Edit tour

Windows Analysis Report
FAR.N#U00b02430-24000993.exe

Overview

General Information

Sample name:	FAR.N#U00b02430-24000993.exe renamed because original name is a hash value
Original sample name:	FAR.N2430-24000993.exe
Analysis ID:	1428834
MD5:	fc6db4b0a1a08504c0374df93b0f517a
SHA1:	bcb0b1dd0433b41936f04e3a50f388194b3d1c1c
SHA256:	7dea1d028135e07900ed820ac9e0ab9a6207906c667736f39a407fff424ce84a
Tags:	agentteslaexeFormbook
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

Binary is likely a compiled AutoIt script file

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Found API chain indicative of sandbox detection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

FAR.N#U00b02430-24000993.exe (PID: 5632 cmdline: "C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe" MD5: FC6DB4B0A1A08504C0374DF93B0F517A)

RegSvcs.exe (PID: 1216 cmdline: "C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

newfile.exe (PID: 6244 cmdline: "C:\Users\user\AppData\Roaming\newfile\newfile.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

conhost.exe (PID: 4392 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

newfile.exe (PID: 1096 cmdline: "C:\Users\user\AppData\Roaming\newfile\newfile.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

conhost.exe (PID: 5176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Host": "mail.cash4cars.nz", "Username": "logs@cash4cars.nz", "Password": "logs2024!"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.3345887048.000000000320E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.3326274628.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3326274628.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.3345887048.00000000031E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3345887048.00000000031E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2100930635.0000000001560000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2100930635.0000000001560000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000000.00000002.2100930635.0000000001560000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2100930635.0000000001560000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x346be:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34730:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x347ba:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3484c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x348b6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34928:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x349be:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34a4e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Process Memory Space: FAR.N#U00b02430-24000993.exe PID: 5632	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: FAR.N#U00b02430-24000993.exe PID: 5632	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: FAR.N#U00b02430-24000993.exe PID: 5632	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 1216	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 1216	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x346be:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34730:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x347ba:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3484c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x348b6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34928:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x349be:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34a4e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.FAR.N#U00b02430-24000993.exe.1560000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.FAR.N#U00b02430-24000993.exe.1560000.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.FAR.N#U00b02430-24000993.exe.1560000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.FAR.N#U00b02430-24000993.exe.1560000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x346be:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34730:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x347ba:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3484c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x348b6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34928:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x349be:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34a4e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.FAR.N#U00b02430-24000993.exe.1560000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.FAR.N#U00b02430-24000993.exe.1560000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.FAR.N#U00b02430-24000993.exe.1560000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x328be:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32930:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x329ba:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32a4c:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32ab6:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32b28:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32bbe:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32c4e:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 6 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\newfile\newfile.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 1216, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\newfile

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.FAR.N#U00b02430-24000993.exe.1560000.1.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Host": "mail.cash4cars.nz", "Username": "logs@cash4cars.nz", "Password": "logs2024!"}

Multi AV Scanner detection for submitted file

Source: FAR.N#U00b02430-24000993.exe

ReversingLabs: Detection: 44%

Machine Learning detection for sample

Source: FAR.N#U00b02430-24000993.exe

Joe Sandbox ML: detected

Source: FAR.N#U00b02430-24000993.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: RegSvcs.pdb, source: newfile.exe, 00000003.00000000.2236193862.00000000009A2000.00000002.00000001.01000000.00000006.sdmp, newfile.exe.2.dr
Source:	Binary string: wntdll.pdbUGP source: FAR.N#U00b02430-24000993.exe, 00000000.00000003.2097077075.0000000003FA0000.00000004.00001000.00020000.00000000.sdmp, FAR.N#U00b02430-24000993.exe, 00000000.00000003.2095818943.0000000004140000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: FAR.N#U00b02430-24000993.exe, 00000000.00000003.2097077075.0000000003FA0000.00000004.00001000.00020000.00000000.sdmp, FAR.N#U00b02430-24000993.exe, 00000000.00000003.2095818943.0000000004140000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: RegSvcs.pdb source: newfile.exe, 00000003.00000000.2236193862.00000000009A2000.00000002.00000001.01000000.00000006.sdmp, newfile.exe.2.dr

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_0073DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0073DBBE
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_0070C2A2 FindFirstFileExW,	0_2_0070C2A2
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_007468EE FindFirstFileW,FindClose,	0_2_007468EE
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_0074698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_0074698F
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_0073D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0073D076
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_0073D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0073D3A9
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_00749642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00749642
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_0074979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0074979D
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_00749B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00749B2B
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_00745C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00745C97

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FAR.N#U00b02430-24000993.exe.1560000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2100930635.0000000001560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: global traffic

TCP traffic: 192.168.2.6:49712 -> 114.142.162.17:26

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 114.142.162.17 114.142.162.17

Source: Joe Sandbox View

ASN Name: SERVERMULE-AS-APNimbus2PtyLtdAU SERVERMULE-AS-APNimbus2PtyLtdAU

Source: unknown

DNS query: name: ip-api.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Code function: 0_2_0074CE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

0_2_0074CE44

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: ip-api.com

Source: RegSvcs.exe, 00000002.00000002.3345887048.00000000031B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: FAR.N#U00b02430-24000993.exe, 00000000.00000002.2100930635.0000000001560000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3327036410.0000000001488000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3345887048.00000000031B1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3326274628.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: RegSvcs.exe, 00000002.00000002.3327036410.0000000001488000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hostingg
Source: RegSvcs.exe, 00000002.00000002.3345887048.0000000003214000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.cash4cars.nz
Source: RegSvcs.exe, 00000002.00000002.3345887048.00000000031B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: FAR.N#U00b02430-24000993.exe, 00000000.00000002.2100930635.0000000001560000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3326274628.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.FAR.N#U00b02430-24000993.exe.1560000.1.raw.unpack, cPKWk.cs

.Net Code: QEe0sUZ

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Code function: 0_2_0074EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_0074EAFF

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Code function: 0_2_0074ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0074ED6A

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

0_2_0074EAFF

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Code function: 0_2_0073AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_0073AA57

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Code function: 0_2_00769576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00769576

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.FAR.N#U00b02430-24000993.exe.1560000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.FAR.N#U00b02430-24000993.exe.1560000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.2100930635.0000000001560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: FAR.N#U00b02430-24000993.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: FAR.N#U00b02430-24000993.exe, 00000000.00000000.2086272101.0000000000792000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_da581f3f-5
Source: FAR.N#U00b02430-24000993.exe, 00000000.00000000.2086272101.0000000000792000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_8fe306cc-0
Source: FAR.N#U00b02430-24000993.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_b4392115-c
Source: FAR.N#U00b02430-24000993.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_62ae0b6f-3

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Code function: 0_2_0073D5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_0073D5EB

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Code function: 0_2_00731201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00731201

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Code function: 0_2_0073E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_0073E8F6

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_006D8060	0_2_006D8060
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_00742046	0_2_00742046
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_00738298	0_2_00738298
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_0070E4FF	0_2_0070E4FF
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_0070676B	0_2_0070676B
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_00764873	0_2_00764873
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_006DCAF0	0_2_006DCAF0
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_006FCAA0	0_2_006FCAA0
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_006ECC39	0_2_006ECC39
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_00706DD9	0_2_00706DD9
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_006EB119	0_2_006EB119
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_006D91C0	0_2_006D91C0
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_006F1394	0_2_006F1394
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_006F781B	0_2_006F781B
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_006E997D	0_2_006E997D
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_006D7920	0_2_006D7920
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_006F7A4A	0_2_006F7A4A
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_006F7CA7	0_2_006F7CA7
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_0075BE44	0_2_0075BE44
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_00709EEE	0_2_00709EEE
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_006DBF40	0_2_006DBF40
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_01543680	0_2_01543680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_01804AD8	2_2_01804AD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0180D238	2_2_0180D238
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_01803EC0	2_2_01803EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0180DE00	2_2_0180DE00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_01804208	2_2_01804208
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06AEB5A8	2_2_06AEB5A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06AE3318	2_2_06AE3318
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06AE0040	2_2_06AE0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06AE5A20	2_2_06AE5A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06AEEA58	2_2_06AEEA58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06AE89A8	2_2_06AE89A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06AE9110	2_2_06AE9110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06AEAEC8	2_2_06AEAEC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06F73500	2_2_06F73500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06AE0023	2_2_06AE0023
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Code function: 3_2_01080BC0	3_2_01080BC0

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: String function: 006F0A30 appears 46 times
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: String function: 006EF9F2 appears 40 times
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: String function: 006D9CB3 appears 31 times

Source: FAR.N#U00b02430-24000993.exe, 00000000.00000003.2100215451.000000000426D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs FAR.N#U00b02430-24000993.exe
Source: FAR.N#U00b02430-24000993.exe, 00000000.00000003.2095699886.00000000040C3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs FAR.N#U00b02430-24000993.exe
Source: FAR.N#U00b02430-24000993.exe, 00000000.00000002.2100930635.0000000001560000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameea16ea75-cecb-40c7-8a5f-1ef4e83dbba6.exe4 vs FAR.N#U00b02430-24000993.exe

Source: FAR.N#U00b02430-24000993.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.FAR.N#U00b02430-24000993.exe.1560000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.FAR.N#U00b02430-24000993.exe.1560000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.2100930635.0000000001560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 0.2.FAR.N#U00b02430-24000993.exe.1560000.1.raw.unpack, cPs8D.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.FAR.N#U00b02430-24000993.exe.1560000.1.raw.unpack, 72CF8egH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.FAR.N#U00b02430-24000993.exe.1560000.1.raw.unpack, G5CXsdn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.FAR.N#U00b02430-24000993.exe.1560000.1.raw.unpack, 3uPsILA6U.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.FAR.N#U00b02430-24000993.exe.1560000.1.raw.unpack, 6oQOw74dfIt.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.FAR.N#U00b02430-24000993.exe.1560000.1.raw.unpack, aMIWm.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.FAR.N#U00b02430-24000993.exe.1560000.1.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.FAR.N#U00b02430-24000993.exe.1560000.1.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/8@2/2

