Edit tour

Windows Analysis Report
SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

Overview

General Information

Sample name:	SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe
Analysis ID:	1427742
MD5:	87b6fcfdaa0ab94d9cf4b7f3cbbc8b8b
SHA1:	2e3dacf58466b4b7a2c6d52b008f6e1b4c98911a
SHA256:	c1874e86e54a70b1917c708826975e45fa5c813f0ec30f6afd4971100ac0e5b7
Tags:	exe
Infos:

Detection

Score:	6
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

PE file contains an invalid checksum

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Process Tree

System is w10x64

SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe (PID: 6748 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe" MD5: 87B6FCFDAA0AB94D9CF4B7F3CBBC8B8B)

cmd.exe (PID: 6984 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\7ZSfx000.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 0_2_0000000140004620 GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,		0_2_0000000140004620
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 0_2_0000000140003E88 FindFirstFileW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPEAX@Z,??3@YAXPEAX@Z,		0_2_0000000140003E88

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 4x nop then movzx eax, byte ptr [rdx+07h]	0_2_00000001400170F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 4x nop then movsxd r9, rbp	0_2_0000000140011620
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 4x nop then movzx eax, byte ptr [rdx]	0_2_000000014000F6E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 4x nop then mov ebp, dword ptr [r13+00h]	0_2_000000014000E740

Source: EasyVBO.exe.0.dr	String found in binary or memory: PATH@https://twitter.com/home?status=Zhttps://www.facebook.com/sharer/sharer.php?u=hhttps://www.linkedin.com/shareArticle?mini=true&url=Dhttps://plus.google.com/share?url=VB equals www.facebook.com (Facebook)
Source: EasyVBO.exe.0.dr	String found in binary or memory: PATH@https://twitter.com/home?status=Zhttps://www.facebook.com/sharer/sharer.php?u=hhttps://www.linkedin.com/shareArticle?mini=true&url=Dhttps://plus.google.com/share?url=VB equals www.linkedin.com (Linkedin)
Source: EasyVBO.exe.0.dr	String found in binary or memory: PATH@https://twitter.com/home?status=Zhttps://www.facebook.com/sharer/sharer.php?u=hhttps://www.linkedin.com/shareArticle?mini=true&url=Dhttps://plus.google.com/share?url=VB equals www.twitter.com (Twitter)

Source: SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1689291681.0000000000858000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1688185626.00000000048CE000.00000004.00000020.00020000.00000000.sdmp, EasyVBO.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1689291681.0000000000858000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1688185626.00000000048CE000.00000004.00000020.00020000.00000000.sdmp, EasyVBO.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1689291681.0000000000858000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1688185626.00000000048CE000.00000004.00000020.00020000.00000000.sdmp, EasyVBO.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1689291681.0000000000858000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1688185626.00000000048CE000.00000004.00000020.00020000.00000000.sdmp, EasyVBO.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1689291681.0000000000858000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1688185626.00000000048CE000.00000004.00000020.00020000.00000000.sdmp, EasyVBO.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1689291681.0000000000858000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1688185626.00000000048CE000.00000004.00000020.00020000.00000000.sdmp, EasyVBO.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1689291681.0000000000858000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1688185626.00000000048CE000.00000004.00000020.00020000.00000000.sdmp, EasyVBO.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: EasyVBO.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1689291681.0000000000858000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1688185626.00000000048CE000.00000004.00000020.00020000.00000000.sdmp, EasyVBO.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1689291681.0000000000858000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1688185626.00000000048CE000.00000004.00000020.00020000.00000000.sdmp, EasyVBO.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1689291681.0000000000858000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1688185626.00000000048CE000.00000004.00000020.00020000.00000000.sdmp, EasyVBO.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1689291681.0000000000858000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1688185626.00000000048CE000.00000004.00000020.00020000.00000000.sdmp, EasyVBO.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1689291681.0000000000858000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1688185626.00000000048CE000.00000004.00000020.00020000.00000000.sdmp, EasyVBO.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1689291681.0000000000858000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1688185626.00000000048CE000.00000004.00000020.00020000.00000000.sdmp, EasyVBO.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: EasyVBO.exe.0.dr	String found in binary or memory: http://www.easyas.co.zaBYour
Source: EasyVBO.exe.0.dr	String found in binary or memory: https://www.easyas.co.za/downloads/7zEasyVBO.exef
Source: EasyVBO.exe.0.dr	String found in binary or memory: https://www.google.com/
Source: EasyVBO.exe.0.dr	String found in binary or memory: https://www.winsms.co.za/api/credits.ASP?User=

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 0_2_000000014001BE60	0_2_000000014001BE60
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 0_2_000000014001AB78	0_2_000000014001AB78
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 0_2_0000000140007FA4	0_2_0000000140007FA4
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 0_2_0000000140016C30	0_2_0000000140016C30
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 0_2_0000000140006C60	0_2_0000000140006C60
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 0_2_000000014000DC90	0_2_000000014000DC90
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 0_2_0000000140022CA0	0_2_0000000140022CA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 0_2_000000014000ECB0	0_2_000000014000ECB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 0_2_00000001400108C0	0_2_00000001400108C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 0_2_0000000140022940	0_2_0000000140022940
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 0_2_000000014000E940	0_2_000000014000E940
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 0_2_0000000140014190	0_2_0000000140014190
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 0_2_000000014000E1A0	0_2_000000014000E1A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 0_2_0000000140013230	0_2_0000000140013230
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 0_2_000000014000DA50	0_2_000000014000DA50
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 0_2_000000014000F6E0	0_2_000000014000F6E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 0_2_0000000140021B8C	0_2_0000000140021B8C
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 0_2_0000000140022F94	0_2_0000000140022F94
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 0_2_0000000140022BB1	0_2_0000000140022BB1

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

Code function: String function: 0000000140003E6C appears 32 times

Source: SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Binary or memory string: OriginalFilename vs SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe
Source: SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1689291681.0000000000858000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEasyVBO.exe vs SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe
Source: SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000000.1632439150.0000000140031000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename7ZSfxMod_x64.exeD vs SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe
Source: SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1681407885.00000000023B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7ZSfxMod_x64.exeD vs SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe
Source: SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe, 00000000.00000003.1688185626.00000000048CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEasyVBO.exe vs SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe
Source: SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Binary or memory string: OriginalFilename7ZSfxMod_x64.exeD vs SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

Source: classification engine

Classification label: clean6.winEXE@5/2@0/0

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

Code function: 0_2_000000014000D328 wvsprintfW,GetLastError,FormatMessageW,FormatMessageW,lstrlenW,lstrlenW,??2@YAPEAX_K@Z,lstrcpyW,lstrcpyW,??3@YAXPEAX@Z,LocalFree,

0_2_000000014000D328

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

Code function: 0_2_0000000140001240 GetDiskFreeSpaceExW,SendMessageW,

0_2_0000000140001240

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

Code function: 0_2_000000014000CE2C GetDlgItem,SendMessageW,GetDlgItem,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,GetDlgItem,SetWindowLongPtrW,GetSystemMenu,EnableMenuItem,GetDlgItem,SetFocus,SetTimer,CoCreateInstance,GetDlgItem,IsWindow,GetDlgItem,EnableWindow,GetDlgItem,ShowWindow,

0_2_000000014000CE2C

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

Code function: 0_2_0000000140002640 GetModuleHandleW,FindResourceExA,FindResourceExA,SizeofResource,LoadResource,LockResource,LoadLibraryA,GetProcAddress,wsprintfW,LoadLibraryA,GetProcAddress,

0_2_0000000140002640

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7016:120:WilError_03

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

File created: C:\Users\user\AppData\Local\Temp\7ZSfx000.cmd

Jump to behavior

Source: SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT sum(daily.Profit) as TotalPR1 from daily WHERE (CODSale = False or (CODSale = True and CODPAID = True)) and RetailLevel = 1;
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT supplierinvoices.date_c, supplierinvoices.SUPPLIER, supplierinvoices.INVNO, supplierinvoices.INVTOTAL, supplierinvoices.UnitCostExcl, supplierinvoices.PLUTOTALExcl, supplierinvoices.USER, supplierinvoices.PLU, supplierinvoices.Barcode, supplierinvoices.DESCRIPTION, supplierinvoices.QTY FROM supplierinvoices WHERE supplierinvoices.INVNO = 'DVBO-frmSupInvLoaded-txtDesc_Change2' and DESCRIPTION like '%N%' order by supplierinvoices.lineorder;&%' AND Supplier = 'T' and InvTotal < 0 and DESCRIPTION like '%&dd-MMM-yyyy : HH:MM:VBO-frmSupInvLoaded-ListItems
Source: EasyVBO.exe.0.dr	Binary or memory string: Select sales.date_c as tDate, Null as lTotal, Sum(sales.QTY) as sTotal from sales where Date_c Between '^' Group by format(sales.date_c, 'dd-MMM-yyyy');
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT Sum(daily.PLUTOTAL) AS TOTALACC from daily where RefNum <> '2' AND AccountSale = True;
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT Rentals.InvNo, Sum(Rentals.VAT) AS TotalVAT, Sum(Rentals.Discount) AS TotalDisc From Rentals where InvNo = 0 GROUP BY Rentals.InvNo;
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT sum(sales.PLUTOTAL) as TotalR2 from sales WHERE Date_c Between ',' and RetailLevel = 2;
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT sum(daily.PLUTOTAL) as TotalR1 from daily WHERE (CODSale = False or (CODSale = True and CODPAID = True)) and RetailLevel = 1;
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT sum(daily.PLUTOTAL) as TotalR2 from daily WHERE (CODSale = False or (CODSale = True and CODPAID = True)) and RetailLevel = 2;
Source: EasyVBO.exe.0.dr	Binary or memory string: Select sales.PLU, Null as lTotal, Sum(sales.QTY) as sTotal from sales where PLU = '' Group by sales.PLU;@Select from stock where PLU ='
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT orders.date_c, orders.DATELASTSOLD, orders.LASTRETAIL, orders.NUMBER, orders.PLU, orders.DESCRIPTION, orders.QTY, orders.ORDERED, orders.COSTEX, orders.Supplier, orders.LinkedToOther, stock.PLU, stock.SOH, stock.REORDER from orders,stock WHERE orders.PLU=stock.PLU AND `%' ORDER BY orders.Supplier, orders.Description;
Source: EasyVBO.exe.0.dr	Binary or memory string: Select suppliers.Supplier from suppliers group by suppliers.Supplier order by suppliers.Supplier;0] STOCK SUPPLIERS REPORT
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT sales.plu, sum(sales.PLUTOTAL) as TotalPettyIn from sales where Company = '*' group by sales.plu;
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT sales.Selected, sales.PLU, sales.Description, sum(sales.Qty) AS TotalQty, recipes.LinkPLU from sales, recipes where Company = 'DfrmSalesHistory-PrintRecipeItemsPP*' GROUP BY sales.PLU;
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT count(1) as RecCount, sales.InvNo from sales Where Date_c Between '.' Group By sales.InvNo;0VBO-mdiMain-ConnectAgain6VBO-mdiMain-cboServer_Click&mdiMain-CheckUpdate
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT sales.category, sum(sales.PLUTOTAL) as TotalSurcharges from sales where Company = '4' group by sales.category;
Source: EasyVBO.exe.0.dr	Binary or memory string: Select sales.date_c, Sum(sales.QTY) as sTotal from sales where PLU = '0' Group by sales.date_c;
Source: EasyVBO.exe.0.dr	Binary or memory string: Select date_format(sales.Date_c, '%m-%Y') as tDate, Sum(sales.PLUTOTAL) as MonthlyTotal, Sum(sales.PROFIT) as Profit from sales where Company = '\' Group by DATE_FORMAT(sales.Date_c, '%m-%Y');&Account sales only?
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT sales.PLU, sales.Description, sum(sales.Qty) AS TotalQty, recipes.LinkPLU from sales, recipes where Company = 'l' and recipes.LinkPLU = sales.PLU and Date_c Between 'n' GROUP BY sales.PLU,sales.DESCRIPTION,recipes.LINKPLU;
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT daily.LineOrder, daily.InvNo, Sum(daily.VAT) AS TotalVAT, Sum(daily.Discount) AS TotalDisc from daily where InvNo = t GROUP BY daily.LineOrder, daily.InvNo order by LineOrder;
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT daily.CustID, daily.Name, Sum(daily.PLUTotal) AS Total from daily where Company = 'n' and CashedUp = 0 and AccountSale = 1 AND Terminal = 'z' GROUP BY daily.CustID, daily.Name order by daily.Name Desc;2Account Receipts Summary:
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT sum(daily.PROFIT) as TotalPR2 from daily WHERE (CODSale = False or (CODSale = True and CODPAID = True)) and RetailLevel = 2;
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT SUM(sales.PLUTotalCost) as PLUTOTALCOST from sales where Company = '~SELECT SUM(sales.profit) as PROFIT from sales where Company = '^SELECT sales.InvNo from sales where Company = '0' Group By sales.InvNo;
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT -Sum(sales.InvTotal) as TTotal from sales where Company = ',') GROUP BY sales.VAT;
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT sales.Invno, sales.InvTotalCost from sales WHERE Date_c Between 'V' Group By sales.InvNo, sales.InvTotalCost;
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT Sum(sales.Profit) as Profit, Sum(sales.PLUTotal) AS Total from sales where Company = ',' And AccountSale = 1;6Please enter email address:
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT sales.Category, Sum(sales.PLUTotal) AS PLUTotal from sales where Date_c Between '4' GROUP BY sales.Category;
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT daily.driver, Sum(daily.CommValue) as Comm from daily where Company = '0' GROUP BY daily.driver;
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT sales.InvNo, Sum(sales.VAT) AS TotalVAT, Sum(sales.Discount) AS TotalDisc from sales where InvNo = , GROUP BY sales.InvNo;DSelect * from daily WHERE InvNo =
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT sales.PLU, sales.Description, Sum(sales.QTY) AS Qty, Sum(sales.PLUTotal) As PLUTotal, Sum(sales.Profit) as Profit from sales where Company = 'd' Group by description order by sales.Description;4SALES TOTALS FOR PERIOD :
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT supplierinvoices.date_c, supplierinvoices.InvNo, supplierinvoices.SUPPLIER, supplierinvoices.SUPID, supplierinvoices.INVTOTAL, supplierinvoices.USER From supplierinvoices where Date_c Between 'L' order by supplierinvoices.lineorder;\select * from supplierinvoices where InvNo = '$' and Supplier = 'NWould you like to print barcode labels?(mnuPrintSupInv_ClickF' and supplierinvoices.Supplier = '(' ORDER BY LineOrder6] SUPPLIER INVOICE LOADED:
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT Sum(daily.PROFIT) AS PROFIT from daily WHERE (CODSale = False or (CODSale = True and CODPAID = True)) and PLU <> '"' AND REFNUM <> '4' And AccountSale = False;lblTotalCashuplblSurchargeslblDiscountslblBasketmnuUser2lblPaymentslblToBanklblTotalNoVAT
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT users.PicCode, users.UserName, users.UserType, users.FullName from users GROUP BY users.PicCode, users.UserName, users.UserType, users.FullName ORDER BY users.UserName;
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT supplierinvoices.INVNO, supplierinvoices.INVTOTAL From supplierinvoices where Date_c = 'x' Group by supplierinvoices.INVNO,supplierinvoices.INVTOTAL;
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT sum(daily.DISCAMT) as TotalDisc from daily where Company = 'j' and (CODSale = 0 or (CODSale = 1 and CODPAID = 1));
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT Sum(sales.PLUTOTAL) AS TOTALACC from sales where Date_c Between 'P' and AccountSale = True and RefNum <> ',' and RetailLevel = 1;
Source: EasyVBO.exe.0.dr	Binary or memory string: Select stockdept.Department from stockdept group by stockdept.Department order by stockdept.Department;4] STOCK DEPARTMENTS REPORT8Stock Suppliers Report PrintVC:\eZ-Az!\Export\Stock Suppliers Report.csv
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT count(1) as RecCount, daily.InvNo from daily where (daily.CODSale = 0 or (daily.CODSale = 1 and daily.CODPAID = 1)) Group by daily.InvNo;
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT Quotations.InvNo, Sum(Quotations.VAT) AS TotalVAT from quotations where InvNo = 6 GROUP BY Quotations.InvNo;FSelect * from daily where InvNo = & order by LineOrder&Customer : CASH
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT Sum(daily.Profit) as Profit, Sum(daily.PLUTotal) AS Total from daily WHERE PLU <> '2' And AccountSale = True;
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT sales.AllocatedTo, Sum(sales.PLUTOTAL) AS Total, (Sum(sales.PLUTOTAL) / R) as TotalEx from sales where Company = 'T' and not isnull(AllocatedTo) and PLU <> ':' GROUP BY sales.AllocatedTo;>frmSalesHistory-cmdDetail_Click
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT sales.LineOrder, sales.InvNo, Sum(sales.VAT) AS TotalVAT, Sum(sales.Discount) AS TotalDisc from sales where InvNo = t GROUP BY sales.LineOrder, sales.InvNo order by LineOrder;(Reprinted invoice :
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT sales.plu, sum(sales.PLUTOTAL) as TotalPettyOut from sales where Company = ',') group by sales.plu;
Source: EasyVBO.exe.0.dr	Binary or memory string: Select supplierinvoices.date_c, Sum(supplierinvoices.QTY) as lTotal, Null as sTotal from supplierinvoices where PLU = 'F' Group by supplierinvoices.Date_c;<There are no records to print!>Item Totals Loaded/Sold History
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT stocksnap.PLU, stocksnap.Description, stocksnap.Department, stocksnap.Category, stocksnap.Supplier, stocksnap.SOH, stocksnap.QtySold, stocksnap.Loaded, stocksnap.TotalCostEx, stocksnap.TotalRetail from stocksnap where AtCashup = 1 and SnapDate Between 'p' Group By stocksnap.plu order by stocksnap.description;HfrmSalesHistory-PrintDailySalesSOHPP
Source: EasyVBO.exe.0.dr	Binary or memory string: Select supplierinvoices.PLU, Sum(supplierinvoices.QTY) as lTotal, Null as sTotal from supplierinvoices where PLU = '@' Group by supplierinvoices.PLU;
Source: EasyVBO.exe.0.dr	Binary or memory string: SELECT sales.Selected, sales.PLU, sales.Description, sales.AccountSale, sales.Refnum, sales.Name, sales.Contact, sales.IDNo, sales.VatNo, Sum(sales.QTY) AS Qty, Sum(sales.PLUTotal) As PLUTotal, Sum(sales.Profit) as Profit from sales where Company = 'd' Group by description order by sales.date_c desc;HfrmSalesHistory-PrintSalesDetailSlip

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe "C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\7ZSfx000.cmd" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\7ZSfx000.cmd" "	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior

Source: SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

Static file information: File size 2068446 > 1048576

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

Code function: 0_2_0000000140002DF0 LoadLibraryA,GetProcAddress,GetNativeSystemInfo,

0_2_0000000140002DF0

Source: SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

Static PE information: real checksum: 0x3a352 should be: 0x208771

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

File created: C:\ez-az!\EasyVBO.exe

Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

Dropped PE file which has not been started: C:\ez-az!\EasyVBO.exe

Jump to dropped file

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 0_2_0000000140004620 GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,		0_2_0000000140004620
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 0_2_0000000140003E88 FindFirstFileW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPEAX@Z,??3@YAXPEAX@Z,		0_2_0000000140003E88

Source: EasyVBO.exe.0.dr	Binary or memory string: ar-AEJServer Datacenter (core installation)jServer Datacenter without Hyper-V (core installation)jServer Datacenter without Hyper-V (full installation)
Source: EasyVBO.exe.0.dr	Binary or memory string: ar-OMZWindows Small Business Server 2011 Essentials:Windows Small Business Server:Small Business Server PremiumbSmall Business Server Premium (core installation)2Windows MultiPoint ServerRServer Standard (evaluation installation)FServer Standard (core installation)>Server Standard without Hyper-VfServer Standard without Hyper-V (core installation)0Server Solutions PremiumXServer Solutions Premium (core installation)
Source: EasyVBO.exe.0.dr	Binary or memory string: ar-TNjServer Enterprise without Hyper-V (core installation)VServer Enterprise for Itanium-based SystemsjServer Enterprise without Hyper-V (full installation)XWindows Essential Server Solution Management0Windows Home Server 2011
Source: EasyVBO.exe.0.dr	Binary or memory string: ar-SYRWindows Storage Server 2008 R2 Essentials0Microsoft Hyper-V Server
Source: EasyVBO.exe.0.dr	Binary or memory string: Windows Server 2008 without Hyper-V for Windows Essential Server Solutions

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

Code function: 0_2_0000000140002DF0 LoadLibraryA,GetProcAddress,GetNativeSystemInfo,

0_2_0000000140002DF0

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 0_2_0000000140001120 RtlAddVectoredExceptionHandler,		0_2_0000000140001120
Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	Code function: 0_2_0000000140023600 SetUnhandledExceptionFilter,		0_2_0000000140023600

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

Code function: 0_2_0000000140007290 ??3@YAXPEAX@Z,ShellExecuteExW,WaitForSingleObject,CloseHandle,??3@YAXPEAX@Z,??3@YAXPEAX@Z,

0_2_0000000140007290

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\7ZSfx000.cmd" "

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

Code function: 0_2_0000000140002E64 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_0000000140002E64

Source: EasyVBO.exe.0.dr	Binary or memory string: Progman
Source: EasyVBO.exe.0.dr	Binary or memory string: Shell_traywnd

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

Code function: 0_2_0000000140022B70 cpuid

0_2_0000000140022B70

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

Code function: GetLastError,wsprintfW,GetEnvironmentVariableW,GetLastError,??2@YAPEAX_K@Z,GetEnvironmentVariableW,GetLastError,lstrcmpiW,??3@YAXPEAX@Z,SetLastError,lstrlenA,??2@YAPEAX_K@Z,GetLocaleInfoW,_wtol,MultiByteToWideChar,

0_2_0000000140002BB4

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

Code function: 0_2_0000000140004C64 lstrlenW,GetSystemTimeAsFileTime,GetFileAttributesW,??3@YAXPEAX@Z,??3@YAXPEAX@Z,

0_2_0000000140004C64

Source: C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

Code function: 0_2_0000000140007FA4 ?_set_new_handler@@YAP6AH_K@ZP6AH0@Z@Z,GetVersionExW,GetCommandLineW,lstrlenW,wsprintfW,_wtol,GetModuleFileNameW,_wtol,??2@YAPEAX_K@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,wsprintfW,_wtol,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,GetCommandLineW,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,GetCurrentProcess,SetProcessWorkingSetSize,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,CoInitialize,lstrlenW,memcpy,_wtol,??3@YAXPEAX@Z,??3@YAXPEAX@Z,GetKeyState,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,GetFileAttributesW,??3@YAXPEAX@Z,??3@YAXPEAX@Z,_wtol,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,SetLastError,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,SetCurrentDirectoryW,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,??3@YAXPEAX@Z,MessageBoxA,

0_2_0000000140007FA4

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	12 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	12 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 DLL Side-Loading	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	24 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe	6%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ez-az!\EasyVBO.exe	0%	Virustotal		Browse

Name	Source	Malicious	Reputation
https://www.winsms.co.za/api/credits.ASP?User=	EasyVBO.exe.0.dr	false	high
https://www.google.com/	EasyVBO.exe.0.dr	false	high
http://www.easyas.co.zaBYour	EasyVBO.exe.0.dr	false	unknown
https://www.easyas.co.za/downloads/7zEasyVBO.exef	EasyVBO.exe.0.dr	false	high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427742
Start date and time:	2024-04-18 03:33:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe
Detection:	CLEAN
Classification:	clean6.winEXE@5/2@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 78 Number of non-executed functions: 68
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Process:	C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	5.152383346840018
Encrypted:	false
SSDEEP:	6:mRoiowv2sw7uvXWhjAdbMD2Uwv2sw7uvXWhjAd10Wiowkn23fS3:mRoeQuvGqd9QuvGqd1Lef8
MD5:	277D1B8F03BF100459AD736A4706F463
SHA1:	955EBC1232CBDC1841B12424CCF673345C7F2CD2
SHA-256:	99477299FA042E5CAC31BDA70B55C3C977050D74D8FF7074A455C6F98A769181
SHA-512:	24790F507F21F4E5DD82FCE10C7473BEA79F94277F9E69A85ABD357E649D16C28249EF7E6155882C47B3A0F8687ECEE85E29DD9CB4A187C077A6CE6213B843F5
Malicious:	false
Reputation:	low
Preview:	:Repeat..del "C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe"..if exist "C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe" goto Repeat..del "C:\Users\user\AppData\Local\Temp\7ZSfx000.cmd"..

C:\ez-az!\EasyVBO.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19781992
Entropy (8bit):	6.212819135706876
Encrypted:	false
SSDEEP:	393216:Aihl2xljXZofwLBIcpLQwK7oM2j004g4CNKQj95sXNb5SzBEPWLXfCHMd+fhUFCb:AS2xJp70SDblaXPUpccULgAph
MD5:	FCFB4A2D4401291F004769097E0824B9
SHA1:	BC993EE8C0D1CB8C4C7EA624466513629BCF0832
SHA-256:	365987CB64D860C9984A91808F295D85D4860323D0339EF284B6783D019E902A
SHA-512:	E63AFC2FE57BF787533B7D7E66C75DCC793FF8CE966ECB093A707A26F5508203D5DBD4CA9CF436B87241F966F61356B582BBDACA2AC7F565ECA4A31DD03E6C78
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......a...%.u.%.u.%.u...{.$.u.j.\|.1.u...x.$.u.Rich%.u.........................PE..L..... f.................`-.. ......HP.......p-...@...........................1..............................................T-.d....`1.\ ............-.h)..................................................8...l....................................text....[-......`-................. ..`.data........p-......p-.............@....rsrc...\ ...`1..0....-.............@..@....0.....yq:...\|.>.G....h.Q.....^\...........OLE32.DLL.KERNEL32.DLL.NTDLL.DLL.URLMON.DLL.MSVBVM60.DLL........................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.964571416300009
TrID:	Win64 Executable GUI (202006/5) 91.78% Win64 Executable (generic) (12005/4) 5.45% Win16/32 Executable Delphi generic (2074/23) 0.94% Generic Win/DOS Executable (2004/3) 0.91% DOS Executable Generic (2002/1) 0.91%
File name:	SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe
File size:	2'068'446 bytes
MD5:	87b6fcfdaa0ab94d9cf4b7f3cbbc8b8b
SHA1:	2e3dacf58466b4b7a2c6d52b008f6e1b4c98911a
SHA256:	c1874e86e54a70b1917c708826975e45fa5c813f0ec30f6afd4971100ac0e5b7
SHA512:	cad60287d7340fff636e13443544e1fcc9796ff165f7b56afe8bfeb1b240dfc002f9d6872bba6c6a993a81ff1362e74ea52c9b58067a5d1a59f347bf20ca7c4f
SSDEEP:	49152:Il4n2ygDR5l1R+2CvsKU4TP5GdY/5ONw2cK9vWvGYYhfBfah7Dgpqqd:JnsRfXovsKjTxkGONw54vWvxYNBfahIr
TLSH:	A6A5235B323551F8D5678078CA8A865BF3F278890731938F1270CB7B5F277A56C6A321
File Content Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..d......P..........#..................5.........@.............................P......R.......................................................\|........0.....

