270930137f2c179ec5486ae11f4d63eebea58
Instruction ID: ce2663d095ed31aeab88efff22b8dc1b4c2bba8b507dabe6f4105b5f9e9763fb
Opcode Fuzzy Hash: 7b1403d5914d4530fe47a8f82c8270930137f2c179ec5486ae11f4d63eebea58
Instruction Fuzzy Hash: F431A43632574082E7B6DF6AE540BDE23A1F79C7C0F454616EB4A876E1DB38C990CB40

Function 00000001400CD43C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000001400CD47C
_invalid_parameter_noinfo.LIBCMT ref: 00000001400CD487

Strings

B, xrefs: 00000001400CD49E

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: f142854bbd35509e0e6cf6d1b19321f8302ce735d6d42cf7474cb3ceb48b450d
Instruction ID: 4c29f18453707743488baf9c562445ff6073951acd49dd0199948b569ea73218
Opcode Fuzzy Hash: f142854bbd35509e0e6cf6d1b19321f8302ce735d6d42cf7474cb3ceb48b450d
Instruction Fuzzy Hash: 23317C72B14B648AFB1A9F66D4407DC76B4B748BD8F580216EF1A17BA9CB34D401D710

Function 00000001400CC274 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000001400CC2AB
_invalid_parameter_noinfo.LIBCMT ref: 00000001400CC2B6

Strings

B, xrefs: 00000001400CC2D1

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: 3dbffe0ecb4f73c39fb9b65c97a116103d8a13a35a2cb64abf06d926933e568d
Instruction ID: 21f6b6ba8bc4f901c143108b015d77873a37f058539977df2aaa5f9727886b27
Opcode Fuzzy Hash: 3dbffe0ecb4f73c39fb9b65c97a116103d8a13a35a2cb64abf06d926933e568d
Instruction Fuzzy Hash: 4D217372B18BA489F71BDBA6E440BDC7A70A7087E8F544211FF1A17AE9CB3485458310

Function 000000014006A430 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69timeCOMMON

Download Yara Rule

APIs

FileTimeToLocalFileTime.KERNEL32 ref: 000000014006A4C1
FileTimeToSystemTime.KERNEL32 ref: 000000014006A4D4

Strings

%04d%02d%02d%02d%02d%02d, xrefs: 000000014006A50A

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Time$File$LocalSystem
String ID: %04d%02d%02d%02d%02d%02d
API String ID: 1748579591-4847443
Opcode ID: da853acb75203b9197ee7e39166a25ca6d04b4a46699a2b6eec94314b825f63d
Instruction ID: 543d6ab66f39a653baa6eca2ce8bb5353151caec1cb0951d654299c145d38e2f
Opcode Fuzzy Hash: da853acb75203b9197ee7e39166a25ca6d04b4a46699a2b6eec94314b825f63d
Instruction Fuzzy Hash: 9D317472218640C1D7659F16E8403AEB7B1F7C9BA0F154216FB9A43AE8DB7CC550CB50

Function 00000001400A2400 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00000001400A2444
SetMenuItemInfoW.USER32 ref: 00000001400A246F

Part of subcall function 000000014008FE90: GetMenu.USER32 ref: 000000014008FECF
Part of subcall function 000000014008FE90: IsWindowVisible.USER32 ref: 000000014008FEE9
Part of subcall function 000000014008FE90: SetWindowPos.USER32 ref: 000000014008FF1A
Part of subcall function 000000014008FE90: RedrawWindow.USER32 ref: 000000014008FF3A

Strings

P, xrefs: 00000001400A2434

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: MenuWindow$InfoItem$RedrawVisible
String ID: P
API String ID: 4094535373-3110715001
Opcode ID: 1c50f4f2c919c2d43725ae82c15717623c3478abc8f7f097317918e0ad62bfbc
Instruction ID: 366fa4dc9fe67773129d5df7824e50ab7173fee0d9b2a875714e7a57374eb872
Opcode Fuzzy Hash: 1c50f4f2c919c2d43725ae82c15717623c3478abc8f7f097317918e0ad62bfbc
Instruction Fuzzy Hash: E11167363146808BE762CF26E84479A73A0F79CBD4F585226EB9943E65CB38D991CF40

Function 00000001400691F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32 ref: 0000000140069218