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Code function: 0_2_007437B5 GetLastError,FormatMessageW,

0_2_007437B5

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_007310BF AdjustTokenPrivileges,CloseHandle,		0_2_007310BF
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_007316C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_007316C3

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Code function: 0_2_007451CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_007451CD

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Code function: 0_2_0075A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0075A67C

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Code function: 0_2_0074648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0074648E

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Code function: 0_2_006D42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_006D42A2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File created: C:\Users\user\AppData\Roaming\newfile

Jump to behavior

Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5176:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4392:120:WilError_03

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

File created: C:\Users\user\AppData\Local\Temp\autE4C3.tmp

Jump to behavior

Source: FAR.N#U00b02430-24000993.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: FAR.N#U00b02430-24000993.exe

ReversingLabs: Detection: 44%

Source: unknown	Process created: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe "C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe"
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\newfile\newfile.exe "C:\Users\user\AppData\Roaming\newfile\newfile.exe"
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\newfile\newfile.exe "C:\Users\user\AppData\Roaming\newfile\newfile.exe"
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe"	Jump to behavior

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: FAR.N#U00b02430-24000993.exe

Static file information: File size 1119744 > 1048576

Source: FAR.N#U00b02430-24000993.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: FAR.N#U00b02430-24000993.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: FAR.N#U00b02430-24000993.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: FAR.N#U00b02430-24000993.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: FAR.N#U00b02430-24000993.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: FAR.N#U00b02430-24000993.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: FAR.N#U00b02430-24000993.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: RegSvcs.pdb, source: newfile.exe, 00000003.00000000.2236193862.00000000009A2000.00000002.00000001.01000000.00000006.sdmp, newfile.exe.2.dr
Source:	Binary string: wntdll.pdbUGP source: FAR.N#U00b02430-24000993.exe, 00000000.00000003.2097077075.0000000003FA0000.00000004.00001000.00020000.00000000.sdmp, FAR.N#U00b02430-24000993.exe, 00000000.00000003.2095818943.0000000004140000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: FAR.N#U00b02430-24000993.exe, 00000000.00000003.2097077075.0000000003FA0000.00000004.00001000.00020000.00000000.sdmp, FAR.N#U00b02430-24000993.exe, 00000000.00000003.2095818943.0000000004140000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: RegSvcs.pdb source: newfile.exe, 00000003.00000000.2236193862.00000000009A2000.00000002.00000001.01000000.00000006.sdmp, newfile.exe.2.dr

Source: FAR.N#U00b02430-24000993.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: FAR.N#U00b02430-24000993.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: FAR.N#U00b02430-24000993.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: FAR.N#U00b02430-24000993.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: FAR.N#U00b02430-24000993.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Code function: 0_2_006D42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_006D42DE

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_006F0A76 push ecx; ret	0_2_006F0A89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0180E8C9 push B4069A68h; ret	2_2_0180E8D5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06F711BE push es; ret	2_2_06F711C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File created: C:\Users\user\AppData\Roaming\newfile\newfile.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run newfile			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run newfile			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\Users\user\AppData\Roaming\newfile\newfile.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_006EF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_006EF98E
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_00761C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00761C41

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: FAR.N#U00b02430-24000993.exe PID: 5632, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-95636

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: FAR.N#U00b02430-24000993.exe, 00000000.00000002.2100930635.0000000001560000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3326274628.0000000000402000.00000040.80000000.00040000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Memory allocated: 1080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Memory allocated: 2C10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Memory allocated: 4C10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Memory allocated: 8C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Memory allocated: 2370000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Memory allocated: 4370000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7950			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1881			Jump to behavior

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

API coverage: 4.0 %

Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe TID: 3360	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe TID: 6416	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_0073DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0073DBBE
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_0070C2A2 FindFirstFileExW,	0_2_0070C2A2
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_007468EE FindFirstFileW,FindClose,	0_2_007468EE
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_0074698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_0074698F
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_0073D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0073D076
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_0073D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0073D3A9
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_00749642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00749642
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_0074979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0074979D
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_00749B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00749B2B
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_00745C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00745C97

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Code function: 0_2_006D42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_006D42DE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99782	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99657	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99532	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99407	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99282	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99169	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95993	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94933	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94110	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: RegSvcs.exe, 00000002.00000002.3326274628.0000000000402000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: vmware
Source: RegSvcs.exe, 00000002.00000002.3326274628.0000000000402000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem
Source: RegSvcs.exe, 00000002.00000002.3350073689.00000000064DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 2_2_018070C0 CheckRemoteDebuggerPresent,

2_2_018070C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Code function: 0_2_0074EAA2 BlockInput,

0_2_0074EAA2

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Code function: 0_2_00702622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00702622

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Code function: 0_2_006D42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_006D42DE

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_006F4CE8 mov eax, dword ptr fs:[00000030h]	0_2_006F4CE8
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_01543570 mov eax, dword ptr fs:[00000030h]	0_2_01543570
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_01543510 mov eax, dword ptr fs:[00000030h]	0_2_01543510
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_01541ED0 mov eax, dword ptr fs:[00000030h]	0_2_01541ED0

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Code function: 0_2_00730B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00730B62

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_00702622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00702622
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_006F083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_006F083F
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_006F09D5 SetUnhandledExceptionFilter,	0_2_006F09D5
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_006F0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_006F0C21

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 1001008

Jump to behavior

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

0_2_00731201

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Code function: 0_2_00712BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00712BA5

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Code function: 0_2_0073B226 SendInput,keybd_event,

0_2_0073B226

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Code function: 0_2_007522DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_007522DA

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe"

Jump to behavior

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

0_2_00730B62

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Code function: 0_2_00731663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00731663

Source: FAR.N#U00b02430-24000993.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: FAR.N#U00b02430-24000993.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Code function: 0_2_006F0698 cpuid

0_2_006F0698

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Queries volume information: C:\Users\user\AppData\Roaming\newfile\newfile.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Queries volume information: C:\Users\user\AppData\Roaming\newfile\newfile.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newfile\newfile.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Code function: 0_2_00748195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00748195

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Code function: 0_2_0072D27A GetUserNameW,

0_2_0072D27A

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Code function: 0_2_0070B952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

0_2_0070B952

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe

Code function: 0_2_006D42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_006D42DE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FAR.N#U00b02430-24000993.exe.1560000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FAR.N#U00b02430-24000993.exe.1560000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3345887048.000000000320E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3326274628.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3345887048.00000000031E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2100930635.0000000001560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FAR.N#U00b02430-24000993.exe PID: 5632, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1216, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: FAR.N#U00b02430-24000993.exe	Binary or memory string: WIN_81
Source: FAR.N#U00b02430-24000993.exe	Binary or memory string: WIN_XP
Source: FAR.N#U00b02430-24000993.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: FAR.N#U00b02430-24000993.exe	Binary or memory string: WIN_XPe
Source: FAR.N#U00b02430-24000993.exe	Binary or memory string: WIN_VISTA
Source: FAR.N#U00b02430-24000993.exe	Binary or memory string: WIN_7
Source: FAR.N#U00b02430-24000993.exe	Binary or memory string: WIN_8

Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FAR.N#U00b02430-24000993.exe.1560000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FAR.N#U00b02430-24000993.exe.1560000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3326274628.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3345887048.00000000031E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2100930635.0000000001560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FAR.N#U00b02430-24000993.exe PID: 5632, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1216, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FAR.N#U00b02430-24000993.exe.1560000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FAR.N#U00b02430-24000993.exe.1560000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3345887048.000000000320E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3326274628.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3345887048.00000000031E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2100930635.0000000001560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FAR.N#U00b02430-24000993.exe PID: 5632, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1216, type: MEMORYSTR

Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_00751204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00751204
Source: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe	Code function: 0_2_00751806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00751806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	121 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	2 Valid Accounts	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	38 System Information Discovery	Distributed Component Object Model	121 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	1 Masquerading	LSA Secrets	541 Security Software Discovery	SSH	3 Clipboard Data	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	251 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	251 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Files and Directories	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
FAR.N#U00b02430-24000993.exe	45%	ReversingLabs	Win32.Spyware.Negasteal
FAR.N#U00b02430-24000993.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\newfile\newfile.exe	0%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.cash4cars.nz	114.142.162.17	true	true		unknown
ip-api.com	208.95.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://ip-api.com/line/?fields=hostingg	RegSvcs.exe, 00000002.00000002.3327036410.0000000001488000.00000004.00000020.00020000.00000000.sdmp	false	high
http://mail.cash4cars.nz	RegSvcs.exe, 00000002.00000002.3345887048.0000000003214000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://account.dyn.com/	FAR.N#U00b02430-24000993.exe, 00000000.00000002.2100930635.0000000001560000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3326274628.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000002.00000002.3345887048.00000000031B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://ip-api.com	RegSvcs.exe, 00000002.00000002.3345887048.00000000031B1000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
114.142.162.17	mail.cash4cars.nz	Australia		133525	SERVERMULE-AS-APNimbus2PtyLtdAU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428834
Start date and time:	2024-04-19 17:22:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	FAR.N#U00b02430-24000993.exe renamed because original name is a hash value
Original Sample Name:	FAR.N2430-24000993.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/8@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 99% Number of executed functions: 50 Number of non-executed functions: 301
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target newfile.exe, PID 1096 because it is empty
Execution Graph export aborted for target newfile.exe, PID 6244 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: FAR.N#U00b02430-24000993.exe