File Icon


Icon Hash:	0536331b729a9a4a

Static PE Info

General

Entrypoint:	0x140023590
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x50E0DEC6 [Mon Dec 31 00:39:34 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	08fd62a9d05cc8111782017958ea975d

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F880D39B1B8h
dec eax
add esp, 28h
jmp 00007F880D39ACAFh
jmp dword ptr [000010B0h]
jmp dword ptr [000010B2h]
jmp dword ptr [000010B4h]
jmp dword ptr [000010B6h]
int3
int3
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [ecx]
cmp dword ptr [eax], E06D7363h
jne 00007F880D39AFEEh
cmp dword ptr [eax+18h], 04h
jne 00007F880D39AFE8h
mov eax, dword ptr [eax+20h]
cmp eax, 19930520h
je 00007F880D39AFD7h
cmp eax, 19930521h
je 00007F880D39AFD0h
cmp eax, 19930522h
je 00007F880D39AFC9h
cmp eax, 01994000h
jne 00007F880D39AFC9h
call dword ptr [000010FAh]
int3
xor eax, eax
dec eax
add esp, 28h
ret
int3
int3
dec eax
sub esp, 28h
dec eax
lea ecx, dword ptr [FFFFFFB1h]
call dword ptr [00000A97h]
xor eax, eax
dec eax
add esp, 28h
ret
jmp dword ptr [00001072h]
int3
int3
dec eax
mov eax, ecx
mov ecx, 00005A4Dh
cmp word ptr [eax], cx
je 00007F880D39AFC5h
xor eax, eax
ret
dec eax
arpl word ptr [eax+3Ch], cx
dec eax
add ecx, eax
xor eax, eax
cmp dword ptr [ecx], 00004550h
jne 00007F880D39AFCEh
mov edx, 0000020Bh
cmp word ptr [ecx+18h], dx
sete al
rep ret
int3
dec esp
arpl word ptr [ecx+3Ch], ax
inc ebp
xor ecx, ecx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x28c7c	0xc8	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x33000	0x1500	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x31000	0x1eb4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x24000	0x720	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x22cee	0x22e00	f158047ebe99d29de226689b79ac5102	False	0.5297239023297491	zlib compressed data	6.371845942933979	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x24000	0x634c	0x6400	2b1b7806aa55db71cb683e76cc1b00a0	False	0.4071484375	data	5.241175621947523	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2b000	0x53e8	0xe00	28b200f1a51873f7a601ddce6d47825d	False	0.36021205357142855	data	3.6291582394007675	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x31000	0x1eb4	0x2000	5886961f7384ad35e90549e1353999ec	False	0.457275390625	data	5.166903373683131	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x33000	0x1500	0x1600	ee950c13a402eb14ff9afe058728a934	False	0.34730113636363635	data	3.976781071635148	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x331c0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1536	Russian	Russia	0.2579268292682927
RT_ICON	0x33828	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512, 16 important colors	Russian	Russia	0.3803763440860215
RT_ICON	0x33b10	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 384	Russian	Russia	0.4344262295081967
RT_ICON	0x33cf8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Russian	Russia	0.46621621621621623
RT_GROUP_ICON	0x33e20	0x3e	data	Russian	Russia	0.8064516129032258
RT_VERSION	0x33e60	0x358	data	English	United States	0.477803738317757
RT_MANIFEST	0x341b8	0x346	ASCII text, with CRLF line terminators	English	United States	0.5059665871121718

Imports

DLL	Import
COMCTL32.dll
SHELL32.dll	ShellExecuteW, SHBrowseForFolderW, SHGetSpecialFolderPathW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteExW, SHGetMalloc
GDI32.dll	CreateCompatibleDC, CreateFontIndirectW, DeleteObject, DeleteDC, GetCurrentObject, StretchBlt, GetDeviceCaps, CreateCompatibleBitmap, SelectObject, SetStretchBltMode, GetObjectW
ADVAPI32.dll	FreeSid, AllocateAndInitializeSid, CheckTokenMembership
USER32.dll	wvsprintfW, CreateWindowExA, GetSystemMenu, EnableMenuItem, IsWindow, EnableWindow, MessageBeep, LoadIconW, LoadImageW, SetWindowsHookExW, PtInRect, CallNextHookEx, DefWindowProcW, CallWindowProcW, DrawIconEx, DialogBoxIndirectParamW, GetWindow, ClientToScreen, GetDC, DrawTextW, ShowWindow, SystemParametersInfoW, GetSystemMetrics, SetFocus, UnhookWindowsHookEx, SetWindowLongPtrW, GetClientRect, GetDlgItem, GetKeyState, MessageBoxA, SetWindowTextW, wsprintfA, GetSysColor, GetWindowTextLengthW, GetWindowTextW, GetClassNameA, GetWindowLongW, GetMenu, SetWindowPos, GetWindowDC, ReleaseDC, CopyImage, GetParent, CharUpperW, ScreenToClient, CreateWindowExW, SetTimer, GetWindowRect, DispatchMessageW, KillTimer, DestroyWindow, SendMessageW, EndDialog, wsprintfW, GetWindowLongPtrW, GetMessageW
ole32.dll	CreateStreamOnHGlobal, CoInitialize, CoCreateInstance
OLEAUT32.dll	SysFreeString, VariantClear, OleLoadPicture, SysAllocString
KERNEL32.dll	ReadFile, SetFileTime, SetEndOfFile, SetUnhandledExceptionFilter, QueryPerformanceCounter, GetTickCount, WaitForMultipleObjects, SetFilePointer, GetFileSize, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, FormatMessageW, lstrcpyW, LocalFree, IsBadReadPtr, GetSystemDirectoryW, GetCurrentThreadId, SuspendThread, TerminateThread, InitializeCriticalSection, ResetEvent, SetEvent, CreateEventW, GetVersionExW, GetModuleFileNameW, GetCurrentProcess, SetProcessWorkingSetSize, SetCurrentDirectoryW, GetDriveTypeW, CreateFileW, GetCommandLineW, GetStartupInfoW, CreateProcessW, CreateJobObjectW, AssignProcessToJobObject, CreateIoCompletionPort, SetInformationJobObject, ResumeThread, GetQueuedCompletionStatus, GetExitCodeProcess, CloseHandle, SetEnvironmentVariableW, GetTempPathW, GetSystemTimeAsFileTime, lstrlenW, CompareFileTime, SetThreadLocale, FindFirstFileW, DeleteFileW, FindNextFileW, FindClose, RemoveDirectoryW, lstrcmpW, ExpandEnvironmentStringsW, WideCharToMultiByte, VirtualAlloc, GlobalMemoryStatusEx, GetEnvironmentVariableW, lstrcmpiW, lstrlenA, GetLocaleInfoW, MultiByteToWideChar, GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetSystemDefaultLCID, lstrcmpiA, GlobalAlloc, GlobalFree, MulDiv, FindResourceExA, SizeofResource, LoadResource, LockResource, LoadLibraryA, GetProcAddress, ExitProcess, lstrcatW, AddVectoredExceptionHandler, RemoveVectoredExceptionHandler, GetDiskFreeSpaceExW, SetFileAttributesW, SetLastError, Sleep, GetExitCodeThread, WaitForSingleObject, CreateThread, GetLastError, SystemTimeToFileTime, GetLocalTime, GetFileAttributesW, CreateDirectoryW, WriteFile, GetStdHandle, VirtualFree, GetModuleHandleW, GetCurrentProcessId
msvcrt.dll	__CxxFrameHandler, _purecall, ??3@YAXPEAX@Z, ??2@YAPEAX_K@Z, memcmp, free, memcpy, _wtol, memmove, malloc, wcsncmp, strncmp, _wcsnicmp, memset, ?_set_new_handler@@YAP6AH_K@ZP6AH0@Z@Z, _beginthreadex, _CxxThrowException, __C_specific_handler, _unlock, __dllonexit, _lock, _onexit, ??1type_info@@UEAA@XZ, __getmainargs, _XcptFilter, _exit, _ismbblead, _cexit, exit, _acmdln, _initterm, _amsg_exit, __setusermatherr, _commode, _fmode, __set_app_type, ?terminate@@YAXXZ

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

Target ID:	0
Start time:	03:33:52
Start date:	18/04/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe"
Imagebase:	0x140000000
File size:	2'068'446 bytes
MD5 hash:	87B6FCFDAA0AB94D9CF4B7F3CBBC8B8B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:33:58
Start date:	18/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\7ZSfx000.cmd" "
Imagebase:	0x7ff6c0050000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:33:58
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	18.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	40.4%
Total number of Nodes:	1538
Total number of Limit Nodes:	31

Executed Functions

Function 0000000140007FA4 Relevance: 255.8, APIs: 95, Strings: 50, Instructions: 2028stringwindowCOMMON

Download Yara Rule

APIs

?_set_new_handler@@YAP6AH_K@ZP6AH0@Z@Z.MSVCRT ref: 0000000140007FCA

Part of subcall function 000000014000252C: GetModuleHandleW.KERNEL32 ref: 0000000140002537
Part of subcall function 000000014000252C: CreateWindowExW.USER32 ref: 0000000140002581
Part of subcall function 000000014000252C: SetTimer.USER32 ref: 000000014000259C
Part of subcall function 000000014000252C: GetMessageW.USER32 ref: 00000001400025AF
Part of subcall function 000000014000252C: DispatchMessageW.USER32 ref: 00000001400025BA
Part of subcall function 000000014000252C: KillTimer.USER32 ref: 00000001400025C8
Part of subcall function 000000014000252C: DestroyWindow.USER32 ref: 00000001400025D1

GetVersionExW.KERNEL32 ref: 0000000140007FE8
MessageBoxA.USER32 ref: 000000014000A31D

Part of subcall function 00000001400011B4: ??2@YAPEAX_K@Z.MSVCRT ref: 00000001400011E7
Part of subcall function 00000001400011B4: ??3@YAXPEAX@Z.MSVCRT ref: 000000014000121C

GetCommandLineW.KERNEL32 ref: 0000000140008110

Part of subcall function 0000000140003BB8: ??3@YAXPEAX@Z.MSVCRT ref: 0000000140003CF5
Part of subcall function 0000000140003BB8: ??3@YAXPEAX@Z.MSVCRT ref: 0000000140003D14
Part of subcall function 0000000140003BB8: ??3@YAXPEAX@Z.MSVCRT ref: 0000000140003D1C

lstrlenW.KERNEL32 ref: 0000000140008152

Part of subcall function 00000001400044D4: ??2@YAPEAX_K@Z.MSVCRT ref: 0000000140004545
Part of subcall function 00000001400044D4: ??3@YAXPEAX@Z.MSVCRT ref: 00000001400045BF
Part of subcall function 00000001400044D4: ??3@YAXPEAX@Z.MSVCRT ref: 00000001400045C9

Part of subcall function 0000000140005E24: #17.COMCTL32 ref: 0000000140005E36
Part of subcall function 0000000140005E24: SHGetSpecialFolderPathW.SHELL32 ref: 0000000140005EDF
Part of subcall function 0000000140005E24: wsprintfW.USER32 ref: 0000000140005EF8

wsprintfW.USER32 ref: 00000001400081CE
_wtol.MSVCRT ref: 0000000140008227
GetModuleFileNameW.KERNEL32 ref: 0000000140008306
??2@YAPEAX_K@Z.MSVCRT ref: 0000000140008767
??3@YAXPEAX@Z.MSVCRT ref: 000000014000A04C
??3@YAXPEAX@Z.MSVCRT ref: 000000014000A082
??3@YAXPEAX@Z.MSVCRT ref: 000000014000A08C
??3@YAXPEAX@Z.MSVCRT ref: 000000014000A09D
??3@YAXPEAX@Z.MSVCRT ref: 000000014000A0AA
??3@YAXPEAX@Z.MSVCRT ref: 000000014000A0B7
??3@YAXPEAX@Z.MSVCRT ref: 000000014000A0BF
SetCurrentDirectoryW.KERNEL32 ref: 000000014000A10D
??3@YAXPEAX@Z.MSVCRT ref: 000000014000A156

Part of subcall function 000000014000620C: lstrlenW.KERNEL32 ref: 0000000140006248
Part of subcall function 000000014000620C: lstrlenW.KERNEL32 ref: 0000000140006254

??3@YAXPEAX@Z.MSVCRT ref: 000000014000A299
??3@YAXPEAX@Z.MSVCRT ref: 000000014000A2A3
??3@YAXPEAX@Z.MSVCRT ref: 000000014000A2BE
??3@YAXPEAX@Z.MSVCRT ref: 000000014000A2F4
??3@YAXPEAX@Z.MSVCRT ref: 000000014000A2FE

Strings

FinishMessage, xrefs: 000000014000A18C
sfxelevation, xrefs: 00000001400082AB, 0000000140008F0E
123456789ABCDEFGHJKMNPQRSTUVWXYZ, xrefs: 0000000140009256
SfxAuthor, xrefs: 00000001400091EA
7ZipSfx.%03x, xrefs: 0000000140009646
hidcon, xrefs: 0000000140009AA9
, xrefs: 00000001400081A3
MiscFlags, xrefs: 0000000140008AF8
OverwriteMode, xrefs: 0000000140008A69
x64, xrefs: 0000000140008158, 0000000140009C78
forcenowait, xrefs: 0000000140009B14
nowait, xrefs: 0000000140009ADA
SfxVarModulePlatform, xrefs: 0000000140008169
amd64, xrefs: 0000000140009C50
7-Zip SFX, xrefs: 000000014000A307
sfxtest, xrefs: 0000000140008351
BeginPromptTimeout, xrefs: 0000000140008BC7, 000000014000932D
bpt, xrefs: 0000000140008BAE
AutoInstall, xrefs: 0000000140009483, 00000001400094F9, 0000000140009A01
ExecuteFile, xrefs: 0000000140009539, 0000000140009555
waitall, xrefs: 0000000140009A77
:, xrefs: 0000000140009A72
sfxlang, xrefs: 0000000140008209
Shortcut, xrefs: 000000014000A0E4
sfxconfig, xrefs: 00000001400084D7, 0000000140008858
SfxString%d, xrefs: 0000000140008942
Sorry, this program requires Microsoft Windows 2000 or later., xrefs: 000000014000A30E
shc, xrefs: 0000000140009B87
BeginPrompt, xrefs: 00000001400093E4
SetEnvironment, xrefs: 00000001400090C9
ExecuteParameters, xrefs: 0000000140009D06
sfxwaitall, xrefs: 0000000140008288
GUIMode, xrefs: 0000000140008AAE
HelpText, xrefs: 0000000140009110
" -, xrefs: 0000000140008EF7
setup.exe, xrefs: 00000001400098FD, 0000000140009909
InstallPath, xrefs: 00000001400091B4
i386, xrefs: 0000000140009C15
SfxVarCmdLine2, xrefs: 0000000140008992, 0000000140008E3C
SfxVarCmdLine0, xrefs: 000000014000818C
SfxVarCmdLine1, xrefs: 0000000140008D90
x86, xrefs: 0000000140009BED
sfxversion, xrefs: 000000014000826A
RunProgram, xrefs: 0000000140009577, 0000000140009593
SfxVarSystemLanguage, xrefs: 00000001400081EE
SfxVarSystemPlatform, xrefs: 000000014000817A
GUIFlags, xrefs: 0000000140008AD3
Delete, xrefs: 000000014000A11A
SelfDelete, xrefs: 0000000140008B39, 000000014000A223
del, xrefs: 0000000140009BBA

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@$??2@Messagelstrlen$ModuleTimerWindowwsprintf$?_set_new_handler@@CommandCreateCurrentDestroyDirectoryDispatchFileFolderHandleKillLineNamePathSpecialVersion_wtol
String ID: $" -$123456789ABCDEFGHJKMNPQRSTUVWXYZ$7-Zip SFX$7ZipSfx.%03x$:$AutoInstall$BeginPrompt$BeginPromptTimeout$Delete$ExecuteFile$ExecuteParameters$FinishMessage$GUIFlags$GUIMode$HelpText$InstallPath$MiscFlags$OverwriteMode$RunProgram$SelfDelete$SetEnvironment$SfxAuthor$SfxString%d$SfxVarCmdLine0$SfxVarCmdLine1$SfxVarCmdLine2$SfxVarModulePlatform$SfxVarSystemLanguage$SfxVarSystemPlatform$Shortcut$Sorry, this program requires Microsoft Windows 2000 or later.$amd64$bpt$del$forcenowait$hidcon$i386$nowait$setup.exe$sfxconfig$sfxelevation$sfxlang$sfxtest$sfxversion$sfxwaitall$shc$waitall$x64$x86
API String ID: 3747563368-1559077127
Opcode ID: 4ef42f46e25c75f399746fa4bbb1b5ad56f32420e56fd404ebd352ac327b6c5f
Instruction ID: db551c5363eaed7a2341ab669c1e9c118c0dded1f732eccb4f1a25bb0e919439
Opcode Fuzzy Hash: 4ef42f46e25c75f399746fa4bbb1b5ad56f32420e56fd404ebd352ac327b6c5f
Instruction Fuzzy Hash: 02238FB260468181EA73EB17F4513EAA3A1F78D7D0F858016FB8A476B6DB7CC985C701

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000CE2C Relevance: 30.1, APIs: 20, Instructions: 142
windowcomtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014000A8D4: GetDlgItem.USER32 ref: 000000014000A8E7
Part of subcall function 000000014000A8D4: ShowWindow.USER32 ref: 000000014000A8FC

GetDlgItem.USER32 ref: 000000014000CE6F
SendMessageW.USER32 ref: 000000014000CE86
GetDlgItem.USER32 ref: 000000014000CEB1
SetWindowTextW.USER32 ref: 000000014000CEC0

Part of subcall function 0000000140005D88: ??3@YAXPEAX@Z.MSVCRT ref: 0000000140005DE3
Part of subcall function 0000000140005D88: ??3@YAXPEAX@Z.MSVCRT ref: 0000000140005DED
Part of subcall function 0000000140005D88: SetWindowTextW.USER32 ref: 0000000140005DFA
Part of subcall function 0000000140005D88: ??3@YAXPEAX@Z.MSVCRT ref: 0000000140005E07

GetDlgItem.USER32 ref: 000000014000CEF0
GetWindowLongPtrW.USER32 ref: 000000014000CF00
GetDlgItem.USER32 ref: 000000014000CF15
SetWindowLongPtrW.USER32 ref: 000000014000CF23
GetSystemMenu.USER32 ref: 000000014000CF4F
EnableMenuItem.USER32 ref: 000000014000CF65
GetDlgItem.USER32 ref: 000000014000CF74
SetFocus.USER32 ref: 000000014000CF7D
SetTimer.USER32 ref: 000000014000CFB6
CoCreateInstance.OLE32 ref: 000000014000CFE9
GetDlgItem.USER32 ref: 000000014000D00C
IsWindow.USER32 ref: 000000014000D015
GetDlgItem.USER32 ref: 000000014000D025
EnableWindow.USER32 ref: 000000014000D030
GetDlgItem.USER32 ref: 000000014000D048
ShowWindow.USER32 ref: 000000014000D053

Part of subcall function 000000014000AE64: GetDlgItem.USER32 ref: 000000014000AE9F

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Item$Window$??3@$EnableLongMenuShowText$CreateFocusInstanceMessageSendSystemTimer
String ID:
API String ID: 2865198823-0
Opcode ID: 5ce78dd444096b8786c346c29929ee32c62203d06813a0206295d19df5ea6e21
Instruction ID: 079c7ac86b116e49045ffb4edc75684c67d86df7d9bfec031532efdebc40771f
Opcode Fuzzy Hash: 5ce78dd444096b8786c346c29929ee32c62203d06813a0206295d19df5ea6e21
Instruction Fuzzy Hash: D6612675700A5182EB16EB23F8543AA63A1FB8DBC4F548029AF5A47B76CF3DD8468700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001AB78 Relevance: 29.3, APIs: 19, Instructions: 841COMMON

Download Yara Rule

APIs

Part of subcall function 000000014001E5E0: memset.MSVCRT ref: 000000014001E735

??2@YAPEAX_K@Z.MSVCRT ref: 000000014001AC78
??2@YAPEAX_K@Z.MSVCRT ref: 000000014001ACBF

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??2@$memset
String ID:
API String ID: 1860491036-0
Opcode ID: 754dafb53211b6b89d7064efe52fa548b32d53189381823beab15babbee0611b
Instruction ID: ed1fc53f798cd692ea34d8e720e547a4d58ead03ce6a790df6d4e213704e53ff
Opcode Fuzzy Hash: 754dafb53211b6b89d7064efe52fa548b32d53189381823beab15babbee0611b
Instruction Fuzzy Hash: DC920A36209AC486DB71DF26E4907DEB3A0F789B84F944116EB8E47BA5DF39C549CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140002640 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 83
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 0000000140002664
FindResourceExA.KERNEL32 ref: 000000014000267E
FindResourceExA.KERNEL32 ref: 000000014000269A
SizeofResource.KERNEL32 ref: 00000001400026B3
LoadResource.KERNEL32 ref: 00000001400026C5
LockResource.KERNEL32 ref: 00000001400026D3
LoadLibraryA.KERNEL32 ref: 00000001400026FC
GetProcAddress.KERNEL32 ref: 000000014000270C
wsprintfW.USER32 ref: 000000014000273A
LoadLibraryA.KERNEL32 ref: 000000014000274C
GetProcAddress.KERNEL32 ref: 000000014000275C

Strings

SetThreadPreferredUILanguages, xrefs: 0000000140002752
%04X%c%04X%c, xrefs: 0000000140002720
SetProcessPreferredUILanguages, xrefs: 0000000140002702
kernel32, xrefs: 00000001400026EB, 0000000140002745

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Resource$Load$AddressFindLibraryProc$HandleLockModuleSizeofwsprintf
String ID: %04X%c%04X%c$SetProcessPreferredUILanguages$SetThreadPreferredUILanguages$kernel32
API String ID: 2639302590-365843014
Opcode ID: a2f189bdfd28608f52dff0fd3af26c1fbaefb9dd969611c1fe3c02c1d799a4c5
Instruction ID: f6dca357354e6560be330941fd006cb1e74769c1960c74121044c9e71c2572c5
Opcode Fuzzy Hash: a2f189bdfd28608f52dff0fd3af26c1fbaefb9dd969611c1fe3c02c1d799a4c5
Instruction Fuzzy Hash: 7E310E71301A01C6EF569B13B8487A863A0B74CFD5F898129AE4E47774EF38D949CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140004C64 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 124
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32 ref: 0000000140004C7D
GetSystemTimeAsFileTime.KERNEL32 ref: 0000000140004D0B
GetFileAttributesW.KERNELBASE ref: 0000000140004D14
??3@YAXPEAX@Z.MSVCRT ref: 0000000140004DF5

Part of subcall function 00000001400011B4: ??2@YAPEAX_K@Z.MSVCRT ref: 00000001400011E7
Part of subcall function 00000001400011B4: ??3@YAXPEAX@Z.MSVCRT ref: 000000014000121C

??3@YAXPEAX@Z.MSVCRT ref: 0000000140004D82

Strings

:, xrefs: 0000000140004D65
/, xrefs: 0000000140004CB9

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@$FileTime$??2@AttributesSystemlstrlen
String ID: /$:
API String ID: 655742493-4222935259
Opcode ID: d157c9533f0f9d49ef8e3418face91079c4844c2be8b94a2e191a57bb3c86796
Instruction ID: f8fbb18883293c944a5223a04127ae13a98a5e64185f6a48e103599028eb0a7f
Opcode Fuzzy Hash: d157c9533f0f9d49ef8e3418face91079c4844c2be8b94a2e191a57bb3c86796
Instruction Fuzzy Hash: 1E4176F260074191FB76EF27B8057ED62A0B758BC8F049122BF46476FBDBB8C9468245

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140002DF0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000000140002DFB
GetProcAddress.KERNEL32 ref: 0000000140002E0B
GetNativeSystemInfo.KERNELBASE ref: 0000000140002E1B

Strings

GetNativeSystemInfo, xrefs: 0000000140002E01
kernel32, xrefs: 0000000140002DF4

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: AddressInfoLibraryLoadNativeProcSystem
String ID: GetNativeSystemInfo$kernel32
API String ID: 2103483237-3846845290
Opcode ID: 169ea72a8e44f366d28411f9fb4270812fba7da24471d97dbd32d1ceaaff366f
Instruction ID: 12807e536fd761ecd2e755d78b37e2178466a37d5335733e22d95b3fde629c5d
Opcode Fuzzy Hash: 169ea72a8e44f366d28411f9fb4270812fba7da24471d97dbd32d1ceaaff366f
Instruction Fuzzy Hash: 65E0B634614981C2EA67AB52F8503A522A4B788B80F840119B64E432B0EF3CDA4A8600

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140004620 Relevance: 7.5, APIs: 5, Instructions: 41COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE ref: 0000000140004633
SetLastError.KERNEL32 ref: 000000014000464B