Strings

%04d%02d%02d%02d%02d%02d, xrefs: 0000000140069252

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: SystemTime
String ID: %04d%02d%02d%02d%02d%02d
API String ID: 2656138-4847443
Opcode ID: 2ff4b1820d2364d9f577b191bec8b04824b767bcd333dad6373aca0fc83f01a2
Instruction ID: 081afddc60d746bfe1a987099392737971544f35c784718eac0e83f34709faf6
Opcode Fuzzy Hash: 2ff4b1820d2364d9f577b191bec8b04824b767bcd333dad6373aca0fc83f01a2
Instruction Fuzzy Hash: E2018072608240C6D7558F56E4503AAB7B6F789BA1F244316FBA943EE8E73DC194CB10

Function 00000001400B4110 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32 ref: 00000001400B412F
GetClassNameW.USER32 ref: 00000001400B4158

Strings

#32770, xrefs: 00000001400B4163

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: ClassNameProcessThreadWindow
String ID: #32770
API String ID: 2910564809-463685578
Opcode ID: e8047d1e42999be60de19a6cc0ad454134824f98375cbbf849391dc593281c5a
Instruction ID: e63c6177215d44839a19a194d6d884bbe473a4af60b4672c8e870eaa7599cc95
Opcode Fuzzy Hash: e8047d1e42999be60de19a6cc0ad454134824f98375cbbf849391dc593281c5a
Instruction Fuzzy Hash: 07011232704A84D6EB628F59E4443A973B5F358BC8F584111EB8C57A68DF3CD9D6CB00

Function 00000001400D2338 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMONLIBRARYCODE

Download Yara Rule

APIs

wcsnlen.LIBCMT ref: 00000001400D235C
LCMapStringW.KERNEL32(?,?,?,?,Link Source,00000001400CEB01,?,?,?,?,?,?,?,?,?,00000001400CAB35), ref: 00000001400D237F

Strings

Link Source, xrefs: 00000001400D2342

Memory Dump Source

Source File: 00000000.00000002.3395015508.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3395001386.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395079548.00000001400F2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.0000000140112000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395118774.000000014011B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395147142.000000014011F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395163641.0000000140127000.00000010.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3395176494.000000014012A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_ftFxGrU7W4.jbxd

Similarity

API ID: Stringwcsnlen
String ID: Link Source
API String ID: 1747122221-2774405599
Opcode ID: c080c2e9a6ea1d9ecb8d26c4e5a31789c6608c63ac5bcbbdbaeffb88547775a7
Instruction ID: 6036e2388dbd086b456f7592fa0f4c4355c3acd6c29aa9ac2c869fe03fc3d7c7
Opcode Fuzzy Hash: c080c2e9a6ea1d9ecb8d26c4e5a31789c6608c63ac5bcbbdbaeffb88547775a7
Instruction Fuzzy Hash: D9F0FE36704B4082DB258B07B441B5EABA5FBEEBD4F588125EF8857B29CA3CC9518B40

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ftFxGrU7W4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: ftFxGrU7W4.exePID: 2196, Parent PID: 4004

General

Chronological Activities

Disassembly

Analysis Process: ftFxGrU7W4.exePID: 2196, Parent PID: 4004COMMON

Execution Graph

Windows Analysis Report
ftFxGrU7W4.exe

Function 0000000140056150 Relevance: 65.2, APIs: 35, Strings: 2, Instructions: 462
registrywindowCOMMON

Function 000000014001EFA0 Relevance: 54.5, APIs: 22, Strings: 9, Instructions: 233
windowregistryCOMMON

Function 0000000140081F80 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 159
processCOMMON

Function 000000014004E3CB Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 217
COMMON

Function 00000001400207F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73
COMMON

Function 0000000140005660 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 102
sleepwindowCOMMON

Function 00000001400AF3C0 Relevance: 19.7, APIs: 13, Instructions: 164
windowlibraryCOMMON

Function 000000014001F780 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 296
timeCOMMON

Function 00000001400CD994 Relevance: 18.1, APIs: 12, Instructions: 93
COMMON

Function 00000001400053C0 Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 318
COMMON

Function 000000014000BCF0 Relevance: 12.1, APIs: 8, Instructions: 106
windowthreadCOMMON

Function 000000014002E64C Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 245
COMMON

Function 000000014001E5C0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 185
comCOMMON

Function 0000000140036C57 Relevance: 9.2, APIs: 6, Instructions: 174
windowclipboardCOMMON

Function 0000000140056A91 Relevance: 7.5, APIs: 5, Instructions: 44
timeclipboardCOMMON