Simulations

Behavior and APIs

Time	Type	Description
17:22:59	API Interceptor	159x Sleep call for process: RegSvcs.exe modified
17:23:02	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run newfile C:\Users\user\AppData\Roaming\newfile\newfile.exe
17:23:11	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run newfile C:\Users\user\AppData\Roaming\newfile\newfile.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	tems.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	00_datos de la transacci#U00f3n rechazada y n#U00famero de cuenta incorrecto.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	PO-095325.scr.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	UPDATED SSTATEMENT OF ACCOUNT.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Copy of Poseidon Marine 4th monthly Stores Apr 2024 R3 .xls.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	ip-api.com/line/?fields=hosting
	REMITTANCE COPY.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	New Voicemail_Daiichi-Sankyo.html	Get hash	malicious	HTMLPhisher	Browse	ip-api.com/json/?fields=status,country,regionName,city,query
	DHL.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	KjCBSM7Ukv.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	ip-api.com/line/?fields=hosting
	eO2bqORIJb.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
114.142.162.17	http://otahuhumainstreet.co.nz	Get hash	malicious	Unknown	Browse	otahuhumainstreet.co.nz/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	tems.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	00_datos de la transacci#U00f3n rechazada y n#U00famero de cuenta incorrecto.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	PO-095325.scr.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	UPDATED SSTATEMENT OF ACCOUNT.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Copy of Poseidon Marine 4th monthly Stores Apr 2024 R3 .xls.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	REMITTANCE COPY.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	New Voicemail_Daiichi-Sankyo.html	Get hash	malicious	HTMLPhisher	Browse	208.95.112.1
	DHL.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	KjCBSM7Ukv.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	208.95.112.1
	eO2bqORIJb.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
mail.cash4cars.nz	tems.exe	Get hash	malicious	AgentTesla	Browse	114.142.162.17
	20220829_PEDIDO_22073M_PROTECO_LIMPIEZA_Y_KITS.vbe	Get hash	malicious	AgentTesla, GuLoader	Browse	114.142.162.17
	justificante.vbe	Get hash	malicious	AgentTesla, GuLoader	Browse	114.142.162.17
	Transferencia 4334300002017359pdf.vbe	Get hash	malicious	AgentTesla, GuLoader	Browse	114.142.162.17
	20220830_ProtecoPTE.vbe	Get hash	malicious	AgentTesla, GuLoader	Browse	114.142.162.17
	Klkket.vbe	Get hash	malicious	AgentTesla, GuLoader	Browse	114.142.162.17
	PEDIDO MILWAUKEE 00652024.vbe	Get hash	malicious	AgentTesla, GuLoader	Browse	114.142.162.17
	Psychologizing.vbe	Get hash	malicious	AgentTesla, GuLoader	Browse	114.142.162.17
	RFQ122.494001.vbe	Get hash	malicious	AgentTesla, GuLoader	Browse	114.142.162.17
	FACTURA2402616 - BP.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	114.142.162.17

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SERVERMULE-AS-APNimbus2PtyLtdAU	tems.exe	Get hash	malicious	AgentTesla	Browse	114.142.162.17
	20220829_PEDIDO_22073M_PROTECO_LIMPIEZA_Y_KITS.vbe	Get hash	malicious	AgentTesla, GuLoader	Browse	114.142.162.17
	justificante.vbe	Get hash	malicious	AgentTesla, GuLoader	Browse	114.142.162.17
	Transferencia 4334300002017359pdf.vbe	Get hash	malicious	AgentTesla, GuLoader	Browse	114.142.162.17
	20220830_ProtecoPTE.vbe	Get hash	malicious	AgentTesla, GuLoader	Browse	114.142.162.17
	Klkket.vbe	Get hash	malicious	AgentTesla, GuLoader	Browse	114.142.162.17
	PEDIDO MILWAUKEE 00652024.vbe	Get hash	malicious	AgentTesla, GuLoader	Browse	114.142.162.17
	Psychologizing.vbe	Get hash	malicious	AgentTesla, GuLoader	Browse	114.142.162.17
	RFQ122.494001.vbe	Get hash	malicious	AgentTesla, GuLoader	Browse	114.142.162.17
	FACTURA2402616 - BP.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	114.142.162.17
TUT-ASUS	tems.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	00_datos de la transacci#U00f3n rechazada y n#U00famero de cuenta incorrecto.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	PO-095325.scr.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	UPDATED SSTATEMENT OF ACCOUNT.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Copy of Poseidon Marine 4th monthly Stores Apr 2024 R3 .xls.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	REMITTANCE COPY.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	New Voicemail_Daiichi-Sankyo.html	Get hash	malicious	HTMLPhisher	Browse	208.95.112.1
	DHL.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	KjCBSM7Ukv.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	208.95.112.1
	eO2bqORIJb.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\newfile\newfile.exe	tems.exe	Get hash	malicious	AgentTesla	Browse
	HBL.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Heur.15333.25205.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.FileRepMalware.7644.21541.exe	Get hash	malicious	AgentTesla	Browse
	Cintillo 2024.pdf.exe	Get hash	malicious	AgentTesla	Browse
	SHIPMENT ADVICE FOR CLEARTEX.exe	Get hash	malicious	AgentTesla	Browse
	REQUEST FOR QUOTATION.exe	Get hash	malicious	Unknown	Browse
	67002314579XX.exe	Get hash	malicious	AgentTesla	Browse
	Quotation 22001625_REV001.exe	Get hash	malicious	AgentTesla	Browse
	justificante - 2024-04-16T133815.900.exe	Get hash	malicious	AgentTesla	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\newfile.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\newfile\newfile.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	142
Entropy (8bit):	5.090621108356562
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUC7WglAFXMWA2yTMGfsbNRLFS9Am12MFuAvOAsDeieVyn:Q3La/xwczlAFXMWTyAGCDLIP12MUAvvw
MD5:	8C0458BB9EA02D50565175E38D577E35
SHA1:	F0B50702CD6470F3C17D637908F83212FDBDB2F2
SHA-256:	C578E86DB701B9AFA3626E804CF434F9D32272FF59FB32FA9A51835E5A148B53
SHA-512:	804A47494D9A462FFA6F39759480700ECBE5A7F3A15EC3A6330176ED9C04695D2684BF6BF85AB86286D52E7B727436D0BB2E8DA96E20D47740B5CE3F856B5D0F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Temp\autE4C3.tmp

Download File

Process:	C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe
File Type:	data
Category:	dropped
Size (bytes):	157720
Entropy (8bit):	7.884870119185333
Encrypted:	false
SSDEEP:	3072:IkGLdtRNUevIWvLJWKK/lFW0HT2wGXx40RAuulx4cE:sTUetvLJWt/zZHTkhBKE
MD5:	91FE9C86E5DBA5162BC2009796390A4D
SHA1:	D0D2AD77DF220A5B69211855971A995E21301196
SHA-256:	625AECAF209AFBA7B3CEEC972E02D93AD1A4A23FFC12D13E9D0A05B731EB0C45
SHA-512:	7BA0AE92B72F3A72FD89F5284D5429363CE49DAE03DF550A7CAE67D0D5F041DD2F974300C8BAC77A8F297FC11D8C4DA623B965DE1A9DB5C3F5E91B0F5F0CC436
Malicious:	false
Reputation:	low
Preview:	EA06......y...J.O.Pf....F.Rfs.&aH.V...>.O....`..4.Q.......g..8N+....M..~3+.~.d.Ke6i..A?..g..e^_X..".i.RwF.\...D.+..Vd..U..@...3d.L.Q.D.........Pf..\|.F.~.........n.P..F.......M- ...aH..Ff..Q....4..Tb.Z.r..E>.B..d.$.... .N.0t.}....Q..`.......b......}....mX...v.z.S.....P$3......L..@..i........0.Z..Y.\...U.?32..?.....!R....:..WW.Q.....D....Z..G.t.......[ ...(.....I..)..%:!x...Sz..D...........Y....2.N.E6../G...m.....h..]...r...[./V.<.p......l.=}..94..(4...G..l.R...2..ct.....D.......+^N?..^.sJ...f.z..Kv...U.....K=.h.2j.K.H.6.\.m3...>ed....~....o...H.2.Q.P&...G...I....g....b...B...L@8....+.8+@....:...@-...@.....Y............K&... #..S..v$.._J....s.{..3.U/>=.~....sk..X.L.0.O7MV..'0.$.'].Y.Q...7..).J]".H....uJ.I.M(..".J...x...._{.............F7ti.$. ..)....iO.S.. .C..q....'g2...2.D..:...R...C9..o....6.I.`8...)..MB....(q.].iN.m...J...+Tje.*..K"....<..[.v.L.mx...Z...I.....-rmA.V....iI..cT..:s?.S..Z56W).`-qJ...?.M)....}0.S....>.Y.T.{....p..(....R.I

C:\Users\user\AppData\Local\Temp\autE522.tmp

Download File

Process:	C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe
File Type:	data
Category:	dropped
Size (bytes):	9994
Entropy (8bit):	7.691552960471397
Encrypted:	false
SSDEEP:	192:C5L1fjxqLFVvqjW1oIfBKCYZ7DkDeRHj8l7yv2Mu8Dh4Q5D6IxEMwaxg44IX2:C5LVEL2JCYRDgeRHwl742Mu894Ypnwq6
MD5:	FE0E8387FCB3C078E7DEC66871CF1279
SHA1:	7A49B895E97E2AB7A22600D8C0038CF0BBCF5C1D
SHA-256:	F0E4C4756BD84CB13B788FBF6A575DAED3BA5472AF5C34916EBA65E3A305B33A
SHA-512:	1F89A3D9F199941E27331DAE3D8D602A3836CCC0904209CE1E152C377235C6996B8C354B312C1973240B89966DB0ECFC7F22149ACB4F0C04E4E510B81E3201A3
Malicious:	false
Reputation:	low
Preview:	EA06..t.._....i.M....U8.M.Si\|._=.O.....U6.O&S.t.e:.O......S..c8....A>.6-`........,..H...k.O....oL......k..T.q\...../...@........6...o.\|........t..V....S.+T.u`... ....fs.t..c ._..w....d....H,.......Ai.H..g...X.F..=j...>.\|..C`.....02..O....u.<......zm\.L@]>......N.x>:.....O.j.:.....Z@j.:......j.:......'.n.5.....^..../Z.Lg.#^...h.#..z.c6.H....S...#....O.B=2.L@.......x....g.>_L.....@\|........`.R...K.u...a>...np.....{.........x.....I..l...$..6- ._...k...e...g.\..l\|2..rt......K.O.4.:.#G.\.h.+...o..6...e........./..<.....%v....Z@4.]..g.).u`...2.....xZfV...Z.)..F.>....ei....?..........,....Z..5...b]8..4....`....n....v.......h.O....F\...FV...X...."U?... ....,vV.....Wj.Z%...F`.Y.T..c.....-R..y...B3......;,.X.n._.X'..........c........l.d.h.?.....,vZ....._j..%`.........c.....'...q/...@......8.a..~.`.W@B)h.'e......j.[..'U...g;..Bv^...x..r...}2...@B...,v`.!..>.[..mS .M..@...X...\.K..@.D.a.Q...s...ZeS...c;..f.!...,vb...U..j........#. ....3*.L,.........;2.X...c