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID:
API String ID: 1799206407-0
Opcode ID: 732aa5cf8a0b536b1d73982889c9a663d39d9e536a769e1e128de2abf31fdd25
Instruction ID: f2a4ae8da89aa704bebc97db6a782c5147fdb8b6e4a3716fcaa04814ab1f2660
Opcode Fuzzy Hash: 732aa5cf8a0b536b1d73982889c9a663d39d9e536a769e1e128de2abf31fdd25
Instruction Fuzzy Hash: 130175F020490581FB62CB23F8443E91350A78EBF4F544324FB76472F6EE79C8488A06

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001BE60 Relevance: 3.6, APIs: 2, Instructions: 607COMMON

Download Yara Rule

APIs

??2@YAPEAX_K@Z.MSVCRT ref: 000000014001C19B
??2@YAPEAX_K@Z.MSVCRT ref: 000000014001C2D6

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: b8ce4e3a7f9cda4a03bc003810d2454121b1d52160f0f282c9a5e923796ff970
Instruction ID: f66374e12b2ef1ee8c20eee0e254ebf10d7c98769e3fdc09a342321545d7bcfe
Opcode Fuzzy Hash: b8ce4e3a7f9cda4a03bc003810d2454121b1d52160f0f282c9a5e923796ff970
Instruction Fuzzy Hash: 21526E36218B8082DB65DF26E4907EEB7A0F788BD4F144116EF8A4BBA5DF39C455CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001240 Relevance: 3.0, APIs: 2, Instructions: 32windowCOMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNELBASE ref: 0000000140001264

Part of subcall function 000000014000D280: IsWindow.USER32 ref: 000000014000D2A9
Part of subcall function 000000014000D280: IsBadReadPtr.KERNEL32 ref: 000000014000D2BF
Part of subcall function 000000014000D280: ??3@YAXPEAX@Z.MSVCRT ref: 000000014000D314

SendMessageW.USER32 ref: 00000001400012BE

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@DiskFreeMessageReadSendSpaceWindow
String ID:
API String ID: 1707747161-0
Opcode ID: 34a6eb46a1e37af6cfcb9f0952c6949315762cfb0f2351f1f41dadfaf1e27716
Instruction ID: 4832e38faedfc34bcfc9005da668c70e8bca9e0630ae1cf6d573793ac2f8c69a
Opcode Fuzzy Hash: 34a6eb46a1e37af6cfcb9f0952c6949315762cfb0f2351f1f41dadfaf1e27716
Instruction Fuzzy Hash: 1A018B7162054282FB12DB62B8187D523A0EBCD3C4F804419FB4A87AB4DFB9C8568B01

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001120 Relevance: 1.5, APIs: 1, Instructions: 10COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAddVectoredExceptionHandler.NTDLL ref: 0000000140001132

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: 29db9e29e85a20634c378d6f7e594186e95775e4190722e96d78594e3bd7500c
Instruction ID: 11c84ac962bfac1d3e3f6bf1921e280f4780a080860a21bfcd0e6c9db30b0d65
Opcode Fuzzy Hash: 29db9e29e85a20634c378d6f7e594186e95775e4190722e96d78594e3bd7500c
Instruction Fuzzy Hash: B8C02BB0700204C1FF1A4BB3B4413D412209B0C7C0F486025DE160F320C93CC1D98710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140023600 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE ref: 000000014002360B

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 12a09a6572b507f28eb06b83899dc6345859f3a02e273289c0f5a8ab2bbb5133
Instruction ID: 8a2cfb7a60becd5b6d388a39692cd0d19847975afaf430174f4ae598c23b6f62
Opcode Fuzzy Hash: 12a09a6572b507f28eb06b83899dc6345859f3a02e273289c0f5a8ab2bbb5133
Instruction Fuzzy Hash: F2B01230B11810D1D705AB23ECC13C012A0675C350FD10419D30D82130DA3CC9DF8B04

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000C7F4 Relevance: 40.8, APIs: 27, Instructions: 269
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000000014000C832
LoadIconW.USER32 ref: 000000014000C83E
GetSystemMetrics.USER32 ref: 000000014000C84B
GetSystemMetrics.USER32 ref: 000000014000C857
GetModuleHandleW.KERNEL32 ref: 000000014000C861
LoadImageW.USER32 ref: 000000014000C87C
SendMessageW.USER32 ref: 000000014000C89C
SendMessageW.USER32 ref: 000000014000C8AE

Part of subcall function 000000014000B590: GetDlgItem.USER32 ref: 000000014000B5AB
Part of subcall function 000000014000B590: GetWindowTextLengthW.USER32 ref: 000000014000B5B4
Part of subcall function 000000014000B590: GetDlgItem.USER32 ref: 000000014000B5C4
Part of subcall function 000000014000B590: SetWindowTextW.USER32 ref: 000000014000B5D3

Part of subcall function 000000014000A8D4: GetDlgItem.USER32 ref: 000000014000A8E7
Part of subcall function 000000014000A8D4: ShowWindow.USER32 ref: 000000014000A8FC

Part of subcall function 000000014000A6C4: GetDlgItem.USER32 ref: 000000014000A6E2
Part of subcall function 000000014000A6C4: SendMessageW.USER32 ref: 000000014000A6FB
Part of subcall function 000000014000A6C4: GetDlgItem.USER32 ref: 000000014000A70A
Part of subcall function 000000014000A6C4: SendMessageW.USER32 ref: 000000014000A71E
Part of subcall function 000000014000A6C4: SendMessageW.USER32 ref: 000000014000A733
Part of subcall function 000000014000A6C4: GetDlgItem.USER32 ref: 000000014000A73F
Part of subcall function 000000014000A6C4: SendMessageW.USER32 ref: 000000014000A753
Part of subcall function 000000014000A6C4: GetDlgItem.USER32 ref: 000000014000A75F

Part of subcall function 0000000140005D88: ??3@YAXPEAX@Z.MSVCRT ref: 0000000140005DE3
Part of subcall function 0000000140005D88: ??3@YAXPEAX@Z.MSVCRT ref: 0000000140005DED
Part of subcall function 0000000140005D88: SetWindowTextW.USER32 ref: 0000000140005DFA
Part of subcall function 0000000140005D88: ??3@YAXPEAX@Z.MSVCRT ref: 0000000140005E07

GetDlgItem.USER32 ref: 000000014000C8CD
GetDlgItem.USER32 ref: 000000014000C8DF
GetWindowLongPtrW.USER32 ref: 000000014000C8F2
SetWindowLongPtrW.USER32 ref: 000000014000C905
GetDlgItem.USER32 ref: 000000014000C916
GetDlgItem.USER32 ref: 000000014000C925
GetWindowLongPtrW.USER32 ref: 000000014000C933
SetWindowLongPtrW.USER32 ref: 000000014000C946
GetDlgItem.USER32 ref: 000000014000C959
SetWindowTextW.USER32 ref: 000000014000C968
GetWindow.USER32 ref: 000000014000CA73
GetWindow.USER32 ref: 000000014000CA8B
GetWindow.USER32 ref: 000000014000CA9F
GetWindow.USER32 ref: 000000014000CAC7
GetWindow.USER32 ref: 000000014000CAEA
GetModuleHandleW.KERNEL32 ref: 000000014000CB51
LoadIconW.USER32 ref: 000000014000CB5D
GetDlgItem.USER32 ref: 000000014000CB78
SendMessageW.USER32 ref: 000000014000CB8C

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Window$Item$MessageSend$LongText$??3@HandleLoadModule$IconMetricsSystem$ImageLengthShow
String ID:
API String ID: 1297775559-0
Opcode ID: 230b22909ceeb94f0608847938a818cc85bee1bbae042fdbb68d371aadd9d1da
Instruction ID: 1908e9196fab05edd893eeec3b7530b3d652cf60547ec149697d6d8dd5479fb9
Opcode Fuzzy Hash: 230b22909ceeb94f0608847938a818cc85bee1bbae042fdbb68d371aadd9d1da
Instruction Fuzzy Hash: 4DB17EB571168086FB56EF23B8157E92391E78DBC8F184029BF0A4BBA6DF3CC8059340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140007834 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 117
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDriveTypeW.KERNELBASE ref: 0000000140007896
CreateFileW.KERNELBASE ref: 00000001400078DC
WriteFile.KERNELBASE ref: 00000001400079DE
??3@YAXPEAX@Z.MSVCRT ref: 00000001400079EB
FindCloseChangeNotification.KERNELBASE ref: 00000001400079F3
SetFileAttributesW.KERNELBASE ref: 0000000140007A0F
ShellExecuteW.SHELL32 ref: 0000000140007A31
??3@YAXPEAX@Z.MSVCRT ref: 0000000140007A48
??3@YAXPEAX@Z.MSVCRT ref: 0000000140007A52
??3@YAXPEAX@Z.MSVCRT ref: 0000000140007A5A

Strings

:, xrefs: 0000000140007882
if exist ", xrefs: 000000014000794E
del ", xrefs: 000000014000791F, 000000014000797D
:Repeat, xrefs: 000000014000790E
\, xrefs: 000000014000788C
" goto Repeat, xrefs: 000000014000796C
open, xrefs: 0000000140007A25
", xrefs: 000000014000793D, 000000014000799D
7ZSfx%03x.cmd, xrefs: 00000001400078A5

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@$File$AttributesChangeCloseCreateDriveExecuteFindNotificationShellTypeWrite
String ID: "$" goto Repeat$7ZSfx%03x.cmd$:$:Repeat$\$del "$if exist "$open
API String ID: 468898492-2163742583
Opcode ID: 5111a49f367fcdcbf87e6656306f522d5f19602045a4121188601974b1e97d08
Instruction ID: c2acf72f743c7c88f75e501aed890f389f98254632e1fdf2c35ab60dd80480a0
Opcode Fuzzy Hash: 5111a49f367fcdcbf87e6656306f522d5f19602045a4121188601974b1e97d08
Instruction Fuzzy Hash: BB518972214A8092EB12DB22F4807EAA370F7C97C4F908115F78D479A9DFB9CA09CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000AA68 Relevance: 30.3, APIs: 20, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32 ref: 000000014000AAA5
GetWindowLongPtrW.USER32 ref: 000000014000AAB3
SetWindowPos.USER32 ref: 000000014000AC94
GetDlgItem.USER32 ref: 000000014000ACD1
GetClientRect.USER32 ref: 000000014000AD75
GetDlgItem.USER32 ref: 000000014000ADC1
GetDlgItem.USER32 ref: 000000014000AAC7

Part of subcall function 00000001400025E0: GetParent.USER32 ref: 00000001400025F5
Part of subcall function 00000001400025E0: GetWindowRect.USER32 ref: 0000000140002609
Part of subcall function 00000001400025E0: ScreenToClient.USER32 ref: 0000000140002615
Part of subcall function 00000001400025E0: ScreenToClient.USER32 ref: 0000000140002622

GetDlgItem.USER32 ref: 000000014000AB0D
GetWindowLongPtrW.USER32 ref: 000000014000AB18
GetDlgItem.USER32 ref: 000000014000AB2C
GetSystemMetrics.USER32 ref: 000000014000ABA7
GetSystemMetrics.USER32 ref: 000000014000ABB4
GetSystemMetrics.USER32 ref: 000000014000ABC1
GetSystemMetrics.USER32 ref: 000000014000ABCF
GetParent.USER32 ref: 000000014000ABF5
GetClientRect.USER32 ref: 000000014000AC0B
ClientToScreen.USER32 ref: 000000014000AC19
ClientToScreen.USER32 ref: 000000014000AC27
GetSystemMetrics.USER32 ref: 000000014000AE2F
GetSystemMetrics.USER32 ref: 000000014000AE3D

Part of subcall function 000000014000AA08: GetDlgItem.USER32 ref: 000000014000AA2B
Part of subcall function 000000014000AA08: SetWindowPos.USER32 ref: 000000014000AA50

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Item$ClientMetricsSystem$Window$Screen$Rect$LongParent
String ID:
API String ID: 3236151763-0
Opcode ID: 025e47d761893ee3653c3497d4f0533d9b1854fe2d563d47e8164a9c013cf852
Instruction ID: 369a408b8412ce97b511fc1b5ae79844d77352fe4683048695a2f3e38f7c1b89
Opcode Fuzzy Hash: 025e47d761893ee3653c3497d4f0533d9b1854fe2d563d47e8164a9c013cf852
Instruction Fuzzy Hash: D8C19AB66146418BD725DF2AF44479EBBA1F38D784F104129EF8A83B68DB7DE845CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001EAC Relevance: 18.3, APIs: 12, Instructions: 306
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??3@YAXPEAX@Z.MSVCRT ref: 0000000140001FD4

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: e98ab00b73688e068dea67750d4801ea79e1c4a600f14e831cb8fa7c40ff978b
Instruction ID: e9a6f6f0e99161eb75aa7f14f9fa2e7700f4eecc7ee99dc7bf13f8221d623660
Opcode Fuzzy Hash: e98ab00b73688e068dea67750d4801ea79e1c4a600f14e831cb8fa7c40ff978b
Instruction Fuzzy Hash: 93D14A76214A8482DB61DF66E0803EEB7A1F788BD0F504112FB8A57BB5DF39C956C701

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002328C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 130
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoW.KERNEL32 ref: 00000001400232A9
Sleep.KERNEL32 ref: 00000001400232DD
_amsg_exit.MSVCRT ref: 00000001400232F3
_initterm.MSVCRT ref: 0000000140023378
exit.KERNELBASE ref: 000000014002342B
_cexit.MSVCRT ref: 000000014002343A
_ismbblead.MSVCRT ref: 000000014002345D

Strings

MZ`, xrefs: 000000014002340E

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: InfoSleepStartup_amsg_exit_cexit_initterm_ismbbleadexit
String ID: MZ`
API String ID: 4226152999-2330268423
Opcode ID: ed595b863fa2b2b2b1a30745f0382519c85c7d08017929ca237b7209b8ed5393
Instruction ID: d6a55b3e83bdc9c209881f0a881d1bc4d9882899e88dd1fca6d04e187958d7bd
Opcode Fuzzy Hash: ed595b863fa2b2b2b1a30745f0382519c85c7d08017929ca237b7209b8ed5393
Instruction Fuzzy Hash: 3D51343261568086F763DB22E9543EA77A4F74CBD0F440019FB4A936B0DB78CE84CB02

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000252C Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 42
timewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 0000000140002537
CreateWindowExW.USER32 ref: 0000000140002581
SetTimer.USER32 ref: 000000014000259C
GetMessageW.USER32 ref: 00000001400025AF
DispatchMessageW.USER32 ref: 00000001400025BA
KillTimer.USER32 ref: 00000001400025C8
DestroyWindow.USER32 ref: 00000001400025D1

Strings

Static, xrefs: 0000000140002560

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MessageTimerWindow$CreateDestroyDispatchHandleKillModule
String ID: Static
API String ID: 1156981321-2272013587
Opcode ID: 8b5d70c0ab82d035e66b0e25e51935182117c4989160dc9bb5dd70cc523b7953
Instruction ID: d0d38201065a0f6c45c2d774da11ab6e4765d6954ce13fe1e266fe3997452c5a
Opcode Fuzzy Hash: 8b5d70c0ab82d035e66b0e25e51935182117c4989160dc9bb5dd70cc523b7953
Instruction Fuzzy Hash: 53115E32614B8587E765CF76F85579A77A0FB8C785F400229BB8A87A65EF3CC448CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000BFE4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 98
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400011B4: ??2@YAPEAX_K@Z.MSVCRT ref: 00000001400011E7
Part of subcall function 00000001400011B4: ??3@YAXPEAX@Z.MSVCRT ref: 000000014000121C

GetDlgItem.USER32 ref: 000000014000C04A
SendMessageW.USER32 ref: 000000014000C05E
wsprintfW.USER32 ref: 000000014000C08C
GetDlgItem.USER32 ref: 000000014000C0A8
SetWindowTextW.USER32 ref: 000000014000C0B9
??3@YAXPEAX@Z.MSVCRT ref: 000000014000C168

Strings

%d%%, xrefs: 000000014000C085

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@Item$??2@MessageSendTextWindowwsprintf
String ID: %d%%
API String ID: 2523864657-1518462796
Opcode ID: 7a1e47a64a861bb18f74371ded62823702c003e5eb072c254bd3990f658e8273
Instruction ID: ee99228d9c6b07caf3aa755007f199285e8574d04f769176d592a10f0abc269a
Opcode Fuzzy Hash: 7a1e47a64a861bb18f74371ded62823702c003e5eb072c254bd3990f658e8273
Instruction Fuzzy Hash: 0A4147B6625A8082EB56DB17E8843D96361F78CBC4F849026FF4A477A6DF3CD915C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000A910 Relevance: 12.1, APIs: 8, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32 ref: 000000014000A93E
GetSystemMetrics.USER32 ref: 000000014000A953
GetSystemMetrics.USER32 ref: 000000014000A963
GetSystemMetrics.USER32 ref: 000000014000A96F
SelectObject.GDI32 ref: 000000014000A98A
DrawTextW.USER32 ref: 000000014000A9AF
SelectObject.GDI32 ref: 000000014000A9D3
ReleaseDC.USER32 ref: 000000014000A9E1

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MetricsSystem$ObjectSelect$DrawReleaseText
String ID:
API String ID: 2466489532-0
Opcode ID: 212ebf79ee84d7d1206f2bd4f633f06da61df4060c7ba716baeaa0a612a14154
Instruction ID: 6fdc208c196e79815fa99ac3444dcdc670a98afdbec5e2efd68a2c8f262fee81
Opcode Fuzzy Hash: 212ebf79ee84d7d1206f2bd4f633f06da61df4060c7ba716baeaa0a612a14154
Instruction Fuzzy Hash: B9213B76600A949BD705DF63E94479AB7A0F348BD8F508518EF5643B64CF3CE4A6CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000AF8C Relevance: 12.1, APIs: 8, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 000000014000AFBB
SystemParametersInfoW.USER32 ref: 000000014000AFDB
GetDC.USER32 ref: 000000014000AFE7
GetDeviceCaps.GDI32 ref: 000000014000AFF8
MulDiv.KERNEL32 ref: 000000014000B00D
ReleaseDC.USER32 ref: 000000014000B01C
GetModuleHandleW.KERNEL32 ref: 000000014000B041
DialogBoxIndirectParamW.USER32 ref: 000000014000B083

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: CapsDeviceDialogHandleIndirectInfoModuleParamParametersReleaseSystemmemcpy
String ID:
API String ID: 2693764856-0
Opcode ID: 75830c3599faa66da3a2a5566216bdd716f4cc8a0b673d9ba80179367551409f
Instruction ID: b5a02b2fd7d579394d0b4a516212713012cfd4d14319e6251bb4a295acc5d9a5
Opcode Fuzzy Hash: 75830c3599faa66da3a2a5566216bdd716f4cc8a0b673d9ba80179367551409f
Instruction Fuzzy Hash: 7C317E7620478086E7669F22F8147DA73A4F78CBC4F444029EB8A43B64DF7CC945CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400211D0 Relevance: 10.7, APIs: 7, Instructions: 213
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_CxxThrowException.MSVCRT ref: 0000000140021286
_CxxThrowException.MSVCRT ref: 00000001400212C4
_CxxThrowException.MSVCRT ref: 000000014002139E
_CxxThrowException.MSVCRT ref: 0000000140021415
??3@YAXPEAX@Z.MSVCRT ref: 0000000140021549

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionThrow$??3@
String ID:
API String ID: 3542664073-0
Opcode ID: 09cb88822c40286a4243dbc931dd126553488028dac59cb05aaf1b2b78d99b7f
Instruction ID: af14aa8b64514ce2e07e2698f8e589b1a5022d734576afd1b2c0c6a739d0f158
Opcode Fuzzy Hash: 09cb88822c40286a4243dbc931dd126553488028dac59cb05aaf1b2b78d99b7f
Instruction Fuzzy Hash: EEA19C32208BC592EA62DB56E5443DEB764FB987C0F40051AFB8D47BAADF38C959C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001E9BC Relevance: 9.1, APIs: 6, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPEAX_K@Z.MSVCRT ref: 000000014001EA51
??3@YAXPEAX@Z.MSVCRT ref: 000000014001EA5B
memcpy.MSVCRT ref: 000000014001EA6D
memcpy.MSVCRT ref: 000000014001EB3E
memcpy.MSVCRT ref: 000000014001EB63
??3@YAXPEAX@Z.MSVCRT ref: 000000014001EB89

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: memcpy$??3@$??2@
String ID:
API String ID: 3516945703-0
Opcode ID: 0fed28a95f6e67d2c8ed636bd7e374487fedc9119edf4c3f38359bae781cb006
Instruction ID: cab2f284b1ac7b0065801a45e3e5ffcbb27f7237741dfbe3d19e62b1e34d98d2
Opcode Fuzzy Hash: 0fed28a95f6e67d2c8ed636bd7e374487fedc9119edf4c3f38359bae781cb006
Instruction Fuzzy Hash: 2C51DE3230468096EB26CF27E080BDE2795FB89BC4F894026EF0D4B7A5DF3AD9058701

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400055A0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140002F84: ??2@YAPEAX_K@Z.MSVCRT ref: 0000000140002FA1
Part of subcall function 0000000140002F84: ??3@YAXPEAX@Z.MSVCRT ref: 0000000140002FD3

Part of subcall function 0000000140005364: ??3@YAXPEAX@Z.MSVCRT ref: 000000014000548A

Part of subcall function 00000001400038C4: lstrlenA.KERNEL32 ref: 0000000140003916
Part of subcall function 00000001400038C4: lstrlenA.KERNEL32 ref: 0000000140003922
Part of subcall function 00000001400038C4: memcmp.MSVCRT ref: 000000014000399A
Part of subcall function 00000001400038C4: memcmp.MSVCRT ref: 00000001400039D7
Part of subcall function 00000001400038C4: memcpy.MSVCRT ref: 0000000140003A01

??3@YAXPEAX@Z.MSVCRT ref: 00000001400057C7
??3@YAXPEAX@Z.MSVCRT ref: 00000001400057D1
??3@YAXPEAX@Z.MSVCRT ref: 00000001400057DB

Strings

amd64, xrefs: 00000001400055C3
x64, xrefs: 00000001400055D1

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@$lstrlenmemcmp$??2@memcpy
String ID: amd64$x64
API String ID: 2116704905-3265184354
Opcode ID: ec4c4eec92d58ce735ce6cc372901221ff938103c1975b9c3afbcbf5ded7a40b
Instruction ID: 858c2603046fe0cde43b8e0567e61fbb2fe352125c52bba6d22330217fc3f120
Opcode Fuzzy Hash: ec4c4eec92d58ce735ce6cc372901221ff938103c1975b9c3afbcbf5ded7a40b
Instruction Fuzzy Hash: 79614976614B8596DB11EF22B4407DEB3A5F7897C8F849026FB8907769CE39C949CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140005E24 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

#17.COMCTL32 ref: 0000000140005E36

Part of subcall function 0000000140002B44: GetUserDefaultUILanguage.KERNEL32(?,?,?,?,0000000140002CE8), ref: 0000000140002B54

Part of subcall function 0000000140002BB4: GetLastError.KERNEL32 ref: 0000000140002C1B
Part of subcall function 0000000140002BB4: wsprintfW.USER32 ref: 0000000140002C32
Part of subcall function 0000000140002BB4: GetEnvironmentVariableW.KERNEL32 ref: 0000000140002C42
Part of subcall function 0000000140002BB4: GetLastError.KERNEL32 ref: 0000000140002C4A
Part of subcall function 0000000140002BB4: ??2@YAPEAX_K@Z.MSVCRT ref: 0000000140002C69
Part of subcall function 0000000140002BB4: GetEnvironmentVariableW.KERNEL32 ref: 0000000140002C7D
Part of subcall function 0000000140002BB4: GetLastError.KERNEL32 ref: 0000000140002C87
Part of subcall function 0000000140002BB4: lstrcmpiW.KERNEL32 ref: 0000000140002C9E
Part of subcall function 0000000140002BB4: ??3@YAXPEAX@Z.MSVCRT ref: 0000000140002CAD
Part of subcall function 0000000140002BB4: SetLastError.KERNEL32 ref: 0000000140002CC3
Part of subcall function 0000000140002BB4: lstrlenA.KERNEL32 ref: 0000000140002CF8
Part of subcall function 0000000140002BB4: ??2@YAPEAX_K@Z.MSVCRT ref: 0000000140002D15
Part of subcall function 0000000140002BB4: GetLocaleInfoW.KERNEL32 ref: 0000000140002D4B
Part of subcall function 0000000140002BB4: _wtol.MSVCRT ref: 0000000140002D5D
Part of subcall function 0000000140002BB4: MultiByteToWideChar.KERNEL32 ref: 0000000140002D8D

SHGetSpecialFolderPathW.SHELL32 ref: 0000000140005EDF
wsprintfW.USER32 ref: 0000000140005EF8

Part of subcall function 00000001400044D4: ??2@YAPEAX_K@Z.MSVCRT ref: 0000000140004545
Part of subcall function 00000001400044D4: ??3@YAXPEAX@Z.MSVCRT ref: 00000001400045BF
Part of subcall function 00000001400044D4: ??3@YAXPEAX@Z.MSVCRT ref: 00000001400045C9

Strings

SfxFolder%02d, xrefs: 0000000140005EE9

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$??2@??3@$EnvironmentVariablewsprintf$ByteCharDefaultFolderInfoLanguageLocaleMultiPathSpecialUserWide_wtollstrcmpilstrlen
String ID: SfxFolder%02d
API String ID: 3019347271-528147737
Opcode ID: 5e04a7a79fe4429cfa42dadccbaaf6a8f015b2ae2ced68cab7a373acd5794ecd
Instruction ID: 7ef698dd5e6699704ad77cf79c85a1a8b12948f7c29a833cdc5a375579afbdaf
Opcode Fuzzy Hash: 5e04a7a79fe4429cfa42dadccbaaf6a8f015b2ae2ced68cab7a373acd5794ecd
Instruction Fuzzy Hash: 0B3129B2600B8582FB26EB52F8957D92360F7897C4F404029F7890B7B6EF79C954C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400038C4 Relevance: 6.4, APIs: 5, Instructions: 116stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 0000000140003916
lstrlenA.KERNEL32 ref: 0000000140003922
memcmp.MSVCRT ref: 000000014000399A
memcmp.MSVCRT ref: 00000001400039D7
memcpy.MSVCRT ref: 0000000140003A01