C:\Users\user\AppData\Local\Temp\iodization

Download File

Process:	C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe
File Type:	ASCII text, with very long lines (29698), with no line terminators
Category:	dropped
Size (bytes):	29698
Entropy (8bit):	4.485436146250109
Encrypted:	false
SSDEEP:	384:QmogElNuNba09lcV/ZOfcQIqwDTywGVxgq5MSfZON03MlQ8THJCf9r3w35dImP6Z:QmlIc+RZOfcQcGVxgq5MSfUnCtl+PFk
MD5:	6C8BF35041BFD0C2F3745CC9224AACE2
SHA1:	666F6A4C0AA3D4830B942F190BED3D74E5D0E397
SHA-256:	775B53E000B1901EC451C6D253BD8CF772343D1CA682ABB59F4B583FE65CB2F6
SHA-512:	D24DABC47E8D4987E1554EB8AEFB646B72169A79C840089AAEF591F672D5D56DBC125E3BFA0BA349722E0E3902DE0DDAA861CD16C38D0A7E7A210DBEB64C7D53
Malicious:	false
Reputation:	low
Preview:	~/;2h_i27_i]i866/</=\>0h6660<2?.;2:\?0;6660<2?.j2<\g186660<2?/;2>\>0k6660<2?.;2g\?0;6660<2?.j2i\g0i6660<2?/;2k\>-96660<2?.;36\?-86660<2?.j38\g,k6660<2?/;3:\>0:6660<2?.;3<\?0i6660<2?.j3>\g0i6660<2?/;3g-9]60<2?.;3i\?0k6660<2?2j.:`l`l`l\g1:6660<2?3;.<`l`l`l\>0:6660<2?2;.>`l`l`l\?0i6660<2?2j.g`l`l`l\g0i6660<2?3;.i`l`l`l\>,k6660<2?2;.k`l`l`l\?0:6660<2?2j/6`l`l`l\g0i6660<2?3;/8`l`l`l\>0i6660<2?2;/:`l`l`l-9]?0<2?2j/<`l`l`l\g1;6660<2?/;^6\>196660<2?.;^8\?0;6660<2?.j^:\g186660<2?/;^<\>-96660<2?.;^>\?-86660<2?.j^g\g,k6660<2?/;^i\>0:6660<2?.;^k\?0i6660<2?.j_6\g0i6660<2?/;_8-9]60<2?.;_:\?076660<2?2j0>`l`l`l\g0:6660<2?3;0g`l`l`l\>1<6660<2?2;0i`l`l`l\?076660<2?2j0k`l`l`l\g166660<2?3;16`l`l`l\>0?6660<2?2;18`l`l`l\?-96660<2?2j1:`l`l`l\g-86660<2?3;1<`l`l`l\>,k6660<2?2;1>`l`l`l\?0:6660<2?2j1g`l`l`l\g0i6660<2?3;1i`l`l`l\>0i6660<2?2;1k`l`l`l-9]?0<2?.j26\g196660<2?/;[6\>0>

C:\Users\user\AppData\Local\Temp\jailless

Download File

Process:	C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe
File Type:	data
Category:	dropped
Size (bytes):	244736
Entropy (8bit):	6.7132066068118945
Encrypted:	false
SSDEEP:	6144:WkfbTP3spVreXJKnjbBugxg2LjL+ogjWDv4:WSbTP3QyAjggpXL+ogjWDv4
MD5:	F7597840E272C39C9F3C2D0DB39AF894
SHA1:	11229837CD9908DE6B71A04D4067F8A5AB8755C3
SHA-256:	617E41B9186A42698D36B3DB941E9DB1CD368364122B3A90F3BC92BE8F2E93E5
SHA-512:	63E17903AC39B1ADC7FE74AF521862DCC2BC992691AD69F0E1C6967D852223BCFE91652472FBE361E65B3D63C33C2C71E2D37CC1E9E799D0FA6E905C533856F1
Malicious:	false
Reputation:	low
Preview:	y..OSRMO2A6X..DF.I32RI0H.ZFN4OXOPRMO6A6XD4DF4I32RI0HDZFN4OXO.RMO8^.VD.M...2~.hd -)f>F ?=1?m,W/X70.&#.;F\r ^h...nY <~_@E.A6XD4DFd.32.H3H.Mg(4OXOPRMO.A4YO5OF4.02RA0HDZFNJ.[OPrMO6.5XD4.F4i32RK0H@ZFN4OXOTRMO6A6XD.@F4K32RI0HFZ..4OHOPBMO6A&XD$DF4I32BI0HDZFN4OXO\|.NOyA6XD.GFrL32RI0HDZFN4OXOPRMO6A2XH4DF4I32RI0HDZFN4OXOPRMO6A6XD4DF4I32RI0HDZFN4OXOPRMO6a6XL4DF4I32RI0HLzFN\|OXOPRMO6A6Xj@!>@I32..3HDzFN4.[OPPMO6A6XD4DF4I32rI0(j(5<WOXO.WMO6.5XD2DF4.02RI0HDZFN4OXO.RM..3S4+WDF8I32RI4HDXFN4.[OPRMO6A6XD4DFtI3pRI0HDZFN4OXOPRMOV.5XD4DF\|I32PI5HL.DN.xYOSRMO7A6^D4DF4I32RI0HDZFN4OXOPRMO6A6XD4DF4I32RI0HDZFN4OXOM....~f.IzLVN.....K..U.6.._.X.MU...rI.....u<6..Z.A...Y...4.PAME.....j);9J2.9.@9.M....\|.,...@Z.I...Nz.4@j.f...tn..zW0j...=.1&]f%6"Qa..63?&.C.YD4DF.......-"...LWQd@5....p&<.....,I0H ZFNFOXO1RMOqA6X+4DFZI32,I0H:ZFNrOXO.RMO.A6Xa4DFYI32vI0H:ZFN.2W@..&E..XD4DF.....$.....y...y!.3.Ty.P....6a.FX.3....V.9..!.]^gz.A5O77PN4KHgH...nRVIJ4F2[H.J.....o..}..E...(.36A6XD4.F4.32R.H.ZFN.O.O..MO6..X.4.F..2

C:\Users\user\AppData\Roaming\newfile\newfile.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45984
Entropy (8bit):	6.16795797263964
Encrypted:	false
SSDEEP:	768:4BbSoy+SdIBf0k2dsjYg6Iq8S1GYqWH8BR:noOIBf0ddsjY/ZGyc7
MD5:	9D352BC46709F0CB5EC974633A0C3C94
SHA1:	1969771B2F022F9A86D77AC4D4D239BECDF08D07
SHA-256:	2C1EEB7097023C784C2BD040A2005A5070ED6F3A4ABF13929377A9E39FAB1390
SHA-512:	13C714244EC56BEEB202279E4109D59C2A43C3CF29F90A374A751C04FD472B45228CA5A0178F41109ED863DBD34E0879E4A21F5E38AE3D89559C57E6BE990A9B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: tems.exe, Detection: malicious, Browse Filename: HBL.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Heur.15333.25205.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.FileRepMalware.7644.21541.exe, Detection: malicious, Browse Filename: Cintillo 2024.pdf.exe, Detection: malicious, Browse Filename: SHIPMENT ADVICE FOR CLEARTEX.exe, Detection: malicious, Browse Filename: REQUEST FOR QUOTATION.exe, Detection: malicious, Browse Filename: 67002314579XX.exe, Detection: malicious, Browse Filename: Quotation 22001625_REV001.exe, Detection: malicious, Browse Filename: justificante - 2024-04-16T133815.900.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.]..............0..d..........V.... ........@.. ..............................s.....`.....................................O.......8............r...A.......................................................... ............... ..H............text...\c... ...d.................. ..`.rsrc...8............f..............@..@.reloc...............p..............@..B................8.......H........+...S..........\|...P...........................................r...p(....2.(....(....z..r...p(....(....(......}......{.....s..........0..{...........Q.-.s.....+i~....o....(.....s.......o.....r!..p..(....Q.P,:.P.....(....o....o ........(....o!...o".....,..o#...t........0..(....... ....s$........o%....X..(....-...o&....0...........('......&.........................0...........(.......&.....*.................0............(.....(....~....,.(....~....o....9]...

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Roaming\newfile\newfile.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	4.442398121585593
Encrypted:	false
SSDEEP:	24:zKLXkhDObntKlglUEnfQtvNuNpKOK5aM9YJC:zKL0hDQntKKH1MqJC
MD5:	6FB4D27A716A8851BC0505666E7C7A10
SHA1:	AD2A232C6E709223532C4D1AB892303273D8C814
SHA-256:	1DC36F296CE49BDF1D560B527DB06E1E9791C10263459A67EACE706C6DDCDEAE
SHA-512:	3192095C68C6B7AD94212B7BCA0563F2058BCE00C0C439B90F0E96EA2F029A37C2F2B69487591B494C1BA54697FE891E214582E392127CB8C90AB682E0D81ADB
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	Microsoft (R) .NET Framework Services Installation Utility Version 4.8.4084.0..Copyright (C) Microsoft Corporation. All rights reserved.....USAGE: regsvcs.exe [options] AssemblyName..Options:.. /? or /help Display this usage message... /fc Find or create target application (default)... /c Create target application, error if it already exists... /exapp Expect an existing application... /tlb:<tlbfile> Filename for the exported type library... /appname:<name> Use the specified name for the target application... /parname:<name> Use the specified name or id for the target partition... /extlb Use an existing type library... /reconfig Reconfigure existing target application (default)... /noreconfig Don't reconfigure existing target application... /u Uninstall target application... /nologo Suppress logo output... /quiet Suppress logo output and success output... /c

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.970776251416459
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	FAR.N#U00b02430-24000993.exe
File size:	1'119'744 bytes
MD5:	fc6db4b0a1a08504c0374df93b0f517a
SHA1:	bcb0b1dd0433b41936f04e3a50f388194b3d1c1c
SHA256:	7dea1d028135e07900ed820ac9e0ab9a6207906c667736f39a407fff424ce84a
SHA512:	90cbe574fb288aa2bdfc64b1c95723eb3e4fbf9c6bc7157c127bc7b71241681e629edc0c4a84e941461abe07ae2f1cc9069740bcf66001d91064b84ea0041eb8
SSDEEP:	24576:lqDEvCTbMWu7rQYlBQcBiT6rprG8a2xPXKQNut5/xH:lTvC/MTQYxsWR7a29ut5/
TLSH:	6A35BF0273D1C062FFAB92734B5AF6115BBC6A260123E61F13981D79BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6621D708 [Fri Apr 19 02:29:28 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F30ACB4FC63h
jmp 00007F30ACB4F56Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F30ACB4F74Dh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F30ACB4F71Ah
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F30ACB5230Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F30ACB52358h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F30ACB52341h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x3abec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10f000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x3abec	0x3ac00	907f37d6ed79e916d338444440d0cb54	False	0.8888754986702128	data	7.798271812071214	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x10f000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x31e84	data			1.0003473241365815
RT_GROUP_ICON	0x10e63c	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x10e6b4	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x10e6c8	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x10e6dc	0x14	data	English	Great Britain	1.25
RT_VERSION	0x10e6f0	0x10c	data	English	Great Britain	0.5895522388059702
RT_MANIFEST	0x10e7fc	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 17:22:59.006534100 CEST	49711	80	192.168.2.6	208.95.112.1
Apr 19, 2024 17:22:59.122282028 CEST	80	49711	208.95.112.1	192.168.2.6
Apr 19, 2024 17:22:59.122481108 CEST	49711	80	192.168.2.6	208.95.112.1
Apr 19, 2024 17:22:59.123483896 CEST	49711	80	192.168.2.6	208.95.112.1
Apr 19, 2024 17:22:59.292146921 CEST	80	49711	208.95.112.1	192.168.2.6
Apr 19, 2024 17:22:59.340434074 CEST	49711	80	192.168.2.6	208.95.112.1
Apr 19, 2024 17:23:00.313030958 CEST	49712	26	192.168.2.6	114.142.162.17
Apr 19, 2024 17:23:01.324706078 CEST	49712	26	192.168.2.6	114.142.162.17
Apr 19, 2024 17:23:03.324712038 CEST	49712	26	192.168.2.6	114.142.162.17
Apr 19, 2024 17:23:07.324785948 CEST	49712	26	192.168.2.6	114.142.162.17
Apr 19, 2024 17:23:15.324701071 CEST	49712	26	192.168.2.6	114.142.162.17
Apr 19, 2024 17:23:50.767529011 CEST	49711	80	192.168.2.6	208.95.112.1
Apr 19, 2024 17:23:50.883809090 CEST	80	49711	208.95.112.1	192.168.2.6
Apr 19, 2024 17:23:50.883929968 CEST	49711	80	192.168.2.6	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 17:22:58.895828009 CEST	60759	53	192.168.2.6	1.1.1.1
Apr 19, 2024 17:22:59.000439882 CEST	53	60759	1.1.1.1	192.168.2.6
Apr 19, 2024 17:22:59.910242081 CEST	58094	53	192.168.2.6	1.1.1.1
Apr 19, 2024 17:23:00.312007904 CEST	53	58094	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 19, 2024 17:22:58.895828009 CEST	192.168.2.6	1.1.1.1	0x51ae	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 17:22:59.910242081 CEST	192.168.2.6	1.1.1.1	0x16bf	Standard query (0)	mail.cash4cars.nz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 19, 2024 17:22:59.000439882 CEST	1.1.1.1	192.168.2.6	0x51ae	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Apr 19, 2024 17:23:00.312007904 CEST	1.1.1.1	192.168.2.6	0x16bf	No error (0)	mail.cash4cars.nz		114.142.162.17	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	208.95.112.1	80	1216	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 17:22:59.123483896 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Apr 19, 2024 17:22:59.292146921 CEST	174	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 15:22:58 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 74 72 75 65 0a Data Ascii: true

Target ID:	0
Start time:	17:22:56
Start date:	19/04/2024
Path:	C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe"
Imagebase:	0x6d0000
File size:	1'119'744 bytes
MD5 hash:	FC6DB4B0A1A08504C0374DF93B0F517A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2100930635.0000000001560000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000000.00000002.2100930635.0000000001560000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2100930635.0000000001560000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000000.00000002.2100930635.0000000001560000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:22:57
Start date:	19/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe"
Imagebase:	0xf10000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3345887048.000000000320E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3326274628.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3326274628.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3345887048.00000000031E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3345887048.00000000031E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	17:23:11
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Roaming\newfile\newfile.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\newfile\newfile.exe"
Imagebase:	0x9a0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:23:11
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:23:19
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Roaming\newfile\newfile.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\newfile\newfile.exe"
Imagebase:	0x1d0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:23:19
Start date:	19/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.2%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	3%
Total number of Nodes:	2000
Total number of Limit Nodes:	45

Executed Functions

Function 006D42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 006D430D

Part of subcall function 006D6B57: _wcslen.LIBCMT ref: 006D6B6A

GetCurrentProcess.KERNEL32(?,0076CB64,00000000,?,?), ref: 006D4422
IsWow64Process.KERNEL32(00000000,?,?), ref: 006D4429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 006D4454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 006D4466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 006D4474
FreeLibrary.KERNEL32(00000000,?,?), ref: 006D447B
GetSystemInfo.KERNEL32(?,?,?), ref: 006D44A0

Strings

GetNativeSystemInfo, xrefs: 006D4460
kernel32.dll, xrefs: 006D444F
|O, xrefs: 007136F8

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 5e58d419d6dfeb18fa973428e244d21e4e5ef5a0b52b42e5afb7f7e9ab991676
Instruction ID: 569a3738feeeae290c9a7606aa7d775ee12e45a2e80a7a97d16c6f5d36e87631
Opcode Fuzzy Hash: 5e58d419d6dfeb18fa973428e244d21e4e5ef5a0b52b42e5afb7f7e9ab991676
Instruction Fuzzy Hash: 1AA1A465D0A2C0DFEF12CF6D78801E57FE5ABA7340F88C89AD08197B61D67C4949CB29

Uniqueness

Uniqueness Score: -1.00%

Function 006D42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,006D50AA,?,?,00000000,00000000), ref: 006D42B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,006D50AA,?,?,00000000,00000000), ref: 006D42C9
LoadResource.KERNEL32(?,00000000,?,?,006D50AA,?,?,00000000,00000000,?,?,?,?,?,?,006D4F20), ref: 007135BE
SizeofResource.KERNEL32(?,00000000,?,?,006D50AA,?,?,00000000,00000000,?,?,?,?,?,?,006D4F20), ref: 007135D3
LockResource.KERNEL32(006D50AA,?,?,006D50AA,?,?,00000000,00000000,?,?,?,?,?,?,006D4F20,?), ref: 007135E6

Strings

SCRIPT, xrefs: 006D42BF

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 246a075dd664262b1961dfb6f7a89e26ad9afcf8139f8b6a19e43dc05d42bf46
Instruction ID: 8f7659fde18478b6f866f0df50208c0ada4bf0b7bd2b3275a48622568657523e
Opcode Fuzzy Hash: 246a075dd664262b1961dfb6f7a89e26ad9afcf8139f8b6a19e43dc05d42bf46
Instruction Fuzzy Hash: BB117C70600701BFE7228B65DC49F677BBAEFC5B51F10816AF847D6290DBB1DD008660

Uniqueness

Uniqueness Score: -1.00%

Function 00712BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 006D2B6B

Part of subcall function 006D3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,007A1418,?,006D2E7F,?,?,?,00000000), ref: 006D3A78

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00792224), ref: 00712C10
ShellExecuteW.SHELL32(00000000,?,?,00792224), ref: 00712C17

Strings

runas, xrefs: 00712C0B

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 4e457e84b0337f6b2def289b8948fb577cca41b27f07d399df9512ccb59c3a60
Instruction ID: d643540db0769af3fb9bac1b6c5997cb7f89ac590afa182eb39c11fd9de8d72d
Opcode Fuzzy Hash: 4e457e84b0337f6b2def289b8948fb577cca41b27f07d399df9512ccb59c3a60
Instruction Fuzzy Hash: 28112C31E083915AD755FF64D8519BE7BA69FE5744F44442FF082023A3CF68894AC71B

Uniqueness

Uniqueness Score: -1.00%

Function 0073DBBE Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00715222), ref: 0073DBCE
GetFileAttributesW.KERNELBASE(?), ref: 0073DBDD
FindFirstFileW.KERNELBASE(?,?), ref: 0073DBEE
FindClose.KERNEL32(00000000), ref: 0073DBFA

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 72eac06d1bf322ed8667c13715d8a6a76d7f68eff1fb54395183526af14965d0
Instruction ID: 643c8daf687ae83e39368bfd93b56a5a334912e88e81bdc431b8eb0b8de2b057
Opcode Fuzzy Hash: 72eac06d1bf322ed8667c13715d8a6a76d7f68eff1fb54395183526af14965d0
Instruction Fuzzy Hash: BFF0A7704206145FA2316B78AC0D47A776CAE01334F108702F876C10E1EBF89D5485AA

Uniqueness

Uniqueness Score: -1.00%

Function 006DD730 Relevance: 21.6, APIs: 14, Instructions: 627sleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 006DD807
timeGetTime.WINMM ref: 006DDA07
Sleep.KERNEL32(0000000A), ref: 006DDBB1