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: lstrlenmemcmp$memcpy
String ID:
API String ID: 4028117624-0
Opcode ID: e61e7cd68d7093f4e5a67f569cf27875338d7cf8ea487269455bbe03944e1053
Instruction ID: 6a2b3e63620bd6df988fbf07d4f22db1189dba812221ae4ed225a5cfa453c9d2
Opcode Fuzzy Hash: e61e7cd68d7093f4e5a67f569cf27875338d7cf8ea487269455bbe03944e1053
Instruction Fuzzy Hash: 8C41B2B371858082D722DF5BB8807DEB655B399BC4F544026FFC983B69EA78C9898700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001B04 Relevance: 6.1, APIs: 4, Instructions: 104synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 0000000140001B81
WaitForSingleObject.KERNEL32 ref: 0000000140001BA9

Part of subcall function 000000014000D328: wvsprintfW.USER32 ref: 000000014000D35D
Part of subcall function 000000014000D328: GetLastError.KERNEL32 ref: 000000014000D36B
Part of subcall function 000000014000D328: FormatMessageW.KERNEL32 ref: 000000014000D3A0
Part of subcall function 000000014000D328: FormatMessageW.KERNEL32 ref: 000000014000D3CD
Part of subcall function 000000014000D328: lstrlenW.KERNEL32 ref: 000000014000D3DC
Part of subcall function 000000014000D328: lstrlenW.KERNEL32 ref: 000000014000D3EA
Part of subcall function 000000014000D328: ??2@YAPEAX_K@Z.MSVCRT ref: 000000014000D40D
Part of subcall function 000000014000D328: lstrcpyW.KERNEL32 ref: 000000014000D41D
Part of subcall function 000000014000D328: lstrcpyW.KERNEL32 ref: 000000014000D433
Part of subcall function 000000014000D328: ??3@YAXPEAX@Z.MSVCRT ref: 000000014000D444
Part of subcall function 000000014000D328: LocalFree.KERNEL32 ref: 000000014000D44E

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: FormatMessagelstrcpylstrlen$??2@??3@CreateErrorFreeLastLocalObjectSingleThreadWaitwvsprintf
String ID:
API String ID: 359084233-0
Opcode ID: b6197c98bc005501fa2e1716cbaabd79c9b7341934d991dbd4dc0e7a568260a6
Instruction ID: 27d848ed42aebee92a4011adddb7b2aaace4ff63501981991b1408dc0c656728
Opcode Fuzzy Hash: b6197c98bc005501fa2e1716cbaabd79c9b7341934d991dbd4dc0e7a568260a6
Instruction Fuzzy Hash: 47417CB1254A0482FB2ACF57F8447E972A1FB8C7C4F648129FB4647AF4EB79C9418B01

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140006474 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400011B4: ??2@YAPEAX_K@Z.MSVCRT ref: 00000001400011E7
Part of subcall function 00000001400011B4: ??3@YAXPEAX@Z.MSVCRT ref: 000000014000121C

GetTempPathW.KERNEL32 ref: 00000001400064C4
GetTempPathW.KERNEL32 ref: 00000001400064F0
wsprintfW.USER32 ref: 0000000140006547
GetFileAttributesW.KERNELBASE ref: 000000014000657B

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: PathTemp$??2@??3@AttributesFilewsprintf
String ID:
API String ID: 51045435-0
Opcode ID: 372883a48bc59b80761ec0e1d9cde3a8fbb5548a572dbf835d8af5daa7977482
Instruction ID: 2747d159bf7277949935cb4fba0d2b6d855d351c5a4bb5df8e8923f6663874f5
Opcode Fuzzy Hash: 372883a48bc59b80761ec0e1d9cde3a8fbb5548a572dbf835d8af5daa7977482
Instruction Fuzzy Hash: 8E318DB3610A4086EB12DF26E89139D73A2F798FD5F05D015EB0A5B3A9DB39D882C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000B39C Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 000000014000AA68: GetDlgItem.USER32 ref: 000000014000AAA5
Part of subcall function 000000014000AA68: GetWindowLongPtrW.USER32 ref: 000000014000AAB3
Part of subcall function 000000014000AA68: GetDlgItem.USER32 ref: 000000014000AAC7
Part of subcall function 000000014000AA68: GetDlgItem.USER32 ref: 000000014000AB0D
Part of subcall function 000000014000AA68: GetWindowLongPtrW.USER32 ref: 000000014000AB18
Part of subcall function 000000014000AA68: GetDlgItem.USER32 ref: 000000014000AB2C
Part of subcall function 000000014000AA68: GetSystemMetrics.USER32 ref: 000000014000ABA7
Part of subcall function 000000014000AA68: GetSystemMetrics.USER32 ref: 000000014000ABB4
Part of subcall function 000000014000AA68: GetSystemMetrics.USER32 ref: 000000014000ABC1
Part of subcall function 000000014000AA68: GetSystemMetrics.USER32 ref: 000000014000ABCF

GetClientRect.USER32 ref: 000000014000B3C5
GetDlgItem.USER32 ref: 000000014000B3D6
GetClientRect.USER32 ref: 000000014000B3F9
GetDlgItem.USER32 ref: 000000014000B446

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Item$MetricsSystem$ClientLongRectWindow
String ID:
API String ID: 2818034528-0
Opcode ID: 643f2e51a7e994640d157db5d00295b4a2b3d1e7ddbb431dc2ebd41bfbea7cda
Instruction ID: 9ed6c8e37730cbddc61f1c54344563a69f3f242d93f6c81de5cfff2f4b9b3693
Opcode Fuzzy Hash: 643f2e51a7e994640d157db5d00295b4a2b3d1e7ddbb431dc2ebd41bfbea7cda
Instruction Fuzzy Hash: 4B21667260464087EB11EB26F44078ABBA1F7CABD8F244215FB9857BA9CB3DD941CB44

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000A780 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32 ref: 000000014000A7BA
GetSystemMetrics.USER32 ref: 000000014000A7DE
CreateFontIndirectW.GDI32 ref: 000000014000A7EB
DeleteObject.GDI32 ref: 000000014000A827

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: System$CreateDeleteFontIndirectInfoMetricsObjectParameters
String ID:
API String ID: 1900162674-0
Opcode ID: b6ca30374ed028c7f038b40dc9744ed113779794d33a9d0887d5051d2b3d9e53
Instruction ID: 5ef3e011ceba434435382d4f3344423d473e7240348f60068a6af8f641b29f0a
Opcode Fuzzy Hash: b6ca30374ed028c7f038b40dc9744ed113779794d33a9d0887d5051d2b3d9e53
Instruction Fuzzy Hash: CC21277660468097D351CF12F888B9AB7A1F788BC4F558125FF5A43B68DB38D946CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140005D88 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 000000014000412C: GetWindowTextLengthW.USER32 ref: 000000014000415F
Part of subcall function 000000014000412C: GetWindowTextW.USER32 ref: 0000000140004187

??3@YAXPEAX@Z.MSVCRT ref: 0000000140005DE3
??3@YAXPEAX@Z.MSVCRT ref: 0000000140005DED
SetWindowTextW.USER32 ref: 0000000140005DFA
??3@YAXPEAX@Z.MSVCRT ref: 0000000140005E07

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@TextWindow$Length
String ID:
API String ID: 2308334395-0
Opcode ID: 105e684ef15643b8deb3fd5b083e3443adf536ba9838d5972069230a3aba27dc
Instruction ID: c6042e238f6d5bcaae7a22b62415e518ecf74784a4012f6ef476573d8baa93b1
Opcode Fuzzy Hash: 105e684ef15643b8deb3fd5b083e3443adf536ba9838d5972069230a3aba27dc
Instruction Fuzzy Hash: EC01DAB222458592DE12EB12F8913DA6320FBDD784F805122FB8D475BADE7CCA19CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000B590 Relevance: 6.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 000000014000B5AB
GetWindowTextLengthW.USER32 ref: 000000014000B5B4
GetDlgItem.USER32 ref: 000000014000B5C4
SetWindowTextW.USER32 ref: 000000014000B5D3

Part of subcall function 0000000140005D88: ??3@YAXPEAX@Z.MSVCRT ref: 0000000140005DE3
Part of subcall function 0000000140005D88: ??3@YAXPEAX@Z.MSVCRT ref: 0000000140005DED
Part of subcall function 0000000140005D88: SetWindowTextW.USER32 ref: 0000000140005DFA
Part of subcall function 0000000140005D88: ??3@YAXPEAX@Z.MSVCRT ref: 0000000140005E07

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@TextWindow$Item$Length
String ID:
API String ID: 4031798017-0
Opcode ID: f946bd3d82d6762de180bf62ed1a17fb003f2ae37c7c078ffe808206a346cabd
Instruction ID: f2e7a972c93cfe19f5f90a5de08a3d268fbff9f9fd9ff7ba848afb97885aaba9
Opcode Fuzzy Hash: f946bd3d82d6762de180bf62ed1a17fb003f2ae37c7c078ffe808206a346cabd
Instruction Fuzzy Hash: BEF05E35700B9082EB15EB23F8443696360FB8CFC0F548429AF5E47B25DE38C8518700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140002348 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE ref: 0000000140002353
GetLastError.KERNEL32 ref: 000000014000235D
SetLastError.KERNEL32 ref: 000000014000236C
GetFileAttributesW.KERNELBASE ref: 0000000140002379

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$AttributesCreateDirectoryFile
String ID:
API String ID: 635176117-0
Opcode ID: 2e72eff63048d5be1a137730bfc303a42d9ebbc38b115248ad16f29b83008764
Instruction ID: 941f0f6c93d4fe9cb2f68f3b71bb04260c7cb6d7fca5935110114c9f6ad7ed66
Opcode Fuzzy Hash: 2e72eff63048d5be1a137730bfc303a42d9ebbc38b115248ad16f29b83008764
Instruction Fuzzy Hash: CFF06DB060460282FB6AD77778093FC2295AB9DBD1F990824F7268B1F0EF3C8E854600

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001CF0 Relevance: 4.6, APIs: 3, Instructions: 120COMMON

Download Yara Rule

APIs

??2@YAPEAX_K@Z.MSVCRT ref: 0000000140001D0A
??2@YAPEAX_K@Z.MSVCRT ref: 0000000140001D68
??2@YAPEAX_K@Z.MSVCRT ref: 0000000140001E03

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 0931507443d6beb5a26d35151831a05a806604f2c30b384a50b542bfb01cee52
Instruction ID: 18368b84559fe52b797553ab10825a645127ce042fc940a1ff3d3d74138d48a9
Opcode Fuzzy Hash: 0931507443d6beb5a26d35151831a05a806604f2c30b384a50b542bfb01cee52
Instruction Fuzzy Hash: AA5103B6215A8582EB5ADF27E5503ED63A1BBCDBC4F44802AEF0A477B4DF38C9058700

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400044D4 Relevance: 4.6, APIs: 3, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400011B4: ??2@YAPEAX_K@Z.MSVCRT ref: 00000001400011E7
Part of subcall function 00000001400011B4: ??3@YAXPEAX@Z.MSVCRT ref: 000000014000121C

??2@YAPEAX_K@Z.MSVCRT ref: 0000000140004545
??3@YAXPEAX@Z.MSVCRT ref: 00000001400045BF
??3@YAXPEAX@Z.MSVCRT ref: 00000001400045C9

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@$??2@
String ID:
API String ID: 4113381792-0
Opcode ID: c8c9bb79b1bf3efdb9ae2a2846766a3f6b1418794eeac664f8b7a7e974b0e512
Instruction ID: 6673555f7bade080fbe1112363bc78707da94d2d1b9e163b3019869a8437c1e7
Opcode Fuzzy Hash: c8c9bb79b1bf3efdb9ae2a2846766a3f6b1418794eeac664f8b7a7e974b0e512
Instruction Fuzzy Hash: 05313E72614A4086EB52EF22E4953DE73A1F78DBC0F944125FB4D87BAADE38C905CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140007A74 Relevance: 4.6, APIs: 3, Instructions: 63COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 0000000140007AC2
??3@YAXPEAX@Z.MSVCRT ref: 0000000140007ACB
??3@YAXPEAX@Z.MSVCRT ref: 0000000140007AD3

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 8f5bf36786b7a45fdfe7a3f9f5718dc96fedc90bc733df27a9c6dc8f0856823f
Instruction ID: fbb809cce0bcb385a085d9411b91318afdc9c14bdc8ceb4f7dfb5f4d013c2e71
Opcode Fuzzy Hash: 8f5bf36786b7a45fdfe7a3f9f5718dc96fedc90bc733df27a9c6dc8f0856823f
Instruction Fuzzy Hash: AE219D3271068486E361CF1BE581B9EB364F788BD4F688425FF4847B66CB38D9528B00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000B4B4 Relevance: 4.6, APIs: 3, Instructions: 59COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 000000014000B4E3
GetSystemMetrics.USER32 ref: 000000014000B4EF
GetDlgItem.USER32 ref: 000000014000B54F

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MetricsSystem$Item
String ID:
API String ID: 56695849-0
Opcode ID: eb22a1c543e4b1617927f3f26526e1edbe9f69337d71829e8a18da452aa58342
Instruction ID: a07e11810b967e23bad0553dbc1f8a25a03c1330a99bb6e080e7b544c44f4e48
Opcode Fuzzy Hash: eb22a1c543e4b1617927f3f26526e1edbe9f69337d71829e8a18da452aa58342
Instruction Fuzzy Hash: 97213773604A55CBDB50CF26E44039EB7B0F388F99F058116EB8953628EB78E946CF80

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000A510 Relevance: 4.5, APIs: 3, Instructions: 45windowCOMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 000000014000A539
SetWindowLongPtrW.USER32 ref: 000000014000A55B
SendMessageW.USER32 ref: 000000014000A572

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 5e77a48b9390bfecb989d20b45378624cd302e26884958faafc982fa5068f24c
Instruction ID: b5a29ed504c0212ceecf4c7354b3e301356e5d32d3d612a452483e6c59b4c276
Opcode Fuzzy Hash: 5e77a48b9390bfecb989d20b45378624cd302e26884958faafc982fa5068f24c
Instruction Fuzzy Hash: 47013532610F908AE7548F13A880B9977A1F78EFC0F585128EF4A13B64CF38D852C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000A858 Relevance: 4.5, APIs: 3, Instructions: 33COMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 000000014000A865
GetWindowRect.USER32 ref: 000000014000A879
SetWindowPos.USER32 ref: 000000014000A8C5

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Window$ParentRect
String ID:
API String ID: 4286822721-0
Opcode ID: 7aed9bf43e54fcdfd56c3e04cddae3b643a27c953486d2c787dc8b4dde8ded6c
Instruction ID: 5af7d319ebe9c9f9547611065177959ae22408f7e8b6a6c786e068d2d0f5a45d
Opcode Fuzzy Hash: 7aed9bf43e54fcdfd56c3e04cddae3b643a27c953486d2c787dc8b4dde8ded6c
Instruction Fuzzy Hash: A5016272224940CBE710CF3AE84875A77B1F788B89F194114EB8887668CF3DD845CF00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140003074 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 000000014000309C

Strings

@, xrefs: 000000014000308D

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: @
API String ID: 1890195054-2766056989
Opcode ID: 0c8148a405d0491f8f8bee87c6b59593e1dddf4b1f1ef8662aeb9e36fd4e39f7
Instruction ID: e0e8d83febbd95f6b33e07ff757352145e733e90624ddd0b8ca01a25266c3cf7
Opcode Fuzzy Hash: 0c8148a405d0491f8f8bee87c6b59593e1dddf4b1f1ef8662aeb9e36fd4e39f7
Instruction Fuzzy Hash: 8CF030B071714441FF67E763BA253E526A4A75D394F050518FB96472F1DBB889448600

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001D9C8 Relevance: 3.2, APIs: 2, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400011B4: ??2@YAPEAX_K@Z.MSVCRT ref: 00000001400011E7
Part of subcall function 00000001400011B4: ??3@YAXPEAX@Z.MSVCRT ref: 000000014000121C

??3@YAXPEAX@Z.MSVCRT ref: 000000014001DB29

Part of subcall function 0000000140018794: ??3@YAXPEAX@Z.MSVCRT ref: 0000000140018779

??3@YAXPEAX@Z.MSVCRT ref: 000000014001DBC0

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@$??2@
String ID:
API String ID: 4113381792-0
Opcode ID: 6114a1cf0c9b5fba6b60770e997c6d232c75977d0cfad6c836d8b218ace9d880
Instruction ID: 8afd40be470a3a8d9c230a38eb8dfb67bb16c70cef032110e56ae5b520b1479e
Opcode Fuzzy Hash: 6114a1cf0c9b5fba6b60770e997c6d232c75977d0cfad6c836d8b218ace9d880
Instruction Fuzzy Hash: 82713932204B4482EB25DB26E49039DB7B0FB88FD4F554526EB9A4BBA5CF39C959C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001700 Relevance: 3.1, APIs: 2, Instructions: 101COMMON

Download Yara Rule

APIs

??2@YAPEAX_K@Z.MSVCRT ref: 0000000140001725
??2@YAPEAX_K@Z.MSVCRT ref: 0000000140001762

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: daf85b05a7e210f2b91abca817817a0327310914d90ac4ce6430109b1cafb949
Instruction ID: 8938c7a33d25e79972656856ed1f4af85985c5348028cf9830efdc7ff641a4ed
Opcode Fuzzy Hash: daf85b05a7e210f2b91abca817817a0327310914d90ac4ce6430109b1cafb949
Instruction Fuzzy Hash: 75413776605B4082EB62DF62E5843E963A1F78DBC4F448129EB5D07BA0EF38CA55C701

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000C180 Relevance: 3.1, APIs: 2, Instructions: 59windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 000000014000C225
SendMessageW.USER32 ref: 000000014000C23E

Part of subcall function 000000014000BFE4: GetDlgItem.USER32 ref: 000000014000C04A
Part of subcall function 000000014000BFE4: SendMessageW.USER32 ref: 000000014000C05E
Part of subcall function 000000014000BFE4: wsprintfW.USER32 ref: 000000014000C08C
Part of subcall function 000000014000BFE4: GetDlgItem.USER32 ref: 000000014000C0A8
Part of subcall function 000000014000BFE4: SetWindowTextW.USER32 ref: 000000014000C0B9
Part of subcall function 000000014000BFE4: ??3@YAXPEAX@Z.MSVCRT ref: 000000014000C168

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ItemMessageSend$??3@DialogTextWindowwsprintf
String ID:
API String ID: 3294831176-0
Opcode ID: ccd341f24d52d5ade3a8783749d759afcb342290cd9dc4ac46513fcabb57290f
Instruction ID: 7eb77c6dd9b52cb1aae203efd7a0c60e12f0f36231aa2cdf2a8cf8ffca969e72
Opcode Fuzzy Hash: ccd341f24d52d5ade3a8783749d759afcb342290cd9dc4ac46513fcabb57290f
Instruction Fuzzy Hash: 44216876211A9482EB54CFABE444B987360F78CFC4F288026EF4D87B69CE35C846C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000B8A4 Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 000000014000B91E
??3@YAXPEAX@Z.MSVCRT ref: 000000014000B928

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 76852fe4f132218d68ab71e6ced5b507dbe40b00dba26bbe5d7873b6fb8ee687
Instruction ID: b1aff4010e78743c431d5e59611608f6ca8b1ad0cc141627bd8f1a978c66b8e5
Opcode Fuzzy Hash: 76852fe4f132218d68ab71e6ced5b507dbe40b00dba26bbe5d7873b6fb8ee687
Instruction Fuzzy Hash: D2113972215B8482DA51EB12F55039EA3A0FB9DBC0F444121FF8E43BAADF38C6218B40

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000A5AC Relevance: 3.0, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

UnhookWindowsHookEx.USER32 ref: 000000014000A5F6
UnhookWindowsHookEx.USER32 ref: 000000014000A610

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: HookUnhookWindows
String ID:
API String ID: 2953937349-0
Opcode ID: 3c3546fcae038cb0794d7b9ae0fe09a7c69f98e11c6f5d805a898245fe1a76be
Instruction ID: 9800168be731374f00ca817fda60fbe59995035cea47002d94ac4e94fb180046
Opcode Fuzzy Hash: 3c3546fcae038cb0794d7b9ae0fe09a7c69f98e11c6f5d805a898245fe1a76be
Instruction Fuzzy Hash: 0001C0B260190485EF67DB67E8583A827B1BB4DFC5F194115E709076B4DE7E88988300

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400011B4 Relevance: 3.0, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

??2@YAPEAX_K@Z.MSVCRT ref: 00000001400011E7
??3@YAXPEAX@Z.MSVCRT ref: 000000014000121C

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??2@??3@
String ID:
API String ID: 1936579350-0
Opcode ID: 3de9ed5e5e67ce5b26cba949b84d8c335606611e244a320a7dd47becb13e48e7
Instruction ID: 7f1f6a3972fdf26489c0ac8fef3e41d4abe5a3f8c6c0a306314698f9579e5899
Opcode Fuzzy Hash: 3de9ed5e5e67ce5b26cba949b84d8c335606611e244a320a7dd47becb13e48e7
Instruction Fuzzy Hash: AF01447261065082E750CF26E15175DB3A1E788FE9F04C215FB65477E9CA39D4A1CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001380 Relevance: 3.0, APIs: 2, Instructions: 32COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 000000014000139F
EndDialog.USER32 ref: 00000001400013E4

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: DialogSleep
String ID:
API String ID: 2355613043-0
Opcode ID: 1cb553221fa8f9c5a90764fb7f989e42ab51d79b0e3b2f5bd109c36b9426aff5
Instruction ID: 3f4e43cb26f79c7ba400e7c12c40e50675289961b497b396f353671a8d16ca53
Opcode Fuzzy Hash: 1cb553221fa8f9c5a90764fb7f989e42ab51d79b0e3b2f5bd109c36b9426aff5
Instruction Fuzzy Hash: 73011D7630064486EB52DF27A5943E972A1FB887D4F598629EB5507AB4CF78CC948700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000AA08 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 000000014000AA2B
SetWindowPos.USER32 ref: 000000014000AA50

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ItemWindow
String ID:
API String ID: 1669990519-0
Opcode ID: d5763e0e8c9a3749c79ab0511775c3be877b2006a0e2304ef9d7db526a893290
Instruction ID: f821960635c4a1ca73fad80cb35aec191f9d9fe11b24d5d0cb80eb2ef7e0de39
Opcode Fuzzy Hash: d5763e0e8c9a3749c79ab0511775c3be877b2006a0e2304ef9d7db526a893290
Instruction Fuzzy Hash: 00F0B776A1879087E710CF1AF48060ABBA0F7C8BE4F548119EF8993B28DB38D8418F00

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400180D4 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00000001400180ED
GetLastError.KERNEL32 ref: 00000001400180FC

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 8a34d447fa3e0832555fe1b112a07d0ffd7edee1e2d5ba31b2746fb1036968b5
Instruction ID: 6bf7ad6728a244616a86f2ac97959c172c882fe73e7c49e6b0f97d8b25702232
Opcode Fuzzy Hash: 8a34d447fa3e0832555fe1b112a07d0ffd7edee1e2d5ba31b2746fb1036968b5
Instruction Fuzzy Hash: 80E06D77610B44D1DBA28F22E8C039963A8A75CBD0F101201FB5A477B0DA39C5D5CB10

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000A680 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 000000014000A6A8
EndDialog.USER32 ref: 000000014000A6B3

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Dialog
String ID:
API String ID: 1120787796-0
Opcode ID: ab369d4f140357f1b0f79b8f19a5333c658bd91fdf8ab67524e51bb0028f1f54
Instruction ID: d6ac346c1cf935dde6f14bd24f281cf7bce7f0ca5abe3ffa9d7652c47deddf8e
Opcode Fuzzy Hash: ab369d4f140357f1b0f79b8f19a5333c658bd91fdf8ab67524e51bb0028f1f54
Instruction Fuzzy Hash: 7EE0657112150085E6679B3FD89839826F1E78AB84F594001D30547B78CF3F8CC8C210

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000A3D8 Relevance: 3.0, APIs: 2, Instructions: 20COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE ref: 000000014000A3E9
GetLastError.KERNEL32 ref: 000000014000A3F3

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 4c907a4584fedd663016c3e1b12b812fdd938b0251e69ca4a056dd77abf6e27a
Instruction ID: b67d3af4849342de1c2f95380a0c0ba73f5942846c7cf6471351c2f066b1b285
Opcode Fuzzy Hash: 4c907a4584fedd663016c3e1b12b812fdd938b0251e69ca4a056dd77abf6e27a
Instruction Fuzzy Hash: 74E012B5711A0086FF5A9BF3EC587B522D05B9CFC5F154028AF07C72A0EE7C88D55201

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000A8D4 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 000000014000A8E7
ShowWindow.USER32 ref: 000000014000A8FC

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 2ba84bd563e3d10343c533f13b93d188e590c2801bb12e0b99bb59907c2c7faa
Instruction ID: 6c02761c73bf97b72e7557279f26fa25ef68adda891ca949cb5974a3e39ec872
Opcode Fuzzy Hash: 2ba84bd563e3d10343c533f13b93d188e590c2801bb12e0b99bb59907c2c7faa
Instruction Fuzzy Hash: 89E08CB171204C86EB2A9767E4407A812E1E78CBC6F594118D71A072A0EB3C48868200

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001983C Relevance: 2.5, APIs: 2, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140019865
LeaveCriticalSection.KERNEL32 ref: 000000014001989D

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: cacb2d538569b4a25055d95f9d02ea92e872e3e584bc1122aa5a1093e64a0b92
Instruction ID: 2f91f605302ed91bac29cc9404e8debeb1d2e4b39582ef643a0ab49b64debfff
Opcode Fuzzy Hash: cacb2d538569b4a25055d95f9d02ea92e872e3e584bc1122aa5a1093e64a0b92
Instruction Fuzzy Hash: B2011636710B9482D7109F5BE48465ABB60F399FD4B599016EF8A47B24CF39D851C700

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400187C4 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??2@YAPEAX_K@Z.MSVCRT ref: 00000001400188B7

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 54aa1fdacae7e4b329cd8dcf8f58995f5c33570b6df32e1b8edb81040072f406
Instruction ID: de66bf1336a74a20cee7eb79eccd17f9ff187ec3aef0618c95afe03dded01f57
Opcode Fuzzy Hash: 54aa1fdacae7e4b329cd8dcf8f58995f5c33570b6df32e1b8edb81040072f406
Instruction Fuzzy Hash: B841E736601B4485EB7A8F57D5543A867A0FB88FC0F588425EF9A0B7A4DF3AC994C311

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000C3C8 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 000000014000C48D

Part of subcall function 000000014000B810: GetSystemMetrics.USER32 ref: 000000014000B872
Part of subcall function 000000014000B810: GetSystemMetrics.USER32 ref: 000000014000B888

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MetricsSystem$??3@
String ID:
API String ID: 2562992111-0
Opcode ID: 21a191cc24c5d2c523163d0ccfef709ec0f80e378e4f43f17e2451c931a2a6d6
Instruction ID: 3833d6c604191d48acd8f8aeef17e44d42231cfcde162414fe16a62a8026d709
Opcode Fuzzy Hash: 21a191cc24c5d2c523163d0ccfef709ec0f80e378e4f43f17e2451c931a2a6d6
Instruction Fuzzy Hash: A0212C7263468482E761CB12F890BEA6264F7987C0F844126FF8D53BA5DB3CC945CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001AADC Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 000000014001AB43

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 11eb724de74259ef008f2539646c767acd92f5b7c5ef71f713e52d6ca86e2d33
Instruction ID: dccdf7ac044f05f7c7aa3d0cd51540a306e87bb835f63fd32124116bf7c98088
Opcode Fuzzy Hash: 11eb724de74259ef008f2539646c767acd92f5b7c5ef71f713e52d6ca86e2d33
Instruction Fuzzy Hash: 5901A932704A9086E252DF07A5C07AEA764F74ABD4FA84525FF0847BA6CB39D8428700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001AA28 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 000000014001AA7D

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: c9979919d1db194ea95ae2375a2eb8ab4e5bc3b3969f5f9536aa72cdd967b338
Instruction ID: a5d43057493e11049620aeffdb34781e270f90dd965d03061198b4484d463503
Opcode Fuzzy Hash: c9979919d1db194ea95ae2375a2eb8ab4e5bc3b3969f5f9536aa72cdd967b338
Instruction Fuzzy Hash: 4001A73270069086D211CF17968075BB764F74DBD4F684525FF584BB65CB3DD852C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140018130 Relevance: 1.5, APIs: 1, Instructions: 37fileCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014001805C: FindCloseChangeNotification.KERNELBASE(?,?,?,0000000140001AE6), ref: 000000014001806E

CreateFileW.KERNELBASE ref: 0000000140018184

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ChangeCloseCreateFileFindNotification
String ID:
API String ID: 727422849-0
Opcode ID: 608078c7bdc8d4c2a4d82e13d152463fe85aa2f20a848740e72cb586ec39b86f
Instruction ID: ed0f798304ddd17e08eb70a86fcc9dfa0f8f882b298a04474a5d1a6029c6856a
Opcode Fuzzy Hash: 608078c7bdc8d4c2a4d82e13d152463fe85aa2f20a848740e72cb586ec39b86f
Instruction Fuzzy Hash: 0B018F32614B80C7D3608F16B44164ABBA5F388BE0F144329FFA903BA4CB38D851CB04

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000BD78 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400011B4: ??2@YAPEAX_K@Z.MSVCRT ref: 00000001400011E7
Part of subcall function 00000001400011B4: ??3@YAXPEAX@Z.MSVCRT ref: 000000014000121C

SetWindowTextW.USER32 ref: 000000014000BDDA

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??2@??3@TextWindow
String ID:
API String ID: 890632301-0
Opcode ID: 09e725b9fbc47d079fc7c84f5381cdf1911a0563218748b9eca7763de64a59e1
Instruction ID: b333b7fb0bec36bcbfd0e25a39b9a861ca80811600cd3e18b323fc81065f06f5
Opcode Fuzzy Hash: 09e725b9fbc47d079fc7c84f5381cdf1911a0563218748b9eca7763de64a59e1
Instruction Fuzzy Hash: 62014BB6724A4082EB12DB03E1583EDA3A1F79DBD5F148012EF49077A6DB38C9508B00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000C544 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 000000014000B810: GetSystemMetrics.USER32 ref: 000000014000B872
Part of subcall function 000000014000B810: GetSystemMetrics.USER32 ref: 000000014000B888

Part of subcall function 000000014000B8A4: ??3@YAXPEAX@Z.MSVCRT ref: 000000014000B91E
Part of subcall function 000000014000B8A4: ??3@YAXPEAX@Z.MSVCRT ref: 000000014000B928

??3@YAXPEAX@Z.MSVCRT ref: 000000014000C5D3

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@$MetricsSystem
String ID:
API String ID: 553786342-0
Opcode ID: c0bc4c2936f8366efe49f835e346be4b1adb2c95ea69aaa9f98c907475ca1e27
Instruction ID: 23bb655ed38c42e7dec931cac22a9a340036093636c2434da9fd674c0f7ea5e7
Opcode Fuzzy Hash: c0bc4c2936f8366efe49f835e346be4b1adb2c95ea69aaa9f98c907475ca1e27
Instruction Fuzzy Hash: 09015631220B8882EB42CB52F8943C573A4FB8C384F80402ABE8D437A5EF3CD808C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140015EC0 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140002518: free.MSVCRT ref: 0000000140002521

??3@YAXPEAX@Z.MSVCRT ref: 0000000140015F20

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@free
String ID:
API String ID: 3516102813-0
Opcode ID: fb501c30ffe9a70a30cad8f0cc87e8e5236dade86312694362895bdc017173c6
Instruction ID: 830a6167fbdf873f81acc46e7d707ca8aeb0adf8bf5cb19c2589b8a9cafa547f
Opcode Fuzzy Hash: fb501c30ffe9a70a30cad8f0cc87e8e5236dade86312694362895bdc017173c6
Instruction Fuzzy Hash: F2F0C976205A4485EA16DF26E4A53D86364EB4CBC4F958126AB4D4B375DE39C895C300

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400012CC Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE ref: 000000014000131F

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: fdd6c57b336fe3967596980c063f1acd51b5360f85544f337aeac028ca6633ab
Instruction ID: 86b86e1f875e3c546c6c39830c42d3ae0764d62cd28490eec4c28c7083631913
Opcode Fuzzy Hash: fdd6c57b336fe3967596980c063f1acd51b5360f85544f337aeac028ca6633ab
Instruction Fuzzy Hash: E9F0F9B2600A00C2EB6ADF6AD4443E863A0FB8CB88F544525DB094B6B4EF39C996C300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140018278 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 00000001400182A1

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: fe911cb77f57771cb470a8d52b7c2442bb7fbd58ad24304b36c8a612410abd7e
Instruction ID: 2ec6e2cfa779f533d74e5e22b73f45f8a3e3eaf4dda18a3a819ed566e25001f9
Opcode Fuzzy Hash: fe911cb77f57771cb470a8d52b7c2442bb7fbd58ad24304b36c8a612410abd7e
Instruction Fuzzy Hash: 49E04676624544CBE311CF61E400B9AB3A0F398B25F404118EA8A83B64CBBCC544CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001AC4 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 0000000140001AEE

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 41d9f9ef1dc3b57e3a721cf8f8f2021bfdce0c87f5d6798cf92c775094d15662
Instruction ID: ec44a651fb08ff4208ab8d663cb64ae3eb70d7ecdfb83dc7752a680166838147
Opcode Fuzzy Hash: 41d9f9ef1dc3b57e3a721cf8f8f2021bfdce0c87f5d6798cf92c775094d15662
Instruction Fuzzy Hash: CDE0C23174464481EB069B9BB6913E86265EB4DBC0F588024FF4803BB2CE78C8A38301

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000A420 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

_beginthreadex.MSVCRT ref: 000000014000A442

Part of subcall function 000000014000A38C: GetLastError.KERNEL32 ref: 000000014000A399

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast_beginthreadex
String ID:
API String ID: 4034172046-0
Opcode ID: b72dc7b368f5597b6cc9a18f35c8f391413a9f10ec7fdc6464c855525bc647eb
Instruction ID: 9e13317f9715109fa2eac0ac4686b1bb256ea08cc9a6434f8cc8f47cc38c69a9
Opcode Fuzzy Hash: b72dc7b368f5597b6cc9a18f35c8f391413a9f10ec7fdc6464c855525bc647eb
Instruction Fuzzy Hash: B9D05B76625B8087DB15DB62F4053D963A4A79E7D9F148028FF8D43365EF3CC2548600

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001154 Relevance: 1.5, APIs: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 000000014000117F

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 900fbfe728c5593d45b02129af1571f898a5c4f8108e92cb198522ad7a1ee711
Instruction ID: b69322a373f40d2fa1fd105a0f7b71726b3d59bc9bfad3d2942958f1aa6ccbda
Opcode Fuzzy Hash: 900fbfe728c5593d45b02129af1571f898a5c4f8108e92cb198522ad7a1ee711
Instruction Fuzzy Hash: 7ED05EB561111182FB5F8B57AD093E511A2AB8C7C0F94C019BB044B2F0C97D4C858B00

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400181DC Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE ref: 00000001400181F8

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: cb644cd8d1f1905214f6792a3cbcb5a71db60d1d09dd455a2866124d54a34d44
Instruction ID: 86fefbcd83b3913b4cd700f615bed1432190b39d7ec08578771d5e8e5d89d9c2
Opcode Fuzzy Hash: cb644cd8d1f1905214f6792a3cbcb5a71db60d1d09dd455a2866124d54a34d44
Instruction Fuzzy Hash: 0FD01772624984CBE7018F61E444B6AF764F398BA9F084008EB898A664CBBDC495CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001805C Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,0000000140001AE6), ref: 000000014001806E

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 60fd23dc0f84d2c3f2dcea106af43bf734ae91ca7e1a62bac8cc23c3b08f3bc4
Instruction ID: 8e6fd74606613dcdde953c05bcf23f19d7e6a9153137f3f59d1f8e8c1ee46785
Opcode Fuzzy Hash: 60fd23dc0f84d2c3f2dcea106af43bf734ae91ca7e1a62bac8cc23c3b08f3bc4
Instruction Fuzzy Hash: 63D09E71A0194581EB771FBA84413543395A75CFB4F5843109B754A2E0DA2689968711

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400195F8 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 0000000140019612

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: b72743eb361664d82c275d1e974104d4d681605d4059b6f5b43ea9aea1490b5e
Instruction ID: 11dc706e16af470e3a4d7cc3df911193cf664264314d879e62d066bde224018a
Opcode Fuzzy Hash: b72743eb361664d82c275d1e974104d4d681605d4059b6f5b43ea9aea1490b5e
Instruction Fuzzy Hash: 62D0127171124543EE76A6BB54423D46250975E7F8F180620FF308F2E2E63699934B10

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001AAB4 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 000000014001AACE

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: fef9e5114bb7b9b45218d8570e31c364584d71e4da58567589a6f18737c70e4d
Instruction ID: 40f2cf2f80e87ffe45f561daa4115ab8faf72166c337f67564cc1bc82ec64de9
Opcode Fuzzy Hash: fef9e5114bb7b9b45218d8570e31c364584d71e4da58567589a6f18737c70e4d
Instruction Fuzzy Hash: E9D01271B1034547EE6AA7BB54423D81250D71E7B4F640714FB704F2E2DB29C9934711

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140018254 Relevance: 1.5, APIs: 1, Instructions: 11timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE ref: 0000000140018263

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: 6a0d52bac7a705ee21b9cba521dba818c34176661b34fd447dfb1df5715079e4
Instruction ID: a8864e215d1781b561f977d9942fe44c3bab8b0121a593bf2ef7b1a799a9fa4c
Opcode Fuzzy Hash: 6a0d52bac7a705ee21b9cba521dba818c34176661b34fd447dfb1df5715079e4
Instruction Fuzzy Hash: 2FC08C3AB2142082D70C937748E271D1212638CF80FE1C428DB0FD6710CC3C80D64B00

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400194EC Relevance: 1.3, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 00000001400195E6

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionThrow
String ID:
API String ID: 432778473-0
Opcode ID: 088c7989c6830c2dae7f44350017a953dd094d2267a7ccfc3a7c985fb350db90
Instruction ID: 0df30f8ba79df6d1bb458f30455cb07bc174ed77bb4e3c06237ec5f0adee4d35
Opcode Fuzzy Hash: 088c7989c6830c2dae7f44350017a953dd094d2267a7ccfc3a7c985fb350db90
Instruction Fuzzy Hash: 8B316576612F4499EB428B19E4843D933A8F70C758FA0463ADB8C07775EF7AC95AC380

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140018A74 Relevance: 1.3, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000000140018AAF

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 8f19b6621b0f68508855df72082f1fe74747effc1c26b8db5c25bcc9e0106cb3
Instruction ID: 582de85c3c4221056c3d89bb531e227b3cad688c5854f62f37c7784f836c5433
Opcode Fuzzy Hash: 8f19b6621b0f68508855df72082f1fe74747effc1c26b8db5c25bcc9e0106cb3
Instruction Fuzzy Hash: 49F0BB3131858547FB728BAEA4803E952D0BB4C7C4F944526FF89CBA75D979CE948702

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140018B28 Relevance: 1.3, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140018278: WriteFile.KERNELBASE ref: 00000001400182A1

GetLastError.KERNEL32 ref: 0000000140018B5B

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 88c23c17ee25e73724b32c10983a9cd08bcae85fc69e39aee9daa1343831ffd8
Instruction ID: 0cf489fb7cefbee19b390f06c5ccb45f93454c31495503a7f945c0bf97b62f7c
Opcode Fuzzy Hash: 88c23c17ee25e73724b32c10983a9cd08bcae85fc69e39aee9daa1343831ffd8
Instruction Fuzzy Hash: D1F0E97131818087DB618FABA0C07A96191F71C7C4F441435FB468B666D734CD948744

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140018A14 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000000140018A40

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: f91846a33f49af399046c59952a0e6f93846c9f63ec338f8fde20e094b0c6a68
Instruction ID: 128b5b1f7257d182eacd3f7695c14909f43ec7ed553b312aea87ee65d7bc1eef
Opcode Fuzzy Hash: f91846a33f49af399046c59952a0e6f93846c9f63ec338f8fde20e094b0c6a68
Instruction Fuzzy Hash: 0AF0A7313241808BE7A19F6BA5C07A96290BB4CBC0F94143AFF968B665DA79CE948705

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400030E0 Relevance: 1.3, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 0000000140003107

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a6e0a543eeb45b1ba8c0fc891aae8c468f576be2538950eefc783f34eb0adf93
Instruction ID: 12badb2b82353b6cd46749a83adf26e0197359f862afe37d23c6629bd06fea85
Opcode Fuzzy Hash: a6e0a543eeb45b1ba8c0fc891aae8c468f576be2538950eefc783f34eb0adf93
Instruction Fuzzy Hash: ACD0C9F071914581FB3B53B378167E745481B1CBC5F440424AF128B6E2E93AC5D54B44

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140003114 Relevance: 1.3, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 000000014000312D

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: a344c7a17730a24953e72c12aa7d89d02a79851603dec69080b8712952861b8c
Instruction ID: 8126266e23569604762762580943d7cc9108cc55e64ca7625322b7278f9ed206
Opcode Fuzzy Hash: a344c7a17730a24953e72c12aa7d89d02a79851603dec69080b8712952861b8c
Instruction Fuzzy Hash: B8C08CB0B1920281FF27A3733C053F602580F1D7C4F082420EF178B2A2E934C4E10388

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400024FC Relevance: 1.3, APIs: 1, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 000000014000250D

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: e643dfb97a48b38184bc71a0c771ec05a04a27d2e8b6a4efa83338b3aea368fc
Instruction ID: c79e3af48478552d1d4dcca3c90f12c9cb13629bcbdadc58ae5c8af48aa99fec
Opcode Fuzzy Hash: e643dfb97a48b38184bc71a0c771ec05a04a27d2e8b6a4efa83338b3aea368fc
Instruction Fuzzy Hash: 79B09274B1380081FFAEE3576D6135040612F8C782E848158EA09026608E38066B0F04

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140002518 Relevance: 1.3, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0000000140002521

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: cd1963c0231a449e0201285a365b6c8630ccb4145deee97d4e002115b2bbb57a
Instruction ID: b62d7211c97d4d99b760abce51a73e8f8216415605979fa60d8ed3bb4eb9178e
Opcode Fuzzy Hash: cd1963c0231a449e0201285a365b6c8630ccb4145deee97d4e002115b2bbb57a
Instruction Fuzzy Hash: DAB01274E03802C2ED0FA3431C5135410101F0D346F9600049701015614A3C04AF0605

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0000000140006C60 Relevance: 36.9, APIs: 3, Strings: 18, Instructions: 185stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 0000000140006D8D
_wtol.MSVCRT ref: 0000000140006EC2
_wtol.MSVCRT ref: 0000000140006E9C

Part of subcall function 0000000140002BB4: GetLastError.KERNEL32 ref: 0000000140002C1B
Part of subcall function 0000000140002BB4: wsprintfW.USER32 ref: 0000000140002C32
Part of subcall function 0000000140002BB4: GetEnvironmentVariableW.KERNEL32 ref: 0000000140002C42
Part of subcall function 0000000140002BB4: GetLastError.KERNEL32 ref: 0000000140002C4A
Part of subcall function 0000000140002BB4: ??2@YAPEAX_K@Z.MSVCRT ref: 0000000140002C69
Part of subcall function 0000000140002BB4: GetEnvironmentVariableW.KERNEL32 ref: 0000000140002C7D
Part of subcall function 0000000140002BB4: GetLastError.KERNEL32 ref: 0000000140002C87
Part of subcall function 0000000140002BB4: lstrcmpiW.KERNEL32 ref: 0000000140002C9E
Part of subcall function 0000000140002BB4: ??3@YAXPEAX@Z.MSVCRT ref: 0000000140002CAD
Part of subcall function 0000000140002BB4: SetLastError.KERNEL32 ref: 0000000140002CC3
Part of subcall function 0000000140002BB4: lstrlenA.KERNEL32 ref: 0000000140002CF8
Part of subcall function 0000000140002BB4: ??2@YAPEAX_K@Z.MSVCRT ref: 0000000140002D15
Part of subcall function 0000000140002BB4: GetLocaleInfoW.KERNEL32 ref: 0000000140002D4B
Part of subcall function 0000000140002BB4: _wtol.MSVCRT ref: 0000000140002D5D
Part of subcall function 0000000140002BB4: MultiByteToWideChar.KERNEL32 ref: 0000000140002D8D

Strings

Title, xrefs: 0000000140006C6A
Progress, xrefs: 0000000140006D5E
ExtractPathTitle, xrefs: 0000000140006ECE
CancelPrompt, xrefs: 0000000140006F0E
ExtractPathWidth, xrefs: 0000000140006EA8
ExtractCancelText, xrefs: 0000000140006E50
ExtractDialogText, xrefs: 0000000140006E62
PasswordTitle, xrefs: 0000000140006F35
GUIMode, xrefs: 0000000140006DA9
GUIFlags, xrefs: 0000000140006E10
PasswordText, xrefs: 0000000140006F5C
WarningTitle, xrefs: 0000000140006D10
ExtractDialogWidth, xrefs: 0000000140006E7B
ExtractPathText, xrefs: 0000000140006EE7
MiscFlags, xrefs: 0000000140006E3C
ErrorTitle, xrefs: 0000000140006CF7
ExtractTitle, xrefs: 0000000140006D37
OverwriteMode, xrefs: 0000000140006DD8

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$_wtol$??2@EnvironmentVariablelstrcmpi$??3@ByteCharInfoLocaleMultiWidelstrlenwsprintf
String ID: CancelPrompt$ErrorTitle$ExtractCancelText$ExtractDialogText$ExtractDialogWidth$ExtractPathText$ExtractPathTitle$ExtractPathWidth$ExtractTitle$GUIFlags$GUIMode$MiscFlags$OverwriteMode$PasswordText$PasswordTitle$Progress$Title$WarningTitle
API String ID: 23300869-2157245290
Opcode ID: 8f4e636a56b65a8d4d1e0c1cc19368c267f83044d73afd2cc50ef2fc3ef7b458
Instruction ID: 10db4e49cc09c16a37a9eb6e00b36d987ebe79190347e2aec0cbcc53de5c4e8d
Opcode Fuzzy Hash: 8f4e636a56b65a8d4d1e0c1cc19368c267f83044d73afd2cc50ef2fc3ef7b458
Instruction Fuzzy Hash: C181F7B131174181FF57EB2BF8657E423A5AB8DBD0F956029BA4A077B6EF78C8448700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140002BB4 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 131stringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000000140002C1B
wsprintfW.USER32 ref: 0000000140002C32
GetEnvironmentVariableW.KERNEL32 ref: 0000000140002C42
GetLastError.KERNEL32 ref: 0000000140002C4A
??2@YAPEAX_K@Z.MSVCRT ref: 0000000140002C69
GetEnvironmentVariableW.KERNEL32 ref: 0000000140002C7D
GetLastError.KERNEL32 ref: 0000000140002C87
lstrcmpiW.KERNEL32 ref: 0000000140002C9E
??3@YAXPEAX@Z.MSVCRT ref: 0000000140002CAD
SetLastError.KERNEL32 ref: 0000000140002CC3
lstrlenA.KERNEL32 ref: 0000000140002CF8
??2@YAPEAX_K@Z.MSVCRT ref: 0000000140002D15
GetLocaleInfoW.KERNEL32 ref: 0000000140002D4B
_wtol.MSVCRT ref: 0000000140002D5D
MultiByteToWideChar.KERNEL32 ref: 0000000140002D8D

Strings

SfxString%d, xrefs: 0000000140002C21

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$??2@EnvironmentVariable$??3@ByteCharInfoLocaleMultiWide_wtollstrcmpilstrlenwsprintf
String ID: SfxString%d
API String ID: 579950010-944934635
Opcode ID: cb2662f3c2ad11c51da9d884ab9eb49bbf496768983eff72749beea9758c2f50
Instruction ID: cdd3954237dff648b59348d4ff135c9c035ce642d639e0d2756145f05093bfc1
Opcode Fuzzy Hash: cb2662f3c2ad11c51da9d884ab9eb49bbf496768983eff72749beea9758c2f50
Instruction Fuzzy Hash: 9B514872200A4586EB66DB23F885BA933A1F78CBD4F44412AFB1A437B4EB38C945C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140003E88 Relevance: 16.6, APIs: 11, Instructions: 81filestringCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 0000000140003EC8
lstrcmpW.KERNEL32 ref: 0000000140003F1D
lstrcmpW.KERNEL32 ref: 0000000140003F33
SetFileAttributesW.KERNEL32 ref: 0000000140003F4C
DeleteFileW.KERNEL32 ref: 0000000140003F59
FindNextFileW.KERNEL32 ref: 0000000140003F6B
FindClose.KERNEL32 ref: 0000000140003F7C
SetFileAttributesW.KERNEL32 ref: 0000000140003F87
RemoveDirectoryW.KERNEL32 ref: 0000000140003F94
??3@YAXPEAX@Z.MSVCRT ref: 0000000140003FA1
??3@YAXPEAX@Z.MSVCRT ref: 0000000140003FB0

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: File$Find$??3@Attributeslstrcmp$CloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 1862581289-0
Opcode ID: 4f3e757cda006ff2284139ef6d2fc1b0bc74b9d385bd6d2a786dca4ff59dabd3
Instruction ID: 565dcd4f617b5ea8440bafb7faf5eba673d93f54db69377951f890960de446c5
Opcode Fuzzy Hash: 4f3e757cda006ff2284139ef6d2fc1b0bc74b9d385bd6d2a786dca4ff59dabd3
Instruction Fuzzy Hash: 0D310C71704A4291EB53DB27F8503E963A5BB8CBD0F844225BA5E47AF9DF7CC9098700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000D328 Relevance: 16.6, APIs: 11, Instructions: 77stringwindowCOMMON

Download Yara Rule

APIs

wvsprintfW.USER32 ref: 000000014000D35D
GetLastError.KERNEL32 ref: 000000014000D36B
FormatMessageW.KERNEL32 ref: 000000014000D3A0
FormatMessageW.KERNEL32 ref: 000000014000D3CD
lstrlenW.KERNEL32 ref: 000000014000D3DC
lstrlenW.KERNEL32 ref: 000000014000D3EA
??2@YAPEAX_K@Z.MSVCRT ref: 000000014000D40D
lstrcpyW.KERNEL32 ref: 000000014000D41D
lstrcpyW.KERNEL32 ref: 000000014000D433
??3@YAXPEAX@Z.MSVCRT ref: 000000014000D444
LocalFree.KERNEL32 ref: 000000014000D44E

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: FormatMessagelstrcpylstrlen$??2@??3@ErrorFreeLastLocalwvsprintf
String ID:
API String ID: 829399097-0
Opcode ID: 50e664bdfb66e25894f099d4a0b4276996e572cb3c6312dcdd15bb8a62020e0b
Instruction ID: b2c157b53e8ae3b6b7f410addf8fe44d36d5f0c493faa764c8cdbd8fc4daff3d
Opcode Fuzzy Hash: 50e664bdfb66e25894f099d4a0b4276996e572cb3c6312dcdd15bb8a62020e0b
Instruction Fuzzy Hash: F7318C32204B4182EB15DB52F88439AB3A5F7997E1F514129FB9E43AA4EF7CC8488B00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140007290 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00000001400011B4: ??2@YAPEAX_K@Z.MSVCRT ref: 00000001400011E7
Part of subcall function 00000001400011B4: ??3@YAXPEAX@Z.MSVCRT ref: 000000014000121C