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 6dc2eeccbc8ce8293b8d3b6bd16f8b1e5b8e4c2c82dbe34fd2613c9aec0db9e8
Instruction ID: 5a069a0b059f65590e8d978a29e9aa72318cd83de11aca0ebc9c769064dfa5ce
Opcode Fuzzy Hash: 6dc2eeccbc8ce8293b8d3b6bd16f8b1e5b8e4c2c82dbe34fd2613c9aec0db9e8
Instruction Fuzzy Hash: EB423670A04341EFD725EF24C844BAAB7E2BF86304F14851EF8568B392D779E845CB92

Uniqueness

Uniqueness Score: -1.00%

Function 006D2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 006D2D07
RegisterClassExW.USER32(00000030), ref: 006D2D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 006D2D42
InitCommonControlsEx.COMCTL32(?), ref: 006D2D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 006D2D6F
LoadIconW.USER32(000000A9), ref: 006D2D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 006D2D94

Strings

+, xrefs: 006D2CF0
AutoIt v3 GUI, xrefs: 006D2D23
0, xrefs: 006D2CE9
TaskbarCreated, xrefs: 006D2D37

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: abf4921485fad8f7decfba4dde7d85d2729b00000cda5d9487c7e036090d72f4
Instruction ID: d41e656721f8152c92dd79ceb61baa6bd4ecab2fdab06af11c530d46052495e0
Opcode Fuzzy Hash: abf4921485fad8f7decfba4dde7d85d2729b00000cda5d9487c7e036090d72f4
Instruction Fuzzy Hash: 712127B0901358AFEB01DFA4EC48BEEBBB4FB48700F00811AF552A62A0D7B91544CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00708D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

.o, xrefs: 0070903A, 00708FD0, 00708FF2

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID:
String ID: .o
API String ID: 0-1957372423
Opcode ID: a2d2d4247ac27b2bcf4d84df3ef3fe38d0109192b34bf9c5af5081b4b5290163
Instruction ID: 828c8c3f5b6c32db5ec654f076e1baca557b93afdc6cd4675d5c4b882d78edf1
Opcode Fuzzy Hash: a2d2d4247ac27b2bcf4d84df3ef3fe38d0109192b34bf9c5af5081b4b5290163
Instruction Fuzzy Hash: E3C1F174A0424AEFDB51DFA8C844BADBBF1AF49310F044299F654AB3D3C7389941CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0071065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0071039A: CreateFileW.KERNELBASE(00000000,00000000,?,00710704,?,?,00000000,?,00710704,00000000,0000000C), ref: 007103B7

GetLastError.KERNEL32 ref: 0071076F
__dosmaperr.LIBCMT ref: 00710776
GetFileType.KERNELBASE(00000000), ref: 00710782
GetLastError.KERNEL32 ref: 0071078C
__dosmaperr.LIBCMT ref: 00710795
CloseHandle.KERNEL32(00000000), ref: 007107B5
CloseHandle.KERNEL32(?), ref: 007108FF
GetLastError.KERNEL32 ref: 00710931
__dosmaperr.LIBCMT ref: 00710938

Strings

H, xrefs: 007108BD

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 3d7b2947b5edf9c0b645642d35edd098d24897b8e53abf504cab54786642d6e1
Instruction ID: de18356d564fffede57596023328c43ca7459cb933514b6fe10b67b89811eae9
Opcode Fuzzy Hash: 3d7b2947b5edf9c0b645642d35edd098d24897b8e53abf504cab54786642d6e1
Instruction Fuzzy Hash: 17A14332A001088FDF19AF6CD895BEE3BA1AF46320F14415DF811AB3D1C7799992CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 006D344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006D3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,007A1418,?,006D2E7F,?,?,?,00000000), ref: 006D3A78

Part of subcall function 006D3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 006D3379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 006D356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0071318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 007131CE
RegCloseKey.ADVAPI32(?), ref: 00713210
_wcslen.LIBCMT ref: 00713277
_wcslen.LIBCMT ref: 00713286

Strings

Include, xrefs: 00713184, 007131C5
\, xrefs: 0071328C
Software\AutoIt v3\AutoIt, xrefs: 006D3560
\Include\, xrefs: 006D3527

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 8b98d3d7ad8c35d0b3c58dae969be202aded1d5b9e19c00b76777e1b9df3233e
Instruction ID: dc0eb2053d3abf49d6fd92b1ba64864e9878e76d5ca4e9013eeafbc660286080
Opcode Fuzzy Hash: 8b98d3d7ad8c35d0b3c58dae969be202aded1d5b9e19c00b76777e1b9df3233e
Instruction Fuzzy Hash: A571B6715043009FC744EF69DC418ABBBE8FF86740F40842EF545872B1EB789A49CB59

Uniqueness

Uniqueness Score: -1.00%

Function 006D2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 006D2B8E
LoadCursorW.USER32(00000000,00007F00), ref: 006D2B9D
LoadIconW.USER32(00000063), ref: 006D2BB3
LoadIconW.USER32(000000A4), ref: 006D2BC5
LoadIconW.USER32(000000A2), ref: 006D2BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 006D2BEF
RegisterClassExW.USER32(?), ref: 006D2C40

Part of subcall function 006D2CD4: GetSysColorBrush.USER32(0000000F), ref: 006D2D07
Part of subcall function 006D2CD4: RegisterClassExW.USER32(00000030), ref: 006D2D31
Part of subcall function 006D2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 006D2D42
Part of subcall function 006D2CD4: InitCommonControlsEx.COMCTL32(?), ref: 006D2D5F
Part of subcall function 006D2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 006D2D6F
Part of subcall function 006D2CD4: LoadIconW.USER32(000000A9), ref: 006D2D85
Part of subcall function 006D2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 006D2D94

Strings

0, xrefs: 006D2C0F
#, xrefs: 006D2C16
AutoIt v3, xrefs: 006D2C2F

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: f6d9fe7856e3c8a7354fb36c54262a62cdc0eea2523d96967e22a9d9ffcae6af
Instruction ID: 7553c93a847984972d24c8f2b4edff7a2396c84a6737d1a18b6c23467bec22d9
Opcode Fuzzy Hash: f6d9fe7856e3c8a7354fb36c54262a62cdc0eea2523d96967e22a9d9ffcae6af
Instruction Fuzzy Hash: A7213874E00328AFEF119FA5EC55AA97FF4FB89B50F40802AE505A66A0D3B90540CF98

Uniqueness

Uniqueness Score: -1.00%

Function 006D3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,006D316A,?,?), ref: 006D31D8
KillTimer.USER32(?,00000001,?,?,?,?,?,006D316A,?,?), ref: 006D3204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 006D3227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,006D316A,?,?), ref: 006D3232
CreatePopupMenu.USER32 ref: 006D3246
PostQuitMessage.USER32(00000000), ref: 006D3267

Strings

TaskbarCreated, xrefs: 006D322D

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: cd151b0d83ca9ac18536566dfafa0400343550417e7bb65e33de03ee1d050927
Instruction ID: 317a016b31a23cfbf3fec66c0101b0bc463eafdfe01ad8dcbd26cf9c7b3828b7
Opcode Fuzzy Hash: cd151b0d83ca9ac18536566dfafa0400343550417e7bb65e33de03ee1d050927
Instruction Fuzzy Hash: A2414C35E00261A7EF151F789C0D7B9361BE786340F048127F542853E2C7AE9B4197AB

Uniqueness

Uniqueness Score: -1.00%

Function 006DDFD0 Relevance: 15.4, APIs: 2, Strings: 6, Instructions: 1414COMMON

Download Yara Rule

Strings

D%z, xrefs: 00722FDA
D%z, xrefs: 0072302D
D%zD%z, xrefs: 006DE27E
D%z, xrefs: 006DE4B1
D%z, xrefs: 006DE1E0
Variable must be of type 'Object'., xrefs: 007232B7

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID:
String ID: D%z$D%z$D%z$D%z$D%zD%z$Variable must be of type 'Object'.
API String ID: 0-1874280672
Opcode ID: 1ba4c701450d120870c23b11bd0d5dedf9c177155179cd8ee54735ea794cf9be
Instruction ID: 1b46072e2f65bd35412a9813bf7e5d9bcaff1260729c27f0cccc1bcf8af2f3bc
Opcode Fuzzy Hash: 1ba4c701450d120870c23b11bd0d5dedf9c177155179cd8ee54735ea794cf9be
Instruction Fuzzy Hash: 43C28F71E00215CFCB24EF58D880AADB7B2BF49310F24855AE915AF351D37AED42CB95

Uniqueness

Uniqueness Score: -1.00%

Function 01542660 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 01542731
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 01542957

Memory Dump Source

Source File: 00000000.00000002.2100886020.0000000001540000.00000040.00001000.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FAR.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: 30e8af4b53c3aa052917812e21e5e8fbde56ed90f0e39d50c947676a587081b9
Instruction ID: d6440a883c023d1124cbea5f1b9f31fe0b7e1db6ed303fd22efe4e1ee077c423
Opcode Fuzzy Hash: 30e8af4b53c3aa052917812e21e5e8fbde56ed90f0e39d50c947676a587081b9
Instruction Fuzzy Hash: C2A11A74E00219EBEB14CFA4D894BEEBBB5BF48308F108559F501BB280D7759A81CF94

Uniqueness

Uniqueness Score: -1.00%

Function 006D2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 006D2C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 006D2CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,006D1CAD,?), ref: 006D2CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,006D1CAD,?), ref: 006D2CCF

Strings

edit, xrefs: 006D2CAC
AutoIt v3, xrefs: 006D2C89, 006D2C8E, 006D2C8F

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 8af7501be3801dd75187bb8726b3ba6a6747097ff38a971ee5dfa69d0d93c0a4
Instruction ID: 787d24c39cf6fb796c215e81ff7ac9d04635382443816d346e496bd3e0d5c981
Opcode Fuzzy Hash: 8af7501be3801dd75187bb8726b3ba6a6747097ff38a971ee5dfa69d0d93c0a4
Instruction Fuzzy Hash: A2F0DA765403A07AFB311B17AC08E773EBDD7C7F61F40805AF900A29A0C6A91850DEB8