??3@YAXPEAX@Z.MSVCRT ref: 0000000140007366
ShellExecuteExW.SHELL32 ref: 000000014000738B
WaitForSingleObject.KERNEL32 ref: 00000001400073A6
CloseHandle.KERNEL32 ref: 00000001400073B4
??3@YAXPEAX@Z.MSVCRT ref: 00000001400073C1
??3@YAXPEAX@Z.MSVCRT ref: 00000001400073C9

Strings

runas, xrefs: 000000014000732A

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@$??2@CloseExecuteHandleObjectShellSingleWait
String ID: runas
API String ID: 228040680-4000483414
Opcode ID: 68883d09e73ee182fc14b5a5bce8f2b324177c31765d8b014cc4152f2f81f4f1
Instruction ID: 439ee56645c6ebca01aea5e0a66fb0c6715fb919133604d2e15fdbf53ada0234
Opcode Fuzzy Hash: 68883d09e73ee182fc14b5a5bce8f2b324177c31765d8b014cc4152f2f81f4f1
Instruction Fuzzy Hash: 98413C72A18B8486E721DB12F44439AB3A4F7D8BD0F504119FB8D43AAACF7CCA05CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140021B8C Relevance: 5.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 0000000140021E0F
_CxxThrowException.MSVCRT ref: 0000000140021E29
_CxxThrowException.MSVCRT ref: 0000000140021EDD

Part of subcall function 000000014002168C: ??2@YAPEAX_K@Z.MSVCRT ref: 00000001400216A6

_CxxThrowException.MSVCRT ref: 0000000140021F63

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionThrow$??2@
String ID:
API String ID: 3392402120-0
Opcode ID: 0f6016ca687063e179ee74b70acac2ce658befef4e1c7b89f4779ae4fd80dacb
Instruction ID: e82bcadf208d9880996ea403331261188986581afee0adac8e3c7d1bf186ce49
Opcode Fuzzy Hash: 0f6016ca687063e179ee74b70acac2ce658befef4e1c7b89f4779ae4fd80dacb
Instruction Fuzzy Hash: 92B14576600A8492EB25DF6AD4843E93761F798B88F52812AEF4E07B68DF34D945CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140002E64 Relevance: 4.5, APIs: 3, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 0000000140002EB9
CheckTokenMembership.ADVAPI32 ref: 0000000140002ED6
FreeSid.ADVAPI32 ref: 0000000140002EE4

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: abe6f783ec305016ce38fee71c7ad877d57f220a55fa2606fae195cd5eb54461
Instruction ID: bd99a0001b312c42b342465bde96b36effb439ec37525ee33b7f735884031050
Opcode Fuzzy Hash: abe6f783ec305016ce38fee71c7ad877d57f220a55fa2606fae195cd5eb54461
Instruction Fuzzy Hash: 061100B76096C0CAD721CF69E48478EBBA0F3A8B44F94412AE78983724C738C549CF14

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140011620 Relevance: 2.6, APIs: 2, Instructions: 107COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000014001163D
memset.MSVCRT ref: 000000014001173B

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 9649af6fc4ef3f732a6c9dbd497b6dcb2825c84bd5b21f93c621901826dd70cd
Instruction ID: 65a7a550d7fee471dd990d29c9786560241e7a1407137cfc9d40ef62c6af32ea
Opcode Fuzzy Hash: 9649af6fc4ef3f732a6c9dbd497b6dcb2825c84bd5b21f93c621901826dd70cd
Instruction Fuzzy Hash: D141C17361469086D375CF0AF4047DEB6A4F7D4784F558222EF8997B95EB3AC059CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000E1A0 Relevance: 1.5, Strings: 1, Instructions: 289COMMON

Download Yara Rule

Strings

MZ`, xrefs: 000000014000E1BD

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: MZ`
API String ID: 0-2330268423
Opcode ID: ce6d06c27b1aa1ff0d9a26cd617125f9c085dea1c835c55786a4642b8c874b91
Instruction ID: 7c3f91cd70b1956add45bf232b18aa1fba3a1746be0ff1480ceef520eef83f4d
Opcode Fuzzy Hash: ce6d06c27b1aa1ff0d9a26cd617125f9c085dea1c835c55786a4642b8c874b91
Instruction Fuzzy Hash: 32C180732202B88BE745CA2F9854CED37E5F39574E7829221EF8497789C63CB511DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000DC90 Relevance: 1.5, Strings: 1, Instructions: 288COMMON

Download Yara Rule

Strings

MZ`, xrefs: 000000014000DCC0

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: MZ`
API String ID: 0-2330268423
Opcode ID: b9f2e461abbd51a00089050847e4ef3fffaf09491b871cef7acf0fa9541dd99d
Instruction ID: 681f7e495cc456687deb5cc797622adf3b1852cdd8235db41fbcd6a1effff65e
Opcode Fuzzy Hash: b9f2e461abbd51a00089050847e4ef3fffaf09491b871cef7acf0fa9541dd99d
Instruction Fuzzy Hash: CDC1B5722212788BD701CB2F98449E937E4F3947497939622EBA86B745D53CF902EB60

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000F6E0 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

MZ`, xrefs: 000000014000F701

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: MZ`
API String ID: 0-2330268423
Opcode ID: 57bda3d6129cfde47ffdf7141f32b3817ba5098d38a3470dffbb5b8e9bb35259
Instruction ID: ef8c7858fccc3ed7b94a1a200c0c2525697487ea3fc1e667f9ba29d498590d53
Opcode Fuzzy Hash: 57bda3d6129cfde47ffdf7141f32b3817ba5098d38a3470dffbb5b8e9bb35259
Instruction Fuzzy Hash: 4A51E572A206A04AE7598F25BC91BEA77D4F3883C1F40863EEB69C3BA0C67CD515C750

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000DA50 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

MZ`, xrefs: 000000014000DAB9

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: MZ`
API String ID: 0-2330268423
Opcode ID: 77ee53ef5df956b01911539818a9af233fb13bf1a7387d27248b6e01f32a8f1a
Instruction ID: d4a5a2d3cc526a446392909bb2679bde978dbacf427336f79b1af1971378171d
Opcode Fuzzy Hash: 77ee53ef5df956b01911539818a9af233fb13bf1a7387d27248b6e01f32a8f1a
Instruction Fuzzy Hash: 6A31D2B231829486DB26CB2E68503EDBBE0F3497C6F441036EB9E87755DB38D606D320

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140013230 Relevance: 1.0, Instructions: 975COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c683318e74ac658dfae7f1b22a9d6e285bfeb19a3b61a0aa070cfdaaeb6d944
Instruction ID: fa98dea519b5eda1a7b0c88864ac0a028e56931ae606e2e3414ea0131dc4e294
Opcode Fuzzy Hash: 7c683318e74ac658dfae7f1b22a9d6e285bfeb19a3b61a0aa070cfdaaeb6d944
Instruction Fuzzy Hash: AE72F6B27341A14BD72A8B39E444FA92BE1F3587C4F106125FAC6CBF94E17AD642CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140014190 Relevance: .5, Instructions: 463COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45bd88158f73c13cbdc850b91d707fbfbba09d5aaaa967a2fa98ea12ed02f1c7
Instruction ID: 579726e642534f0cfa0854f9aa4bc9bf832e03f50000378888d5f0d5352a2755
Opcode Fuzzy Hash: 45bd88158f73c13cbdc850b91d707fbfbba09d5aaaa967a2fa98ea12ed02f1c7
Instruction Fuzzy Hash: C0F12F763284A142EB2B8E36E448FF92A91B3597C5F106521FB57CBAF0F27AC546D340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400108C0 Relevance: .4, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1382a43b33b7cddcd7db1b64c69a0af682e84982ece76e86edf28eade05d2ca4
Instruction ID: dcf8dc4ec09eb26f90e66d9f3c91f1ef6e77107547623fbbca91f4d6bc64b13c
Opcode Fuzzy Hash: 1382a43b33b7cddcd7db1b64c69a0af682e84982ece76e86edf28eade05d2ca4
Instruction Fuzzy Hash: 6F126E72200BA186EB55DB16D09CBEE33A8F748BC4F424125EB8E4B7A1CF76C845C758

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140016C30 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 782b1ac514266e36a8b2af6f8300c2d1ac7d5ec6ebeedf4e2e0c9041e33cce00
Instruction ID: cb5fb520cfc70f0c9e71261567dbc8f25451d660115271b4213b66b039d10361
Opcode Fuzzy Hash: 782b1ac514266e36a8b2af6f8300c2d1ac7d5ec6ebeedf4e2e0c9041e33cce00
Instruction Fuzzy Hash: 61E191736056848BD719CF3AD4407ADBBA1F748F88F18C129EB4A87369EA3AD855C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000ECB0 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c43836c3c657f884e75bc9386950e75eef15775ecf5ec7c41fb3815de4e5849f
Instruction ID: 07aa253ac8b61df6464c485799feee28b840e9c55244de6a4247c0e5a0b51d22
Opcode Fuzzy Hash: c43836c3c657f884e75bc9386950e75eef15775ecf5ec7c41fb3815de4e5849f
Instruction Fuzzy Hash: 01B194E36082E48EC71A8B2E556857C7FF0E22A782709429BE7E543743D22CD365DB35

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400170F0 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69b6475d7a0199148ef249fbc053a23c943e0ccf4ae01405b7bd2e1dbab77975
Instruction ID: c2d67d44a79bda1c45b2b78fd56d78dc5af30eda27a3605eeba87b83f0d380da
Opcode Fuzzy Hash: 69b6475d7a0199148ef249fbc053a23c943e0ccf4ae01405b7bd2e1dbab77975
Instruction Fuzzy Hash: F3619EB76156D08BC755CF3AD140A6CBBB0F759B84F48D102EB8983790D73AD9A1CB50

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000E940 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b38ed77ee13a2300beb4958c0d2de25dc3c21f874df050270ccc9342af00a9b3
Instruction ID: 7f0e2c8b05abf86899b756dade96abd4103cab53847549304050610ada12d9b0
Opcode Fuzzy Hash: b38ed77ee13a2300beb4958c0d2de25dc3c21f874df050270ccc9342af00a9b3
Instruction Fuzzy Hash: 3251E1B37246508BC354CF2DF848A4EB7A5F388798B154225EB99C3B49D739D941CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140022940 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 149e944d266e5c5b931dd92add6c7ceb5ff4a8b28220e4052e827b713932bc95
Instruction ID: 07eb831dacb520702a90a23cc79b56cd7647481813ad32dc71b482efc1c29fb5
Opcode Fuzzy Hash: 149e944d266e5c5b931dd92add6c7ceb5ff4a8b28220e4052e827b713932bc95
Instruction Fuzzy Hash: 4D21913B320A4207EE4CC77A9D277B92291A348345F84993DEA5BC7695EA3DC5198344

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140022F94 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3a61a306afd697059511bcae512bb4e71a01eda6d32417fa44cf9ee444eb9bc
Instruction ID: 73a65b453be35d4ce3bb89c36512a33c87892c173acc78055ed17d4323c9323d
Opcode Fuzzy Hash: b3a61a306afd697059511bcae512bb4e71a01eda6d32417fa44cf9ee444eb9bc
Instruction Fuzzy Hash: 0F418F62D14FD151EB174F3C9402369B320FFABB48F00D716FFC171861EB22A584A611

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140022BB1 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0b449660420dd74c52b061e4e0ac893857a26900f34d65d6a0f16e249f0c9ca
Instruction ID: 996cc509826c41d954252e3c0182fdc15f9bc86c70725160855f9fc20ca493e8
Opcode Fuzzy Hash: b0b449660420dd74c52b061e4e0ac893857a26900f34d65d6a0f16e249f0c9ca
Instruction Fuzzy Hash: DA2107B3E105605BD7478E7ED6883E9B391F7087FAF124B26EF55639E8C1286850C650

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140022CA0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf09fca67504a56f52be9d588926d6449e0b21bca4f1d215e3043032594f1d6f
Instruction ID: dc4db3f6d310dbc4b173e44157b0558f9cce0c008b45b147503ebb6fa7b12afb
Opcode Fuzzy Hash: bf09fca67504a56f52be9d588926d6449e0b21bca4f1d215e3043032594f1d6f
Instruction Fuzzy Hash: 642126B3A204605AD307DF2AEA887BA63D1FB0C7FDF568B259F53579D8C5289840D600

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000E740 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7f0f242bf6ff99ddfe88e2de1c9eb7502ac975c9d7c63aba052d3741762a5e6
Instruction ID: 6a6207eeb7cf2c96ec4238f3769f578d3fac3a3c83234058a3e3c9db56367f79
Opcode Fuzzy Hash: b7f0f242bf6ff99ddfe88e2de1c9eb7502ac975c9d7c63aba052d3741762a5e6
Instruction Fuzzy Hash: 482103B76247A48BC340CF1AE04890FBBB8F788B94F169006EB8893714CB34E941CF48

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140022B70 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da3a4fd853bef1e23ab0d859d8b080efc035e4e503cfffb517ab2648b17c4fa8
Instruction ID: e93ac3addf8566834cc1e59b65eb65e121e7aec22703aba379d5dac9e33cbc56
Opcode Fuzzy Hash: da3a4fd853bef1e23ab0d859d8b080efc035e4e503cfffb517ab2648b17c4fa8
Instruction Fuzzy Hash: F2E04CB2919641DFD3489F2DA54115ABBE0E798314F44C56EE699C7B19E23CC4919F00

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400073EC Relevance: 58.0, APIs: 30, Strings: 3, Instructions: 203threadprocesssynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00000001400011B4: ??2@YAPEAX_K@Z.MSVCRT ref: 00000001400011E7
Part of subcall function 00000001400011B4: ??3@YAXPEAX@Z.MSVCRT ref: 000000014000121C

GetCommandLineW.KERNEL32 ref: 0000000140007445
??3@YAXPEAX@Z.MSVCRT ref: 0000000140007586
??3@YAXPEAX@Z.MSVCRT ref: 0000000140007593
??3@YAXPEAX@Z.MSVCRT ref: 00000001400075A0
??3@YAXPEAX@Z.MSVCRT ref: 00000001400075AD
??3@YAXPEAX@Z.MSVCRT ref: 00000001400075BA
??3@YAXPEAX@Z.MSVCRT ref: 00000001400075C7
??3@YAXPEAX@Z.MSVCRT ref: 00000001400075D4
??3@YAXPEAX@Z.MSVCRT ref: 00000001400075E1
??3@YAXPEAX@Z.MSVCRT ref: 00000001400075EE
??3@YAXPEAX@Z.MSVCRT ref: 00000001400075FB
GetStartupInfoW.KERNEL32 ref: 0000000140007613
CreateProcessW.KERNEL32 ref: 000000014000765D
GetLastError.KERNEL32 ref: 0000000140007667
CreateJobObjectW.KERNEL32 ref: 000000014000767A
AssignProcessToJobObject.KERNEL32 ref: 0000000140007694
CreateIoCompletionPort.KERNEL32 ref: 00000001400076AF
SetInformationJobObject.KERNEL32 ref: 00000001400076E6
ResumeThread.KERNEL32 ref: 00000001400076F1
GetQueuedCompletionStatus.KERNEL32 ref: 0000000140007720
ResumeThread.KERNEL32 ref: 000000014000772F
WaitForSingleObject.KERNEL32 ref: 000000014000773D
CloseHandle.KERNEL32 ref: 0000000140007748
GetExitCodeProcess.KERNEL32 ref: 000000014000775B
GetLastError.KERNEL32 ref: 0000000140007765
CloseHandle.KERNEL32 ref: 0000000140007777
CloseHandle.KERNEL32 ref: 0000000140007785
CloseHandle.KERNEL32 ref: 0000000140007793
??3@YAXPEAX@Z.MSVCRT ref: 00000001400077A3
??3@YAXPEAX@Z.MSVCRT ref: 00000001400077AD

Strings

sfxwaitall, xrefs: 0000000140007489
h, xrefs: 0000000140007608
" -, xrefs: 0000000140007472

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@$CloseHandleObject$CreateProcess$CompletionErrorLastResumeThread$??2@AssignCodeCommandExitInfoInformationLinePortQueuedSingleStartupStatusWait
String ID: " -$h$sfxwaitall
API String ID: 2737579793-4132442212
Opcode ID: ef542cf7b91112885125d90d4d43afff281ca9640340473581095675d7b35d76
Instruction ID: 35156185bb972c6355c094420fad334aee275d507b68e5537b09c5fb06d852d0
Opcode Fuzzy Hash: ef542cf7b91112885125d90d4d43afff281ca9640340473581095675d7b35d76
Instruction Fuzzy Hash: 6BA13072608A8582EB61DB62F4543DAB361F7D9BD0F408119EB8E47BA9DF7CC449CB01

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140002798 Relevance: 38.6, APIs: 21, Strings: 1, Instructions: 120windowCOMMON

Download Yara Rule

APIs

GetWindowDC.USER32 ref: 00000001400027BD
GetDeviceCaps.GDI32 ref: 00000001400027CE
MulDiv.KERNEL32 ref: 00000001400027E7
GetObjectW.GDI32 ref: 0000000140002823
MulDiv.KERNEL32 ref: 0000000140002832
MulDiv.KERNEL32 ref: 0000000140002843
CreateCompatibleDC.GDI32 ref: 000000014000284E
CreateCompatibleDC.GDI32 ref: 000000014000285A
SelectObject.GDI32 ref: 0000000140002869
CreateCompatibleBitmap.GDI32 ref: 000000014000287A
SelectObject.GDI32 ref: 0000000140002886
SetStretchBltMode.GDI32 ref: 0000000140002897
StretchBlt.GDI32 ref: 00000001400028D3
GetCurrentObject.GDI32 ref: 00000001400028E1
SelectObject.GDI32 ref: 00000001400028F0
SelectObject.GDI32 ref: 00000001400028FC
DeleteDC.GDI32 ref: 0000000140002905
DeleteDC.GDI32 ref: 000000014000290E
ReleaseDC.USER32 ref: 0000000140002919
ReleaseDC.USER32 ref: 0000000140002929
CopyImage.USER32 ref: 000000014000293F

Strings

, xrefs: 00000001400028A1

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Object$Select$CompatibleCreate$DeleteReleaseStretch$BitmapCapsCopyCurrentDeviceImageModeWindow
String ID:
API String ID: 3462224810-3916222277
Opcode ID: 26ade80c2127ac77d3c78208ea6233ae7e265dfd8bd1ee717d6e34b9500d5daf
Instruction ID: e3479925685cc3f49304bd47c1febaaee34c875622ba7d18e675c696bdcfd068
Opcode Fuzzy Hash: 26ade80c2127ac77d3c78208ea6233ae7e265dfd8bd1ee717d6e34b9500d5daf
Instruction Fuzzy Hash: 6741293971075083EB199B23B898B5A7361F789FD5F514129EF4A43B64CF3DD88A8B04

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400046B4 Relevance: 37.1, APIs: 19, Strings: 2, Instructions: 373stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140002F84: ??2@YAPEAX_K@Z.MSVCRT ref: 0000000140002FA1
Part of subcall function 0000000140002F84: ??3@YAXPEAX@Z.MSVCRT ref: 0000000140002FD3

??3@YAXPEAX@Z.MSVCRT ref: 0000000140004C42

Part of subcall function 00000001400011B4: ??2@YAPEAX_K@Z.MSVCRT ref: 00000001400011E7
Part of subcall function 00000001400011B4: ??3@YAXPEAX@Z.MSVCRT ref: 000000014000121C

??3@YAXPEAX@Z.MSVCRT ref: 0000000140004825
??3@YAXPEAX@Z.MSVCRT ref: 000000014000482F
??3@YAXPEAX@Z.MSVCRT ref: 00000001400048D5
??3@YAXPEAX@Z.MSVCRT ref: 00000001400048DD
strncmp.MSVCRT ref: 0000000140004990
strncmp.MSVCRT ref: 00000001400049B6
??3@YAXPEAX@Z.MSVCRT ref: 0000000140004A7C
lstrcmpW.KERNEL32 ref: 0000000140004A9A
lstrlenW.KERNEL32 ref: 0000000140004AD2
wcsncmp.MSVCRT ref: 0000000140004AE1
??2@YAPEAX_K@Z.MSVCRT ref: 0000000140004AFF
??2@YAPEAX_K@Z.MSVCRT ref: 0000000140004B76
??3@YAXPEAX@Z.MSVCRT ref: 0000000140004BBD
??3@YAXPEAX@Z.MSVCRT ref: 0000000140004BC5
??3@YAXPEAX@Z.MSVCRT ref: 0000000140004C07
??3@YAXPEAX@Z.MSVCRT ref: 0000000140004C22
??3@YAXPEAX@Z.MSVCRT ref: 0000000140004C2A
??3@YAXPEAX@Z.MSVCRT ref: 0000000140004C34

Strings

{\rtf, xrefs: 000000014000497F, 00000001400049A5
SetEnvironment, xrefs: 0000000140004A90

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@$??2@$strncmp$lstrcmplstrlenwcsncmp
String ID: SetEnvironment${\rtf
API String ID: 2284649278-318139784
Opcode ID: 3e6a06ef15f6418270d7cb7474b3cfec427e61efad56fe83265623473811b33a
Instruction ID: 791a431dda549a468fad8cbb611fbd05f549aaf6a583b695bbb7d383549a121a
Opcode Fuzzy Hash: 3e6a06ef15f6418270d7cb7474b3cfec427e61efad56fe83265623473811b33a
Instruction Fuzzy Hash: F5F16DB260868486EB62DF17F4903EE67A1F789BC4F544016FB89077AADF38D845CB05

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140004E14 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 291comCOMMON

Download Yara Rule

APIs

_wtol.MSVCRT ref: 0000000140004E42
SHGetSpecialFolderPathW.SHELL32 ref: 0000000140004ED9
??3@YAXPEAX@Z.MSVCRT ref: 0000000140005024
??3@YAXPEAX@Z.MSVCRT ref: 0000000140005031
??3@YAXPEAX@Z.MSVCRT ref: 000000014000503B
??3@YAXPEAX@Z.MSVCRT ref: 0000000140005045
??3@YAXPEAX@Z.MSVCRT ref: 000000014000504F
??3@YAXPEAX@Z.MSVCRT ref: 000000014000505C
??3@YAXPEAX@Z.MSVCRT ref: 0000000140005066
_wtol.MSVCRT ref: 00000001400050E4
CoCreateInstance.OLE32 ref: 00000001400051F5
??3@YAXPEAX@Z.MSVCRT ref: 00000001400052F2
??3@YAXPEAX@Z.MSVCRT ref: 00000001400052FF
??3@YAXPEAX@Z.MSVCRT ref: 0000000140005309
??3@YAXPEAX@Z.MSVCRT ref: 0000000140005311
??3@YAXPEAX@Z.MSVCRT ref: 000000014000531B
??3@YAXPEAX@Z.MSVCRT ref: 0000000140005328
??3@YAXPEAX@Z.MSVCRT ref: 0000000140005332
??3@YAXPEAX@Z.MSVCRT ref: 000000014000533A
??3@YAXPEAX@Z.MSVCRT ref: 0000000140005344

Strings

.lnk, xrefs: 00000001400051BB

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@$_wtol$CreateFolderInstancePathSpecial
String ID: .lnk
API String ID: 408529070-24824748
Opcode ID: b22056eb0ab64836e77ee0fdc3e12ec2d8b5f200aa620c899d7aa0044d9ade5e
Instruction ID: 24e89d9e44830d47bb3e07b84861bb9e379d00b0f26f29bb4731df0a07dd64fb
Opcode Fuzzy Hash: b22056eb0ab64836e77ee0fdc3e12ec2d8b5f200aa620c899d7aa0044d9ade5e
Instruction Fuzzy Hash: 4EE1307221878581DB25EB26F4943EEB365F7C97C1F504015FB8A43AAADF78C815CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400041B0 Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 107windowlibrarystringCOMMON

Download Yara Rule

APIs

GetClassNameA.USER32 ref: 00000001400041D0
lstrcmpiA.KERNEL32 ref: 00000001400041E9
GetWindowLongW.USER32 ref: 00000001400041F9

Part of subcall function 000000014000412C: GetWindowTextLengthW.USER32 ref: 000000014000415F
Part of subcall function 000000014000412C: GetWindowTextW.USER32 ref: 0000000140004187

??3@YAXPEAX@Z.MSVCRT ref: 0000000140004230
GetParent.USER32 ref: 000000014000424F
LoadLibraryA.KERNEL32 ref: 0000000140004264
GetMenu.USER32 ref: 000000014000427A
SetThreadLocale.KERNEL32 ref: 0000000140004288
CreateWindowExW.USER32 ref: 00000001400042E1
DestroyWindow.USER32 ref: 00000001400042F6
SendMessageW.USER32 ref: 000000014000430B
GetSysColor.USER32 ref: 0000000140004316
SendMessageW.USER32 ref: 000000014000432A
SendMessageW.USER32 ref: 0000000140004370
??3@YAXPEAX@Z.MSVCRT ref: 000000014000437E
??3@YAXPEAX@Z.MSVCRT ref: 0000000140004388

Strings

RichEdit20W, xrefs: 00000001400042D2
STATIC, xrefs: 00000001400041DA
{\rtf, xrefs: 0000000140004215
riched20, xrefs: 000000014000425D

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Window$??3@MessageSend$Text$ClassColorCreateDestroyLengthLibraryLoadLocaleLongMenuNameParentThreadlstrcmpi
String ID: RichEdit20W$STATIC$riched20${\rtf
API String ID: 3514532227-2281146334
Opcode ID: 1cea02e449897f8f4e117bd75284b9e339369529b9347a5d78e627892f520267
Instruction ID: 72e38384b6fda40cc7471d1c060dcd74c06f6907f8f39cadb45de74e26403e4b
Opcode Fuzzy Hash: 1cea02e449897f8f4e117bd75284b9e339369529b9347a5d78e627892f520267
Instruction Fuzzy Hash: AC5118B5314A8486EB52DF27F4507AA63A1F78CBC1F544129EB8A47B6ADF3CC9458B00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140002968 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 106windowcommemoryCOMMON

Download Yara Rule

APIs

GetClassNameA.USER32 ref: 0000000140002983
lstrcmpiA.KERNEL32 ref: 000000014000299D
GetWindowLongW.USER32 ref: 00000001400029B1
GetMenu.USER32 ref: 00000001400029C2

Part of subcall function 0000000140002640: GetModuleHandleW.KERNEL32 ref: 0000000140002664
Part of subcall function 0000000140002640: FindResourceExA.KERNEL32 ref: 000000014000267E
Part of subcall function 0000000140002640: FindResourceExA.KERNEL32 ref: 000000014000269A
Part of subcall function 0000000140002640: SizeofResource.KERNEL32 ref: 00000001400026B3
Part of subcall function 0000000140002640: LoadResource.KERNEL32 ref: 00000001400026C5
Part of subcall function 0000000140002640: LockResource.KERNEL32 ref: 00000001400026D3

GlobalAlloc.KERNEL32 ref: 0000000140002A04
memcpy.MSVCRT ref: 0000000140002A1B
CoInitialize.OLE32 ref: 0000000140002A22
CreateStreamOnHGlobal.OLE32 ref: 0000000140002A35
OleLoadPicture.OLEAUT32 ref: 0000000140002A6A
GlobalFree.KERNEL32 ref: 0000000140002A81

Part of subcall function 0000000140002798: GetWindowDC.USER32 ref: 00000001400027BD
Part of subcall function 0000000140002798: GetDeviceCaps.GDI32 ref: 00000001400027CE
Part of subcall function 0000000140002798: MulDiv.KERNEL32 ref: 00000001400027E7
Part of subcall function 0000000140002798: GetObjectW.GDI32 ref: 0000000140002823
Part of subcall function 0000000140002798: MulDiv.KERNEL32 ref: 0000000140002832
Part of subcall function 0000000140002798: MulDiv.KERNEL32 ref: 0000000140002843
Part of subcall function 0000000140002798: CreateCompatibleDC.GDI32 ref: 000000014000284E
Part of subcall function 0000000140002798: CreateCompatibleDC.GDI32 ref: 000000014000285A
Part of subcall function 0000000140002798: SelectObject.GDI32 ref: 0000000140002869
Part of subcall function 0000000140002798: CreateCompatibleBitmap.GDI32 ref: 000000014000287A
Part of subcall function 0000000140002798: SelectObject.GDI32 ref: 0000000140002886
Part of subcall function 0000000140002798: SetStretchBltMode.GDI32 ref: 0000000140002897
Part of subcall function 0000000140002798: StretchBlt.GDI32 ref: 00000001400028D3
Part of subcall function 0000000140002798: GetCurrentObject.GDI32 ref: 00000001400028E1
Part of subcall function 0000000140002798: SelectObject.GDI32 ref: 00000001400028F0
Part of subcall function 0000000140002798: SelectObject.GDI32 ref: 00000001400028FC
Part of subcall function 0000000140002798: DeleteDC.GDI32 ref: 0000000140002905
Part of subcall function 0000000140002798: DeleteDC.GDI32 ref: 000000014000290E
Part of subcall function 0000000140002798: ReleaseDC.USER32 ref: 0000000140002919

GetObjectW.GDI32 ref: 0000000140002AD3
SetWindowPos.USER32 ref: 0000000140002AFC
SendMessageW.USER32 ref: 0000000140002B15
GlobalFree.KERNEL32 ref: 0000000140002B30

Strings

STATIC, xrefs: 0000000140002991
IMAGES, xrefs: 00000001400029D0

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Object$Resource$CreateGlobalSelect$CompatibleWindow$DeleteFindFreeLoadStretch$AllocBitmapCapsClassCurrentDeviceHandleInitializeLockLongMenuMessageModeModuleNamePictureReleaseSendSizeofStreamlstrcmpimemcpy
String ID: IMAGES$STATIC
API String ID: 4202116410-1168396491
Opcode ID: 994f66225cb16ce21fdac055c8b6c01be2faff5d1ebffc34b565adef7fd54e96
Instruction ID: b4b4f888654b6f795b9f0930c28b5f26d58917c648ba98f01d9a8093a39e4dfe
Opcode Fuzzy Hash: 994f66225cb16ce21fdac055c8b6c01be2faff5d1ebffc34b565adef7fd54e96
Instruction Fuzzy Hash: 3A411B72205A9182EB26DF66F4547DA73A0FB8DBC5F444026EB4E47B64DF3CC9498B00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000D08C Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014000CC74: GetDlgItem.USER32 ref: 000000014000CC8D
Part of subcall function 000000014000CC74: GetSystemDirectoryW.KERNEL32 ref: 000000014000CCE6
Part of subcall function 000000014000CC74: SHGetFileInfoW.SHELL32 ref: 000000014000CD09
Part of subcall function 000000014000CC74: GetDlgItem.USER32 ref: 000000014000CD21
Part of subcall function 000000014000CC74: SetWindowLongPtrW.USER32 ref: 000000014000CD36

Part of subcall function 000000014000A8D4: GetDlgItem.USER32 ref: 000000014000A8E7
Part of subcall function 000000014000A8D4: ShowWindow.USER32 ref: 000000014000A8FC

GetDlgItem.USER32 ref: 000000014000D0BE

Part of subcall function 00000001400025E0: GetParent.USER32 ref: 00000001400025F5
Part of subcall function 00000001400025E0: GetWindowRect.USER32 ref: 0000000140002609
Part of subcall function 00000001400025E0: ScreenToClient.USER32 ref: 0000000140002615
Part of subcall function 00000001400025E0: ScreenToClient.USER32 ref: 0000000140002622

GetDlgItem.USER32 ref: 000000014000D0DA
GetDlgItem.USER32 ref: 000000014000D0F3
DestroyWindow.USER32 ref: 000000014000D0FC
CreateWindowExA.USER32 ref: 000000014000D15E
SendMessageW.USER32 ref: 000000014000D172
GetDlgItem.USER32 ref: 000000014000D181
SendMessageW.USER32 ref: 000000014000D197
GetDlgItem.USER32 ref: 000000014000D1A3
SetFocus.USER32 ref: 000000014000D1AC

Strings

Edit, xrefs: 000000014000D14C

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Item$Window$ClientMessageScreenSend$CreateDestroyDirectoryFileFocusInfoLongParentRectShowSystem
String ID: Edit
API String ID: 2208078884-554135844
Opcode ID: 014029fb9c0f5c798ac95976c8b3edb8470af2b959fc17a496693b0b21a1a8e9
Instruction ID: 4f0148b2ab78eff773b92db9013aa9c41d0a2ae55cdefcb65806dfae56bf3756
Opcode Fuzzy Hash: 014029fb9c0f5c798ac95976c8b3edb8470af2b959fc17a496693b0b21a1a8e9
Instruction Fuzzy Hash: 5C31233A714B9083EB15DB22F45478AB361F78DBC4F508119EF9A03B29CF38D8558B40

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000B1A0 Relevance: 16.6, APIs: 11, Instructions: 91windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 000000014000B1C3
GetWindowLongPtrW.USER32 ref: 000000014000B1D1
DefWindowProcW.USER32 ref: 000000014000B1EA
CallWindowProcW.USER32 ref: 000000014000B20C
GetSystemMetrics.USER32 ref: 000000014000B221
GetSystemMetrics.USER32 ref: 000000014000B22F
GetWindowDC.USER32 ref: 000000014000B24D
GetWindowRect.USER32 ref: 000000014000B25E
DrawIconEx.USER32 ref: 000000014000B2AD
ReleaseDC.USER32 ref: 000000014000B2B9

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Window$MetricsProcSystem$CallDrawIconLongParentRectRelease
String ID:
API String ID: 2586545124-0
Opcode ID: 490ed51eca46437f8bc29aea8fc558295c222f8e5612c212394ff57848fc6a8b
Instruction ID: 2e74cc92aef88ab80e538159a8b4db3f0932fda3956a3122f2ef86bd2256572e
Opcode Fuzzy Hash: 490ed51eca46437f8bc29aea8fc558295c222f8e5612c212394ff57848fc6a8b
Instruction Fuzzy Hash: 89316B75604A4086E711DF6BB9447AEA7A1F78DBD5F140228FF8A47B68CF7CD8458B00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140005364 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 156COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 000000014000548A
??3@YAXPEAX@Z.MSVCRT ref: 00000001400054EB
wsprintfA.USER32 ref: 000000014000550A
wsprintfA.USER32 ref: 000000014000553E

Strings

:%hs, xrefs: 00000001400054FB
:Language:%u, xrefs: 000000014000552F
;!@InstallEnd@!, xrefs: 00000001400053F5
;!@Install@!UTF-8!, xrefs: 00000001400053A7

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@wsprintf
String ID: :%hs$:Language:%u$;!@Install@!UTF-8!$;!@InstallEnd@!
API String ID: 3815514257-695273242
Opcode ID: f34f66f1e3866e49f017d88cc1823a54f02a6a53f8bca56b665e03616c298efa
Instruction ID: 8c688fbb0041d26bc6ae15155a462ee40b73d92bd5ee55008e43259a9ea6384f
Opcode Fuzzy Hash: f34f66f1e3866e49f017d88cc1823a54f02a6a53f8bca56b665e03616c298efa
Instruction Fuzzy Hash: 1C61B0B261468486DB22EF2BE4503DA7B65F34DFC8F449012FF8917726CA39D956C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000A6C4 Relevance: 12.0, APIs: 8, Instructions: 45windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 000000014000A6E2
SendMessageW.USER32 ref: 000000014000A6FB
GetDlgItem.USER32 ref: 000000014000A70A
SendMessageW.USER32 ref: 000000014000A71E
SendMessageW.USER32 ref: 000000014000A733
GetDlgItem.USER32 ref: 000000014000A73F
SendMessageW.USER32 ref: 000000014000A753
GetDlgItem.USER32 ref: 000000014000A75F

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ItemMessageSend
String ID:
API String ID: 3015471070-0
Opcode ID: 73fba6efa1d381fd05114ef084849e85003ff514f7a0caefc0f587df7393576e
Instruction ID: 31a53a71e8ff25a84de4a2e277adbe73aab4cca00721c47dcf2059183477464c
Opcode Fuzzy Hash: 73fba6efa1d381fd05114ef084849e85003ff514f7a0caefc0f587df7393576e
Instruction Fuzzy Hash: 69112739310AA08BE7159F93F8547AA7221FB8CFC5F549029AF5A43B25DF38D8558B00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140018D70 Relevance: 11.4, APIs: 9, Instructions: 114COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 0000000140018D9F
memcmp.MSVCRT ref: 0000000140018DC8
memcmp.MSVCRT ref: 0000000140018DDE
memcmp.MSVCRT ref: 0000000140018E09
memcmp.MSVCRT ref: 0000000140018E25
memcmp.MSVCRT ref: 0000000140018E41
memcmp.MSVCRT ref: 0000000140018E5D
memcmp.MSVCRT ref: 0000000140018E7C
memcmp.MSVCRT ref: 0000000140018EC2

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: bdee6421f3acc97bff90778bedd7deafc2201c4f350093a814738972457288ea
Instruction ID: fc41c3f96601c974f21c35de1e6372b8c10fcc77abb64dbd8f6502eb97a410b8
Opcode Fuzzy Hash: bdee6421f3acc97bff90778bedd7deafc2201c4f350093a814738972457288ea
Instruction Fuzzy Hash: 7E410871208B8195FB669F27E8403D823A5A76DFC4FD45025EF094B6BAEF7ACA158304

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400058E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400011B4: ??2@YAPEAX_K@Z.MSVCRT ref: 00000001400011E7
Part of subcall function 00000001400011B4: ??3@YAXPEAX@Z.MSVCRT ref: 000000014000121C

??3@YAXPEAX@Z.MSVCRT ref: 000000014000598E
??3@YAXPEAX@Z.MSVCRT ref: 0000000140005A14
??3@YAXPEAX@Z.MSVCRT ref: 0000000140005A3F

Strings

%%T/, xrefs: 00000001400059EC
%%T\, xrefs: 0000000140005966
%%T, xrefs: 0000000140005A19

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@$??2@
String ID: %%T$%%T/$%%T\
API String ID: 4113381792-3604420949
Opcode ID: c895a83202c509a649527651f62f40fa79b642c8f5e3fe230110cb5a11ebf478
Instruction ID: e469b74e8fe9b479cde82999b7ae5f247f4a7a0e88f31417278b6bcc544b8959
Opcode Fuzzy Hash: c895a83202c509a649527651f62f40fa79b642c8f5e3fe230110cb5a11ebf478
Instruction Fuzzy Hash: B541ED72224A8492DB62DF16E4913EA6370F789BD5F805112FB8D476A9DF7CCA06CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140005A58 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400011B4: ??2@YAPEAX_K@Z.MSVCRT ref: 00000001400011E7
Part of subcall function 00000001400011B4: ??3@YAXPEAX@Z.MSVCRT ref: 000000014000121C

??3@YAXPEAX@Z.MSVCRT ref: 0000000140005B06
??3@YAXPEAX@Z.MSVCRT ref: 0000000140005B8C
??3@YAXPEAX@Z.MSVCRT ref: 0000000140005BB7

Strings

%%S, xrefs: 0000000140005B91
%%S\, xrefs: 0000000140005ADE
%%S/, xrefs: 0000000140005B64

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@$??2@
String ID: %%S$%%S/$%%S\
API String ID: 4113381792-1963631775
Opcode ID: 73edd43c9021fcd5f8b3558ad6a79a065c0e9fee4b8df97bf5d74eaa5836a6b9
Instruction ID: 49a38b35dc0d0dec87a86da54b3c63a361a7ccec6a3f853b3077ed1f92172575
Opcode Fuzzy Hash: 73edd43c9021fcd5f8b3558ad6a79a065c0e9fee4b8df97bf5d74eaa5836a6b9
Instruction Fuzzy Hash: F841EFB2224A8492DB62DF16E4913EA7370F789BD4F805111FB8D476A9DF7CCA06CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140005BD0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400011B4: ??2@YAPEAX_K@Z.MSVCRT ref: 00000001400011E7
Part of subcall function 00000001400011B4: ??3@YAXPEAX@Z.MSVCRT ref: 000000014000121C

??3@YAXPEAX@Z.MSVCRT ref: 0000000140005C7E
??3@YAXPEAX@Z.MSVCRT ref: 0000000140005D04
??3@YAXPEAX@Z.MSVCRT ref: 0000000140005D2F

Strings

%%M, xrefs: 0000000140005D09
%%M/, xrefs: 0000000140005CDC
%%M\, xrefs: 0000000140005C56

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@$??2@
String ID: %%M$%%M/$%%M\
API String ID: 4113381792-1781175070
Opcode ID: 874374037690d482bc113b8387e9d7bce76618d6be31f5e877464607cfeae7d3
Instruction ID: 036440d789ba74a1504259e4adc1bf36919ffb3eeb76309873cc29438444da5f
Opcode Fuzzy Hash: 874374037690d482bc113b8387e9d7bce76618d6be31f5e877464607cfeae7d3
Instruction Fuzzy Hash: 3A41F07222468492DB62DF16E4913EA6370F7C9BD4F405111FB8D476A9DF7CCA06CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000BEA8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 000000014000B4B4: GetSystemMetrics.USER32 ref: 000000014000B4E3
Part of subcall function 000000014000B4B4: GetSystemMetrics.USER32 ref: 000000014000B4EF
Part of subcall function 000000014000B4B4: GetDlgItem.USER32 ref: 000000014000B54F

GetSystemMetrics.USER32 ref: 000000014000BEBB
GetSystemMetrics.USER32 ref: 000000014000BED3
GetDlgItem.USER32 ref: 000000014000BF38
GetDlgItem.USER32 ref: 000000014000BFA9
??3@YAXPEAX@Z.MSVCRT ref: 000000014000BFD7

Strings

100%% , xrefs: 000000014000BEFB, 000000014000BF6D

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MetricsSystem$Item$??3@
String ID: 100%%
API String ID: 1133332389-568723177
Opcode ID: 89b7c521e17bd2ea40451f682f150fb257f2283d3bc3e302c92a80b929b6d9aa
Instruction ID: b7e5cbe1fcc40e9654c76361201d91b8f33cf6de00aee79a88ea99a43c7760db
Opcode Fuzzy Hash: 89b7c521e17bd2ea40451f682f150fb257f2283d3bc3e302c92a80b929b6d9aa
Instruction Fuzzy Hash: 44413DB261464687EB52DF3AE8443A933B1F78CB98F115115FB4A472A9DF38CC44CB44

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000C2E8 Relevance: 10.6, APIs: 7, Instructions: 54threadtimeinjectionCOMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 000000014000C304
KillTimer.USER32 ref: 000000014000C31C
SetTimer.USER32 ref: 000000014000C354
SuspendThread.KERNEL32 ref: 000000014000C372
ResumeThread.KERNEL32 ref: 000000014000C391
TerminateThread.KERNEL32 ref: 000000014000C3AB
EndDialog.USER32 ref: 000000014000C3B7

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Thread$DialogTimer$KillResumeSuspendTerminate
String ID:
API String ID: 815346346-0
Opcode ID: fac7d4e5942cdb2efa8289fbc360c5cf8d272b5be83eb2dbf073c8ebca295cbe
Instruction ID: 83f87d55712751966222477489a7d7af00309a825a222f7cadbb10011fa9f1b3
Opcode Fuzzy Hash: fac7d4e5942cdb2efa8289fbc360c5cf8d272b5be83eb2dbf073c8ebca295cbe
Instruction Fuzzy Hash: DE210871221A0086FB16DB27F954BE873A1EB9CBD5F058119EB464B6B6CB798C848740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400122E0 Relevance: 9.2, APIs: 5, Strings: 1, Instructions: 240COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00000001400124CA
memset.MSVCRT ref: 00000001400124DF

Part of subcall function 00000001400117E0: memset.MSVCRT ref: 00000001400117FD
Part of subcall function 00000001400117E0: memset.MSVCRT ref: 00000001400118EB

memset.MSVCRT ref: 0000000140012658
memcpy.MSVCRT ref: 0000000140012690
memcpy.MSVCRT ref: 00000001400126AC

Strings

MZ`, xrefs: 00000001400122F9

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: memset$memcpy
String ID: MZ`
API String ID: 368790112-2330268423
Opcode ID: 51d7a50a57a273631c60acd70143d91eec59d02dadd8de15fed89084a2fb2e4d
Instruction ID: a60bcc020994de79551979a6d8ccac49ac24f225807f4328ce31d9b90e429d21
Opcode Fuzzy Hash: 51d7a50a57a273631c60acd70143d91eec59d02dadd8de15fed89084a2fb2e4d
Instruction Fuzzy Hash: 30B1C6323047C0A7EB29CB26E5543EE77A1F384384F40011ADB994BB96DB3AE479CB10

Uniqueness

Uniqueness Score: -1.00%

Function 000000014001F8EC Relevance: 9.2, APIs: 6, Instructions: 219COMMON

Download Yara Rule

APIs

Part of subcall function 000000014001E110: _CxxThrowException.MSVCRT ref: 000000014001E133

Part of subcall function 0000000140018588: _CxxThrowException.MSVCRT ref: 00000001400185C0
Part of subcall function 0000000140018588: _CxxThrowException.MSVCRT ref: 00000001400185F0
Part of subcall function 0000000140018588: ??2@YAPEAX_K@Z.MSVCRT ref: 0000000140018600
Part of subcall function 0000000140018588: _CxxThrowException.MSVCRT ref: 0000000140018621
Part of subcall function 0000000140018588: memcpy.MSVCRT ref: 000000014001863F
Part of subcall function 0000000140018588: ??3@YAXPEAX@Z.MSVCRT ref: 0000000140018648

??2@YAPEAX_K@Z.MSVCRT ref: 000000014001F956
??3@YAXPEAX@Z.MSVCRT ref: 000000014001F994

Part of subcall function 000000014001F67C: ??3@YAXPEAX@Z.MSVCRT ref: 000000014001F6AE
Part of subcall function 000000014001F67C: memcpy.MSVCRT ref: 000000014001F6DB

_CxxThrowException.MSVCRT ref: 000000014001FB12
_CxxThrowException.MSVCRT ref: 000000014001FB30
_CxxThrowException.MSVCRT ref: 000000014001FB4E
_CxxThrowException.MSVCRT ref: 000000014001FBD1

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionThrow$??3@$??2@memcpy
String ID:
API String ID: 4165819386-0
Opcode ID: 59f6a0a09a6be052dd6f5c788b1b62940a7cbd88e93632abd6137a59a78e0898
Instruction ID: 2b5d6d984cd06daa418e5c0a5a9a762c666e23ebcf80e84a58ed1ddde5e58561
Opcode Fuzzy Hash: 59f6a0a09a6be052dd6f5c788b1b62940a7cbd88e93632abd6137a59a78e0898
Instruction Fuzzy Hash: 89919C7220478496EA32AB26D5943EE7360F78D7D4F400526EF8E4BBA6DF3AC415C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000FED0 Relevance: 9.2, APIs: 6, Instructions: 153COMMON

Download Yara Rule

APIs

??2@YAPEAX_K@Z.MSVCRT ref: 000000014000FFDE
??3@YAXPEAX@Z.MSVCRT ref: 000000014001001E
??2@YAPEAX_K@Z.MSVCRT ref: 0000000140010037
memcpy.MSVCRT ref: 0000000140010059
??3@YAXPEAX@Z.MSVCRT ref: 0000000140010063
memcpy.MSVCRT ref: 000000014001007B

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??2@??3@memcpy
String ID:
API String ID: 1695611338-0
Opcode ID: 2e78267f0e2a1844cc7d10f9070972ae4aeb5c867ba33dc774102358213e8df7
Instruction ID: 8c6f33eece85ed00ead372061efc94821a02db55b8ae8b4f8ffe1b14aa20cf6c
Opcode Fuzzy Hash: 2e78267f0e2a1844cc7d10f9070972ae4aeb5c867ba33dc774102358213e8df7
Instruction Fuzzy Hash: 025185B2201B908AEB66CF27E5407A977A0F70EBC4F148116EF8D17B55EB76D9A0C300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140018588 Relevance: 9.1, APIs: 6, Instructions: 58COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 00000001400185C0
_CxxThrowException.MSVCRT ref: 00000001400185F0
??2@YAPEAX_K@Z.MSVCRT ref: 0000000140018600
_CxxThrowException.MSVCRT ref: 0000000140018621
memcpy.MSVCRT ref: 000000014001863F
??3@YAXPEAX@Z.MSVCRT ref: 0000000140018648

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionThrow$??2@??3@memcpy
String ID:
API String ID: 343384133-0
Opcode ID: e8ddff8425364dc01404ccdc1c2417ed8c61eaea6b6999d5b829b3357c549c38
Instruction ID: 556e7273d66f44b3c971e55782d9f332f452dc05b110076726e16249fbe281d8
Opcode Fuzzy Hash: e8ddff8425364dc01404ccdc1c2417ed8c61eaea6b6999d5b829b3357c549c38
Instruction Fuzzy Hash: 0F21AC72201B8481EB1ADB16D481389B7A5E78CBC4F54841AEF0917BBACB79CE86C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140007BE0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 0000000140007C8C
??3@YAXPEAX@Z.MSVCRT ref: 0000000140007D5D
??3@YAXPEAX@Z.MSVCRT ref: 0000000140007D78

Strings

;!@InstallEnd@!, xrefs: 0000000140007D21
;!@Install@!UTF-8!, xrefs: 0000000140007CFF

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@
String ID: ;!@Install@!UTF-8!$;!@InstallEnd@!
API String ID: 613200358-372238525
Opcode ID: ba4bf318911b61b27174c485e5dbc8b030d162f0f7d4bef85cfb33322df9d48c
Instruction ID: 1a55262f4ed05b6dd80ccd456cbc08e3c16c2dd83afbbdc52573331cd0ecb865
Opcode Fuzzy Hash: ba4bf318911b61b27174c485e5dbc8b030d162f0f7d4bef85cfb33322df9d48c
Instruction Fuzzy Hash: 6F514C72614A8582EB22DB12F4403EAA7A1F7DD7D8F541216FB8D476AADB3CC605CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140001000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 000000014000106B
wsprintfW.USER32 ref: 0000000140001089
lstrcatW.KERNEL32 ref: 000000014000109C
ExitProcess.KERNEL32 ref: 00000001400010C5

Strings

0x%p, xrefs: 000000014000107D

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: wsprintf$ExitProcesslstrcat
String ID: 0x%p
API String ID: 2530384128-1745605757
Opcode ID: 7ca85961a432858a5287f958acff3f5db72a40daf6c0b412f97bcf7cdbf9e76d
Instruction ID: cd6256386a8921e0c9af8c1830ea2bd67bb414ca23f1f90368618b702708356c
Opcode Fuzzy Hash: 7ca85961a432858a5287f958acff3f5db72a40daf6c0b412f97bcf7cdbf9e76d
Instruction Fuzzy Hash: BC212C72600A8692EB22DF62F4543D93370F78C7C4F804129AB89037B6EF78C995CB90

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000BAF8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400011B4: ??2@YAPEAX_K@Z.MSVCRT ref: 00000001400011E7
Part of subcall function 00000001400011B4: ??3@YAXPEAX@Z.MSVCRT ref: 000000014000121C

wsprintfW.USER32 ref: 000000014000BB6F
GetDlgItem.USER32 ref: 000000014000BB90
SetWindowTextW.USER32 ref: 000000014000BB9F
??3@YAXPEAX@Z.MSVCRT ref: 000000014000BBB0

Strings

(%d%s), xrefs: 000000014000BB60

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@$??2@ItemTextWindowwsprintf
String ID: (%d%s)
API String ID: 19352476-2087557067
Opcode ID: 1825c6a26f529c68f805ab4c91239c72c2ecf6dde0a12904335fa9f47149b37d
Instruction ID: c2757bb1cdb7cf1ca0d98992e28b2c5cd1b96b09125c558baacd838e6025e105
Opcode Fuzzy Hash: 1825c6a26f529c68f805ab4c91239c72c2ecf6dde0a12904335fa9f47149b37d
Instruction Fuzzy Hash: 7C21297221468586DB21EF22E4543AA7371FB89BC9F404116FB894BBA9DB3CC946CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000AF14 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 000000014000AF28
GetProcAddress.KERNEL32 ref: 000000014000AF3D
GetWindow.USER32 ref: 000000014000AF71