Uniqueness

Uniqueness Score: -1.00%

Function 01542410 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 154
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01542300: Sleep.KERNELBASE(000001F4), ref: 01542311

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 01542558

Strings

4OXOPRMO6A6XD4DF4I32RI0HDZFN, xrefs: 015425BB, 015425BE

Memory Dump Source

Source File: 00000000.00000002.2100886020.0000000001540000.00000040.00001000.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FAR.jbxd

Similarity

API ID: CreateFileSleep
String ID: 4OXOPRMO6A6XD4DF4I32RI0HDZFN
API String ID: 2694422964-1448326144
Opcode ID: 3614f3d71e9f9ec0d2f07881e63f9a535e33de7354b6d8595ba23a76a8fe67ed
Instruction ID: 24251506c3e1f2787734d39aa4bc98468c7c3f73daaac09e4f61458dc0ae798a
Opcode Fuzzy Hash: 3614f3d71e9f9ec0d2f07881e63f9a535e33de7354b6d8595ba23a76a8fe67ed
Instruction Fuzzy Hash: AE61B570D04298DBEF11DBB4D854BEEBBB5AF15304F044199E2487B2C1D7B91B44CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00742947 Relevance: 7.8, APIs: 5, Instructions: 313
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00742C05
DeleteFileW.KERNEL32(?), ref: 00742C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00742C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00742CAE
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00742CC0

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 1c6c23f8ade6f0850e2ee23a89e2ee6a179da21f564f4ca5ba1363492a69e7ba
Instruction ID: 445dfe9723d1cc7f5bda5f376bfaf13b66ee5bf9e829e6538597da3803ab7554
Opcode Fuzzy Hash: 1c6c23f8ade6f0850e2ee23a89e2ee6a179da21f564f4ca5ba1363492a69e7ba
Instruction Fuzzy Hash: 10B16EB1D0011DABDF11DBA4CC85EEEBB7DEF48300F5040AAFA09E6152EB349A558F65

Uniqueness

Uniqueness Score: -1.00%

Function 00705AA9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

JOm, xrefs: 00705BA8, 00705C6C

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID:
String ID: JOm
API String ID: 0-3333332779
Opcode ID: cde4c688588551de0a28c681058d18ecc55db013d10646234923373592580bfd
Instruction ID: ec307cee2fc0882e5dbade6ab52665bad6e072e5f87d58178f11db81b096e02d
Opcode Fuzzy Hash: cde4c688588551de0a28c681058d18ecc55db013d10646234923373592580bfd
Instruction Fuzzy Hash: 3451CEB190060AEFDF219FA4C849EBFBBF9AF45314F14025AF405A72D2D6799A01CF61

Uniqueness

Uniqueness Score: -1.00%

Function 006D3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,006D3B0F,SwapMouseButtons,00000004,?), ref: 006D3B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,006D3B0F,SwapMouseButtons,00000004,?), ref: 006D3B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,006D3B0F,SwapMouseButtons,00000004,?), ref: 006D3B83

Strings

Control Panel\Mouse, xrefs: 006D3B3E

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 2a1ac18a7148543ce1773203751be109abdcc8a83c13f953537b7875f6a4ae53
Instruction ID: a016f2bcac2245288c30e5814549a6a72c063dfa92362300d28b2eb19b8a528d
Opcode Fuzzy Hash: 2a1ac18a7148543ce1773203751be109abdcc8a83c13f953537b7875f6a4ae53
Instruction Fuzzy Hash: 64112AB5910218FFDB218FA5DC44AEEB7B9EF24744B10846BE845D7310E2719E409765

Uniqueness

Uniqueness Score: -1.00%

Function 01541300 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 01541B2D
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01541B51
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 01541B73

Memory Dump Source

Source File: 00000000.00000002.2100886020.0000000001540000.00000040.00001000.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FAR.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: e8e7a77c1c38f92167ec50984bffac71589908538948dc0fdf133907e09ee162
Instruction ID: 8695a47f51e8eda22c35ae667a97760ccd81eb521c98d70fe73b275421cb2211
Opcode Fuzzy Hash: e8e7a77c1c38f92167ec50984bffac71589908538948dc0fdf133907e09ee162
Instruction Fuzzy Hash: DA621934A14658DBEB24CBA4C880BDEB772FF58304F1095A9D20DEB290E7759E81CB59

Uniqueness

Uniqueness Score: -1.00%

Function 006D3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 007133A2

Part of subcall function 006D6B57: _wcslen.LIBCMT ref: 006D6B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 006D3A04

Strings

Line: , xrefs: 007133EB

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 90582174f391c145553440d274284043cc55c2baf4c46ac9af5002137d513350
Instruction ID: 0354fac024e60cba6414f79df7e83547fb0b576bcdba87e76b01c74a7e09d29a
Opcode Fuzzy Hash: 90582174f391c145553440d274284043cc55c2baf4c46ac9af5002137d513350
Instruction Fuzzy Hash: 6531E171908324AED761EF20DC45BEBB7D9AB81710F00492FF59982391EB749A48C7DB

Uniqueness

Uniqueness Score: -1.00%

Function 006D2DE3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00712C8C

Part of subcall function 006D3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006D3A97,?,?,006D2E7F,?,?,?,00000000), ref: 006D3AC2

Part of subcall function 006D2DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 006D2DC4

Strings

`ey, xrefs: 00712C85
X, xrefs: 00712C5A

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X$`ey
API String ID: 779396738-2559956516
Opcode ID: e94d857ff92967d5dc60788d4c5aeac331d5f787aa5bd4110fd4c6f216114c4d
Instruction ID: f3acd069783520a3427f4d5b7f73361928434ce1b4181c12e51c1640b2e94f7e
Opcode Fuzzy Hash: e94d857ff92967d5dc60788d4c5aeac331d5f787aa5bd4110fd4c6f216114c4d
Instruction Fuzzy Hash: 8F21D571E002989FCF41EF94D805BEE7BFDAF49304F00805AE505A7381DBB85A898FA5

Uniqueness

Uniqueness Score: -1.00%

Function 006EFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 006F0668

Part of subcall function 006F32A4: RaiseException.KERNEL32(?,?,?,006F068A,?,007A1444,?,?,?,?,?,?,006F068A,006D1129,00798738,006D1129), ref: 006F3304

__CxxThrowException@8.LIBVCRUNTIME ref: 006F0685

Strings

Unknown exception, xrefs: 006F0692

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 9624c099be955ac27282aee6e8feb6b4d6941a1a7faf43a8a943944316501cc5
Instruction ID: b9d73844da9c657c03d5d666fbaf22f2a80c3876ad2761b0dae18602de265253
Opcode Fuzzy Hash: 9624c099be955ac27282aee6e8feb6b4d6941a1a7faf43a8a943944316501cc5
Instruction Fuzzy Hash: 81F0AF2490030D678F40BBA5EC46CBE7B6E5E40350B604139BA14D6697EF71EA268685

Uniqueness

Uniqueness Score: -1.00%

Function 00743017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 0074302F
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00743044

Strings

aut, xrefs: 00743038

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 12435f73c79b8c93f44dd01208a040813a5f9e4d8c42e0d4135ebda64f38900d
Instruction ID: c0ca576805dbb845f597cac923ba711d507ade49646d5fa07fe5abf165e31afc
Opcode Fuzzy Hash: 12435f73c79b8c93f44dd01208a040813a5f9e4d8c42e0d4135ebda64f38900d
Instruction Fuzzy Hash: B9D05B715003146BDA209794EC0DFD73A6CD704750F004251BA96D6091DAF89544CAD4

Uniqueness

Uniqueness Score: -1.00%

Function 00757F59 Relevance: 4.9, APIs: 3, Instructions: 430COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,00000067,000000FF,?,?,?), ref: 007582F5
TerminateProcess.KERNEL32(00000000), ref: 007582FC
FreeLibrary.KERNEL32(?,?,?,?), ref: 007584DD

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Process$CurrentFreeLibraryTerminate
String ID:
API String ID: 146820519-0
Opcode ID: 24c73e08cb2023b97aac20ce09ac73ba743f85452ce88929c1b519645db0b259
Instruction ID: 492b68a35eb308cde17d29ef77a5c1290b98a34d2730457b71771603d70e04b6
Opcode Fuzzy Hash: 24c73e08cb2023b97aac20ce09ac73ba743f85452ce88929c1b519645db0b259
Instruction Fuzzy Hash: 75128971A08341CFC754DF28C484B6ABBE1BF88315F04895DE8999B392DB74ED49CB92

Uniqueness

Uniqueness Score: -1.00%

Function 006D10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 006D1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 006D1BF4
Part of subcall function 006D1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 006D1BFC
Part of subcall function 006D1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 006D1C07
Part of subcall function 006D1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 006D1C12
Part of subcall function 006D1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 006D1C1A
Part of subcall function 006D1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 006D1C22

Part of subcall function 006D1B4A: RegisterWindowMessageW.USER32(00000004,?,006D12C4), ref: 006D1BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 006D136A
OleInitialize.OLE32 ref: 006D1388
CloseHandle.KERNEL32(00000000,00000000), ref: 007124AB

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 0bcfe639f88879c6f69d3b224a70e40c5c3f1fd45fd58c7fb386079a14c7a82a
Instruction ID: 9f17bce51822351b02d89f9c5d9e550283cde2b9cd763b378b77b8fce3830cc7
Opcode Fuzzy Hash: 0bcfe639f88879c6f69d3b224a70e40c5c3f1fd45fd58c7fb386079a14c7a82a
Instruction Fuzzy Hash: 0771ADB8D053508EE388DF79A8556653AE1BBCB394B84C22ED41ACB361EB3C4450CF4D

Uniqueness

Uniqueness Score: -1.00%

Function 006D54C6 Relevance: 4.6, APIs: 3, Instructions: 103COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000001,?,00000000), ref: 006D556D
SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001), ref: 006D557D