Strings

SetWindowTheme, xrefs: 000000014000AF33
uxtheme, xrefs: 000000014000AF21

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: AddressLibraryLoadProcWindow
String ID: SetWindowTheme$uxtheme
API String ID: 1082215438-1369271589
Opcode ID: c6d65d4fa7152fdce7dde2593b2eef2279cb1bd3d455aa975498c23a32524551
Instruction ID: 6af782595d2ee8e2db10cdec27669aa385ef22b8cd850645ad57599461334a59
Opcode Fuzzy Hash: c6d65d4fa7152fdce7dde2593b2eef2279cb1bd3d455aa975498c23a32524551
Instruction Fuzzy Hash: 90F0F9B0305A4191EE46DB63F8847E963A1AB4DBC0F585039BB1E07375EE3CD949C304

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000666C Relevance: 7.6, APIs: 5, Instructions: 82stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 000000014000669E
??3@YAXPEAX@Z.MSVCRT ref: 000000014000675C
??3@YAXPEAX@Z.MSVCRT ref: 0000000140006766
??3@YAXPEAX@Z.MSVCRT ref: 0000000140006777
??3@YAXPEAX@Z.MSVCRT ref: 0000000140006781

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@$lstrlen
String ID:
API String ID: 2031685711-0
Opcode ID: 1c491dae6de06989a6d5025431ad05d51f6dad52472c1ca85a72efcfe3cb2044
Instruction ID: 0225852f7739b59731079178c557d6fe29928151f651f0b8a3b4baeb13dceb14
Opcode Fuzzy Hash: 1c491dae6de06989a6d5025431ad05d51f6dad52472c1ca85a72efcfe3cb2044
Instruction Fuzzy Hash: 7F31ABB2208A4481EB22DF22F4913EA63A1F788BC8F548026FF8D576B5DF7DC9458741

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000BBC8 Relevance: 7.6, APIs: 5, Instructions: 78timeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 000000014000BC2F
??3@YAXPEAX@Z.MSVCRT ref: 000000014000BC8F
GetDlgItem.USER32 ref: 000000014000BCB2
??3@YAXPEAX@Z.MSVCRT ref: 000000014000BCD9
SetTimer.USER32 ref: 000000014000BCEF

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@Item$Timer
String ID:
API String ID: 4119539950-0
Opcode ID: 5c11db411503e0c00aeee3160634f6f9f645a4baea3db4e6eb0d38535d48a5c0
Instruction ID: c2d0fc6287c4ea12be7244f7d32978afc2790e5f7a47df7677f85223577b785c
Opcode Fuzzy Hash: 5c11db411503e0c00aeee3160634f6f9f645a4baea3db4e6eb0d38535d48a5c0
Instruction Fuzzy Hash: 58314C7260064182EB21DB17F4503AAA3A1F7DDBD8F148125EB89477B5DF7CC942CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000FCB0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 000000014000FCF6
??2@YAPEAX_K@Z.MSVCRT ref: 000000014000FD19
memcpy.MSVCRT ref: 000000014000FD3B
??3@YAXPEAX@Z.MSVCRT ref: 000000014000FD45
memcpy.MSVCRT ref: 000000014000FD63

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@memcpy$??2@
String ID:
API String ID: 2407475205-0
Opcode ID: c477fd48c61382c83461375b2eb5a96fef6fd05e31e531dd5e93dc0fc9132f3a
Instruction ID: e1dcb932aeda8c14b221736b077e349d8edf68299e8cb47a1b2510dda04a765b
Opcode Fuzzy Hash: c477fd48c61382c83461375b2eb5a96fef6fd05e31e531dd5e93dc0fc9132f3a
Instruction Fuzzy Hash: B831C2B6211B5486DB55CF26E98035873B8F34CFD4B24522AEF8D43B68DB35D8A2C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000CC74 Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 000000014000CC8D

Part of subcall function 00000001400025E0: GetParent.USER32 ref: 00000001400025F5
Part of subcall function 00000001400025E0: GetWindowRect.USER32 ref: 0000000140002609
Part of subcall function 00000001400025E0: ScreenToClient.USER32 ref: 0000000140002615
Part of subcall function 00000001400025E0: ScreenToClient.USER32 ref: 0000000140002622

Part of subcall function 000000014000A8D4: GetDlgItem.USER32 ref: 000000014000A8E7
Part of subcall function 000000014000A8D4: ShowWindow.USER32 ref: 000000014000A8FC

GetSystemDirectoryW.KERNEL32 ref: 000000014000CCE6
SHGetFileInfoW.SHELL32 ref: 000000014000CD09
GetDlgItem.USER32 ref: 000000014000CD21
SetWindowLongPtrW.USER32 ref: 000000014000CD36

Part of subcall function 000000014000C7F4: GetModuleHandleW.KERNEL32 ref: 000000014000C832
Part of subcall function 000000014000C7F4: LoadIconW.USER32 ref: 000000014000C83E
Part of subcall function 000000014000C7F4: GetSystemMetrics.USER32 ref: 000000014000C84B
Part of subcall function 000000014000C7F4: GetSystemMetrics.USER32 ref: 000000014000C857
Part of subcall function 000000014000C7F4: GetModuleHandleW.KERNEL32 ref: 000000014000C861
Part of subcall function 000000014000C7F4: LoadImageW.USER32 ref: 000000014000C87C
Part of subcall function 000000014000C7F4: SendMessageW.USER32 ref: 000000014000C89C
Part of subcall function 000000014000C7F4: SendMessageW.USER32 ref: 000000014000C8AE
Part of subcall function 000000014000C7F4: GetDlgItem.USER32 ref: 000000014000C8CD
Part of subcall function 000000014000C7F4: GetDlgItem.USER32 ref: 000000014000C8DF
Part of subcall function 000000014000C7F4: GetWindowLongPtrW.USER32 ref: 000000014000C8F2
Part of subcall function 000000014000C7F4: SetWindowLongPtrW.USER32 ref: 000000014000C905
Part of subcall function 000000014000C7F4: GetDlgItem.USER32 ref: 000000014000C916
Part of subcall function 000000014000C7F4: GetDlgItem.USER32 ref: 000000014000C925
Part of subcall function 000000014000C7F4: GetWindowLongPtrW.USER32 ref: 000000014000C933
Part of subcall function 000000014000C7F4: SetWindowLongPtrW.USER32 ref: 000000014000C946
Part of subcall function 000000014000C7F4: GetDlgItem.USER32 ref: 000000014000C959
Part of subcall function 000000014000C7F4: SetWindowTextW.USER32 ref: 000000014000C968

Part of subcall function 000000014000B660: GetDlgItem.USER32 ref: 000000014000B67B
Part of subcall function 000000014000B660: SetFocus.USER32 ref: 000000014000B684
Part of subcall function 000000014000B660: GetDlgItem.USER32 ref: 000000014000B69A
Part of subcall function 000000014000B660: SetWindowTextW.USER32 ref: 000000014000B6A9
Part of subcall function 000000014000B660: GetDlgItem.USER32 ref: 000000014000B6C7

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Item$Window$Long$System$ClientHandleLoadMessageMetricsModuleScreenSendText$DirectoryFileFocusIconImageInfoParentRectShow
String ID:
API String ID: 1138730274-0
Opcode ID: 91bd0922984f6835392c0161a47438b2b6cbb55ba6e04e19c88928f38cb9d400
Instruction ID: 4afe2f3a4d1ee666d08244dac2c432b85ba429c63bcf4d4053467f648740bf3e
Opcode Fuzzy Hash: 91bd0922984f6835392c0161a47438b2b6cbb55ba6e04e19c88928f38cb9d400
Instruction Fuzzy Hash: C5218C76704A8582EB11DB26F9843DAB361FB8CBC4F504025AF4A43BA5DF3CC9168B00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000C6EC Relevance: 7.5, APIs: 5, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000000014000C708
SetWindowsHookExW.USER32 ref: 000000014000C71E

Part of subcall function 000000014000BAF8: wsprintfW.USER32 ref: 000000014000BB6F
Part of subcall function 000000014000BAF8: GetDlgItem.USER32 ref: 000000014000BB90
Part of subcall function 000000014000BAF8: SetWindowTextW.USER32 ref: 000000014000BB9F
Part of subcall function 000000014000BAF8: ??3@YAXPEAX@Z.MSVCRT ref: 000000014000BBB0

GetCurrentThreadId.KERNEL32 ref: 000000014000C734
SetWindowsHookExW.USER32 ref: 000000014000C74B
EndDialog.USER32 ref: 000000014000C779

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: CurrentHookThreadWindows$??3@DialogItemTextWindowwsprintf
String ID:
API String ID: 3524378390-0
Opcode ID: dc8895ad33046bf98ae5a62232f52f7fa6a9317188c46a6017a1b357d453a923
Instruction ID: 2ed6bbf3eb8795f5216fde1e4314f4f225e52507604333b267f4148385a72a33
Opcode Fuzzy Hash: dc8895ad33046bf98ae5a62232f52f7fa6a9317188c46a6017a1b357d453a923
Instruction Fuzzy Hash: 0B1179B6215A4482EB12EB27F848BD833A0F75CBC8F114018E71A03AB1DF789898CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002378C Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000001400237C3
GetCurrentProcessId.KERNEL32 ref: 00000001400237CE
GetCurrentThreadId.KERNEL32 ref: 00000001400237DA
GetTickCount.KERNEL32 ref: 00000001400237E6
QueryPerformanceCounter.KERNEL32 ref: 00000001400237F7

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: a880cda3cb84ba9258de0f8a5bfb240fcdc2ae1ef1647e9d9b2b24c99fef0d51
Instruction ID: 6ccee3a3a539053538efcd8899d491f1a7117339fbd9e74b0a102491421af6c2
Opcode Fuzzy Hash: a880cda3cb84ba9258de0f8a5bfb240fcdc2ae1ef1647e9d9b2b24c99fef0d51
Instruction Fuzzy Hash: 25012931265A4482EB928F22F8843D57360F74DBD4F456628FF5E4BBB4DA38CD998700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000B660 Relevance: 7.5, APIs: 5, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 000000014000B67B
SetFocus.USER32 ref: 000000014000B684
GetDlgItem.USER32 ref: 000000014000B69A
SetWindowTextW.USER32 ref: 000000014000B6A9

Part of subcall function 0000000140005D88: ??3@YAXPEAX@Z.MSVCRT ref: 0000000140005DE3
Part of subcall function 0000000140005D88: ??3@YAXPEAX@Z.MSVCRT ref: 0000000140005DED
Part of subcall function 0000000140005D88: SetWindowTextW.USER32 ref: 0000000140005DFA
Part of subcall function 0000000140005D88: ??3@YAXPEAX@Z.MSVCRT ref: 0000000140005E07

GetDlgItem.USER32 ref: 000000014000B6C7

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@Item$TextWindow$Focus
String ID:
API String ID: 1467601455-0
Opcode ID: 84cc39b8c6da9ff15583e7b0b1e1df766a6e73d03c3016cc09b09cef6c3442da
Instruction ID: f32c6ae350f212fba6946d34dd20b6ffccf16695ebf04447abfda4a1d27138ed
Opcode Fuzzy Hash: 84cc39b8c6da9ff15583e7b0b1e1df766a6e73d03c3016cc09b09cef6c3442da
Instruction Fuzzy Hash: 2C01E439601B9082EB15AB53F8543AA7361FB8CFD5F59802AAF5E43B69CE3CD8418700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140003BB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400011B4: ??2@YAPEAX_K@Z.MSVCRT ref: 00000001400011E7
Part of subcall function 00000001400011B4: ??3@YAXPEAX@Z.MSVCRT ref: 000000014000121C

Part of subcall function 0000000140002F84: ??2@YAPEAX_K@Z.MSVCRT ref: 0000000140002FA1
Part of subcall function 0000000140002F84: ??3@YAXPEAX@Z.MSVCRT ref: 0000000140002FD3

Part of subcall function 0000000140003688: MultiByteToWideChar.KERNEL32 ref: 00000001400036ED

??3@YAXPEAX@Z.MSVCRT ref: 0000000140003CF5
??3@YAXPEAX@Z.MSVCRT ref: 0000000140003D14
??3@YAXPEAX@Z.MSVCRT ref: 0000000140003D1C

Strings

X, xrefs: 0000000140003D23

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??3@$??2@$ByteCharMultiWide
String ID: X
API String ID: 319580807-3081909835
Opcode ID: 3060e3ddbb5a66046cc76b1366c3d6e0e27be5e567a6b4b0a147fb46be4641a9
Instruction ID: 5b5cd8eb8d9a394be84bce08e6ce385cb81ab7cfc506db74b41fa3736c061475
Opcode Fuzzy Hash: 3060e3ddbb5a66046cc76b1366c3d6e0e27be5e567a6b4b0a147fb46be4641a9
Instruction Fuzzy Hash: 72518DB660468086DB22DF12E0417DE77A4F78CBC4F508026FB89537AADB38C951CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000B990 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 000000014000B9AB

Part of subcall function 0000000140001100: SHBrowseForFolderW.SHELL32 ref: 000000014000110E

SHGetPathFromIDListW.SHELL32 ref: 000000014000B9E1
SHGetMalloc.SHELL32 ref: 000000014000BA15

Part of subcall function 000000014000B660: GetDlgItem.USER32 ref: 000000014000B67B
Part of subcall function 000000014000B660: SetFocus.USER32 ref: 000000014000B684
Part of subcall function 000000014000B660: GetDlgItem.USER32 ref: 000000014000B69A
Part of subcall function 000000014000B660: SetWindowTextW.USER32 ref: 000000014000B6A9
Part of subcall function 000000014000B660: GetDlgItem.USER32 ref: 000000014000B6C7

Strings

A, xrefs: 000000014000B9BE

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Item$BrowseFocusFolderFromListMallocPathTextWindowmemset
String ID: A
API String ID: 1716548450-3554254475
Opcode ID: 6c7e4313427580dbf2790ced307f3eda4023ce1d053944859fba7b3fef65107a
Instruction ID: 3b16c38e347526199c3c70abaf3893b3f694cb5dd486eda796fea805939d9e8e
Opcode Fuzzy Hash: 6c7e4313427580dbf2790ced307f3eda4023ce1d053944859fba7b3fef65107a
Instruction Fuzzy Hash: 1B112B76705A8482EE65DF12F4843E9A3A0FBC8BC4F444125EB5D43A69DF7CC948CB01

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140010100 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140010119

Part of subcall function 000000014000FED0: ??2@YAPEAX_K@Z.MSVCRT ref: 000000014000FFDE
Part of subcall function 000000014000FED0: ??3@YAXPEAX@Z.MSVCRT ref: 000000014001001E
Part of subcall function 000000014000FED0: ??2@YAPEAX_K@Z.MSVCRT ref: 0000000140010037

??2@YAPEAX_K@Z.MSVCRT ref: 0000000140010166
??2@YAPEAX_K@Z.MSVCRT ref: 00000001400101F4
??2@YAPEAX_K@Z.MSVCRT ref: 0000000140010254

Part of subcall function 000000014000FED0: memcpy.MSVCRT ref: 0000000140010059
Part of subcall function 000000014000FED0: ??3@YAXPEAX@Z.MSVCRT ref: 0000000140010063
Part of subcall function 000000014000FED0: memcpy.MSVCRT ref: 000000014001007B

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ??2@$??3@memcpy$CriticalEnterSection
String ID:
API String ID: 1017973888-0
Opcode ID: cc90200b92cee2bb4d30fea8b75d6bdd50713c0a19fd5b76801b32f42d06977f
Instruction ID: b59ec501bdad7cfb71afe7ee65815f32eb103330be712b5f4d53ce8f8ed15711
Opcode Fuzzy Hash: cc90200b92cee2bb4d30fea8b75d6bdd50713c0a19fd5b76801b32f42d06977f
Instruction Fuzzy Hash: 6E412471200A4091FA62EB23E9513E933A1E75C7C4F844125FF4E4BABAEE79CA45D741

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000C5E4 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

ScreenToClient.USER32 ref: 000000014000C635
GetClientRect.USER32 ref: 000000014000C64B
PtInRect.USER32 ref: 000000014000C659

Part of subcall function 000000014000BD08: KillTimer.USER32 ref: 000000014000BD20

CallNextHookEx.USER32 ref: 000000014000C67E

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ClientRect$CallHookKillNextScreenTimer
String ID:
API String ID: 3015594791-0
Opcode ID: d4e13a6410281f1f6a09a432693b45918f6bf97c599566514008f3ae3b83878b
Instruction ID: ae2fea2a4711727d1841370e253081b473d0f88f786ced071b0fc0ba9d8ce2f7
Opcode Fuzzy Hash: d4e13a6410281f1f6a09a432693b45918f6bf97c599566514008f3ae3b83878b
Instruction Fuzzy Hash: 36111972216A4582EB22DB17F840BA96361F78CBC4F554126FB5D83274DF3AC956C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000FAD0 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

??2@YAPEAX_K@Z.MSVCRT ref: 000000014000FAFB
memcpy.MSVCRT ref: 000000014000FB1D
??3@YAXPEAX@Z.MSVCRT ref: 000000014000FB2B
memcpy.MSVCRT ref: 000000014000FB47

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: memcpy$??2@??3@
String ID:
API String ID: 1252195045-0
Opcode ID: ed690ab9734ccaa0980e5be633517e8d12b6801db14904a6273deacd39c0ab80
Instruction ID: 3019c4301fe5f25c1463b6b73d69c8ffef356320028beaaacfcaee97f1e8da61
Opcode Fuzzy Hash: ed690ab9734ccaa0980e5be633517e8d12b6801db14904a6273deacd39c0ab80
Instruction Fuzzy Hash: 06016932214A9481DB919F13E9403ADA3A5E749FC4F085015FF4907FA9CF38C9428700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000B31C Relevance: 6.0, APIs: 4, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32 ref: 000000014000B343
CreateFontIndirectW.GDI32 ref: 000000014000B35A
GetDlgItem.USER32 ref: 000000014000B371
SendMessageW.USER32 ref: 000000014000B384

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: CreateFontIndirectItemMessageObjectSend
String ID:
API String ID: 2001801573-0
Opcode ID: 6d5e2a21974a0290d11c7cc069466e81e0e3acebe0581a5b81791f05c34418aa
Instruction ID: 5b5f0f544e075b38f7cf9bb66e7d81e952aa3e301a5bb0f5f8535e265778bb14
Opcode Fuzzy Hash: 6d5e2a21974a0290d11c7cc069466e81e0e3acebe0581a5b81791f05c34418aa
Instruction Fuzzy Hash: FB013C76201B8482EB618F52F55479977A0FB8CBC4F188129EF89477A4DF3CC949CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400025E0 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00000001400025F5
GetWindowRect.USER32 ref: 0000000140002609
ScreenToClient.USER32 ref: 0000000140002615
ScreenToClient.USER32 ref: 0000000140002622

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ClientScreen$ParentRectWindow
String ID:
API String ID: 2099118873-0
Opcode ID: 7de5d91b1c8bf6cbd024f117699c573025403ec0b072b76e2df3440ff88d1a8d
Instruction ID: 38c9ab16e3656cf884b3a0d012cb3ee7a59ba000c018e5caaf81826846b1f683
Opcode Fuzzy Hash: 7de5d91b1c8bf6cbd024f117699c573025403ec0b072b76e2df3440ff88d1a8d
Instruction Fuzzy Hash: B7F01C71715B9182EB158B13B84435A6324EB8CFC0F499024EF9A07B69DE3CC8968700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140007164 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 000000014000B810: GetSystemMetrics.USER32 ref: 000000014000B872
Part of subcall function 000000014000B810: GetSystemMetrics.USER32 ref: 000000014000B888

wsprintfW.USER32 ref: 0000000140007221
??3@YAXPEAX@Z.MSVCRT ref: 0000000140007270

Strings

%X - %03X - %03X - %03X - %03X, xrefs: 00000001400071F6

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MetricsSystem$??3@wsprintf
String ID: %X - %03X - %03X - %03X - %03X
API String ID: 1174869416-1993364030
Opcode ID: 376463cde95f503065a0372f77d04eb21846589c3f58d58d4a90efb5eb6e9f57
Instruction ID: 43316a8ab08d6cdf5443f45d8848dbdc911347861ce22d0c71f5014197a009eb
Opcode Fuzzy Hash: 376463cde95f503065a0372f77d04eb21846589c3f58d58d4a90efb5eb6e9f57
Instruction Fuzzy Hash: 6F3110B1614A8592EB12EF52F4813D96324F79C3C4F904026FB4D476AADF7DC949CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000AE64 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 000000014000AE9F

Part of subcall function 00000001400025E0: GetParent.USER32 ref: 00000001400025F5
Part of subcall function 00000001400025E0: GetWindowRect.USER32 ref: 0000000140002609
Part of subcall function 00000001400025E0: ScreenToClient.USER32 ref: 0000000140002615
Part of subcall function 00000001400025E0: ScreenToClient.USER32 ref: 0000000140002622

Part of subcall function 000000014000AA08: GetDlgItem.USER32 ref: 000000014000AA2B
Part of subcall function 000000014000AA08: SetWindowPos.USER32 ref: 000000014000AA50

Strings

, xrefs: 000000014000AE98
, xrefs: 000000014000AE85

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ClientItemScreenWindow$ParentRect
String ID: $
API String ID: 2675214473-227171996
Opcode ID: c4bd72f434b48c830ab944ecceff824468277ff1dde444ce723d8924a88d7d06
Instruction ID: 6c4cc5823688e27172d32cf8a1c5b4521fe4e29dd84c211cf8c9a3571c7da24d
Opcode Fuzzy Hash: c4bd72f434b48c830ab944ecceff824468277ff1dde444ce723d8924a88d7d06
Instruction Fuzzy Hash: CA115E7221464587C714CF2AF4447AABBA1F3C9BD8F148215FB4547B68DB3CD845CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400234C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 0000000140023537
__setusermatherr.MSVCRT ref: 0000000140023582

Strings

MZ`, xrefs: 00000001400234DD

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: __set_app_type__setusermatherr
String ID: MZ`
API String ID: 2629043507-2330268423
Opcode ID: 6eb9fe68b76b86fdacad53cbffd465042498b33527e63477702210e03248e05a
Instruction ID: 63d6acfbcff2126a63b64981d0d41e13731eef29f639e16b51def6bfc5f6d4f3
Opcode Fuzzy Hash: 6eb9fe68b76b86fdacad53cbffd465042498b33527e63477702210e03248e05a
Instruction Fuzzy Hash: 0421FC74A01650CAEB53DB26E8583E933E0A74CBE5F504939F719832F0DA398C85CB02

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400077CC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

_wtol.MSVCRT ref: 00000001400077ED
GetLastError.KERNEL32 ref: 0000000140007824

Strings

, xrefs: 00000001400077F9

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast_wtol
String ID:
API String ID: 3876490843-3916222277
Opcode ID: e232e1c712239dce0f4757f01bad8d1eac7c625181fbeca099144479924383bb
Instruction ID: 9285bdcc729afaec87a5660a9b1b0767a40db37683134d4101bfa17f3d11a53d
Opcode Fuzzy Hash: e232e1c712239dce0f4757f01bad8d1eac7c625181fbeca099144479924383bb
Instruction Fuzzy Hash: FBF0FFB1E5110185FBB7AB736819BE911A1DB18BD5F58D411EB0A834E1EA7D4882C345

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140006298 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 9windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32 ref: 00000001400062B2

Strings

7-Zip SFX, xrefs: 000000014000629C
Could not allocate memory, xrefs: 00000001400062A3

Memory Dump Source

Source File: 00000000.00000002.1693452490.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.1693421046.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693556586.0000000140024000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693639983.000000014002B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693697026.0000000140031000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Message
String ID: 7-Zip SFX$Could not allocate memory
API String ID: 2030045667-3806377612
Opcode ID: 55e790162cb9d03b800ad38cadaf8a296740c2b12dfa7a067b1f688dd9b005c7
Instruction ID: 00f643229744ea2e971361a3c52e96a6143b82f901bc8b741ef78121efc3b944
Opcode Fuzzy Hash: 55e790162cb9d03b800ad38cadaf8a296740c2b12dfa7a067b1f688dd9b005c7
Instruction Fuzzy Hash: 2BC08C3870060AC0EB1A7B23AC627D01260B31C389FC0080AD60547630CFBCC68B8744

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\7ZSfx000.cmd

C:\ez-az!\EasyVBO.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exePID: 6748, Parent PID: 2580

General

Chronological Activities

Analysis Process: cmd.exePID: 6984, Parent PID: 6748

General

Windows Analysis Report
SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529.exe

Function 000000014000CE2C Relevance: 30.1, APIs: 20, Instructions: 142
windowcomtimeCOMMON

Function 0000000140002640 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 83
libraryloaderCOMMON

Function 0000000140004C64 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 124
stringtimeCOMMON

Function 000000014000C7F4 Relevance: 40.8, APIs: 27, Instructions: 269
windowCOMMON

Function 0000000140007834 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 117
fileCOMMON

Function 000000014000AA68 Relevance: 30.3, APIs: 20, Instructions: 285
COMMON

Function 0000000140001EAC Relevance: 18.3, APIs: 12, Instructions: 306
COMMON

Function 000000014002328C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 130
sleepCOMMON

Function 000000014000252C Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 42
timewindowCOMMON

Function 000000014000BFE4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 98
windowCOMMON

Function 000000014000A910 Relevance: 12.1, APIs: 8, Instructions: 70
COMMON

Function 000000014000AF8C Relevance: 12.1, APIs: 8, Instructions: 65
COMMON

Function 00000001400211D0 Relevance: 10.7, APIs: 7, Instructions: 213
COMMON

Function 000000014001E9BC Relevance: 9.1, APIs: 6, Instructions: 143
COMMON

Function 00000001400055A0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 155
COMMON