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 61cc7047ccae535b3b8f35f37f63957d47c67e1100644cf54cf3716a1a6be66a
Instruction ID: 324f777e3f7241a3dfa0e983bf6925132d86f33d0ae656c4cce722fa51764e2c
Opcode Fuzzy Hash: 61cc7047ccae535b3b8f35f37f63957d47c67e1100644cf54cf3716a1a6be66a
Instruction Fuzzy Hash: 05314D71A00609EFDB15CF28D880B99B7B6FB48314F14862AE91697740D775FEA4CB90

Uniqueness

Uniqueness Score: -1.00%

Function 007086AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,007085CC,?,00798CC8,0000000C), ref: 00708704
GetLastError.KERNEL32(?,007085CC,?,00798CC8,0000000C), ref: 0070870E
__dosmaperr.LIBCMT ref: 00708739

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: 1f3ace2534ec1a84c40c088d125207bb0b5266ea70c8fa8b1b060441bec4b30f
Instruction ID: 692483a3ab54d14df2aed2cacb12682a3488c419d939deebaf568e5245d38394
Opcode Fuzzy Hash: 1f3ace2534ec1a84c40c088d125207bb0b5266ea70c8fa8b1b060441bec4b30f
Instruction Fuzzy Hash: 6E018232604220D6C6A06374984977F6BC54B92778F3A0319F8449B1D3DEAECC818696

Uniqueness

Uniqueness Score: -1.00%

Function 00742FD8 Relevance: 4.5, APIs: 3, Instructions: 27filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,00000000,?,?,00742CD4,?,?,?,00000004,00000001), ref: 00742FF2
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00742CD4,?,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00743006
CloseHandle.KERNEL32(00000000,?,00742CD4,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 0074300D

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 4df2f300734c34f3ecb1ca41f86b93a254bf06f43d938499bfbbbc7d656619c2
Instruction ID: dd4e283d859ded6fdf0dd26c028b53e92d08271436bc54c910d74d90e3d2b355
Opcode Fuzzy Hash: 4df2f300734c34f3ecb1ca41f86b93a254bf06f43d938499bfbbbc7d656619c2
Instruction Fuzzy Hash: BCE0863228031477D6352756BC0DF9B3A5CD786B71F118210F7AA751D086E5250142AC

Uniqueness

Uniqueness Score: -1.00%

Function 006E1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 006E17F6

Strings

CALL, xrefs: 006E17C6

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 509a72afa86ebbcc6de8e12583905fe8b33f592e2870c0288b05dfecbb48081b
Instruction ID: f6da508861ad4953d508e1535e926df3e83e9875443ea41a12b65b0f5a42479b
Opcode Fuzzy Hash: 509a72afa86ebbcc6de8e12583905fe8b33f592e2870c0288b05dfecbb48081b
Instruction Fuzzy Hash: AE22BEB0609381DFC714DF15C480A2ABBF2BF86314F24895EF4968B3A2D735E955DB82

Uniqueness

Uniqueness Score: -1.00%

Function 00746EF1 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 297COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00746F6B

Part of subcall function 006D4ECB: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4EFD

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00746F5A, 00746F63

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: LibraryLoad_wcslen
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 3312870042-2806939583
Opcode ID: b205f975b122a5bfa5a7af97bb1c52a299224c204401b5b1f7c3169816acb848
Instruction ID: ba556efb17790d468b4679f8ad39c5c8b89a74873f183d39f8a95131d7afef9c
Opcode Fuzzy Hash: b205f975b122a5bfa5a7af97bb1c52a299224c204401b5b1f7c3169816acb848
Instruction Fuzzy Hash: C9B181315082018FCB58EF24D49196EB7E6BF94310F04895EF896973A2EF34ED49CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00742557 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00742587

Strings

EA06, xrefs: 007425B9

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: __fread_nolock
String ID: EA06
API String ID: 2638373210-3962188686
Opcode ID: 2aaa211946ca004be0fbfac83bf44f52a32881ab08cbab255393847560222f4a
Instruction ID: 23abeb72c3a8032d126283f335a7ac7ed2691ffe952cb8db910ec02898426db4
Opcode Fuzzy Hash: 2aaa211946ca004be0fbfac83bf44f52a32881ab08cbab255393847560222f4a
Instruction Fuzzy Hash: 9F01B5729042587EDF58D7A8CC56EBEBBF8DB05305F00459EF252D21C2E5B9E7188B60

Uniqueness

Uniqueness Score: -1.00%

Function 006D3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 006D3908

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: adb28ec2223352f5104074ac1a07ba821361ee7aaaf62b0607d5f67549f1b09c
Instruction ID: 79c42ccf176c1bb4e22486b7fba26b862c6b782aefb7d067f0c048c44b7b10dd
Opcode Fuzzy Hash: adb28ec2223352f5104074ac1a07ba821361ee7aaaf62b0607d5f67549f1b09c
Instruction Fuzzy Hash: 29317F709043119FE761DF24D885797BBE8FB49708F00092EF59A97380E7B5AA44CB56

Uniqueness

Uniqueness Score: -1.00%

Function 006D5745 Relevance: 3.1, APIs: 2, Instructions: 56fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,006D949C,?,00008000), ref: 006D5773
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,?,?,006D949C,?,00008000), ref: 00714052

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 298f3c27fa7c68238330becef5bbabcf1b9e56ada1568108029b39bf56ca598f
Instruction ID: 346007ad283ce3e9b144501b5bb7471edee31e46c44241eafa73c8a1764f2ad4
Opcode Fuzzy Hash: 298f3c27fa7c68238330becef5bbabcf1b9e56ada1568108029b39bf56ca598f
Instruction Fuzzy Hash: F1018030545325B6E3310A2ACC0EFA77F99EF067B0F208201BAAD5A2E0C7B45855CB94

Uniqueness

Uniqueness Score: -1.00%

Function 015412FD Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 01541B2D
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01541B51
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 01541B73

Memory Dump Source

Source File: 00000000.00000002.2100886020.0000000001540000.00000040.00001000.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FAR.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
Instruction ID: 28a45b32559271609c4eb5b82c21bb9cd58f0a9e2b9a5db56336373273321ee2
Opcode Fuzzy Hash: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
Instruction Fuzzy Hash: 7812EC24E24658C6EB24DF64D8507DEB232FF68300F1090E9910DEB7A4E77A5F81CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 006D4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 006D4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,006D4EDD,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4E9C
Part of subcall function 006D4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 006D4EAE
Part of subcall function 006D4E90: FreeLibrary.KERNEL32(00000000,?,?,006D4EDD,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4EC0

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4EFD

Part of subcall function 006D4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00713CDE,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4E62
Part of subcall function 006D4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 006D4E74
Part of subcall function 006D4E59: FreeLibrary.KERNEL32(00000000,?,?,00713CDE,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4E87

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 3384d938227856286177b584c6346504aad8db13baf462737e5054dba906d9d4
Instruction ID: 3769fc95d8d3bfc9fa5135d166221eefd0471c2d829a7552919076a1cec7f099
Opcode Fuzzy Hash: 3384d938227856286177b584c6346504aad8db13baf462737e5054dba906d9d4
Instruction Fuzzy Hash: C511E332A10205ABCB14AF64DC06FAD77A6AF80710F10842FF542A62E1EE759E4597A8

Uniqueness

Uniqueness Score: -1.00%

Function 00708402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00708440

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 8f691da837c2b9d5e3b2184535bbfddf57517aa4d00098b90e1ff1029d6efb54
Instruction ID: 9e74547d622ed3aa9fcfc4ab4b14abffb69a5afdee45ef2d717e5a564d98165f
Opcode Fuzzy Hash: 8f691da837c2b9d5e3b2184535bbfddf57517aa4d00098b90e1ff1029d6efb54
Instruction Fuzzy Hash: A911487190410AEFCB05DF58E9459DE7BF4EF48300F104159F808AB352DA30EA11CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 006D9A40 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,00000000,00000000,?,?,00000000,?,006D543F,?,00010000,00000000,00000000,00000000,00000000), ref: 006D9A9C

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: b276c0220771caa3507def97566c475bd086dce3efe55db1224fd6a55891fa6f
Instruction ID: ff09315885b6a971cc6fba888ee036656481c24d39c6c56eeb2224d3343062b4
Opcode Fuzzy Hash: b276c0220771caa3507def97566c475bd086dce3efe55db1224fd6a55891fa6f
Instruction Fuzzy Hash: F6114C32604B059FD720CF09C880BA6B7FAEF44754F18C42EE59B86751C770A945CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00705000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00704C7D: RtlAllocateHeap.NTDLL(00000008,006D1129,00000000,?,00702E29,00000001,00000364,?,?,?,006FF2DE,00703863,007A1444,?,006EFDF5,?), ref: 00704CBE

_free.LIBCMT ref: 0070506C

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: 11cf934ffb77c74cd605304aa006e28a374b8a00ecd16baae9fbab7f5e5de82b
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: 13012672204704EBE3218E65D885A5BFBECFB89370F250B1DE184972C0EA34A805CAB4

Uniqueness

Uniqueness Score: -1.00%

Function 006FE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 01e240f1e917896abc80fe4516ec04b53bd0c628eb0e8dd1ba13734fee0edde0
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 52F0F932510A1CD6C6313E698C09BBA37DA9F52335F100719F721D62E2DF75A40286AA

Uniqueness

Uniqueness Score: -1.00%

Function 00704C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,006D1129,00000000,?,00702E29,00000001,00000364,?,?,?,006FF2DE,00703863,007A1444,?,006EFDF5,?), ref: 00704CBE

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2a1da503a197f9b7ce5f53b2590544daa5a8d2e2f6e172effb38e5e2b0a3a7dc
Instruction ID: 3199269f572017f9a9c47764da8140db7e3c88412d754547f9726722210c50b0
Opcode Fuzzy Hash: 2a1da503a197f9b7ce5f53b2590544daa5a8d2e2f6e172effb38e5e2b0a3a7dc
Instruction Fuzzy Hash: 43F0B471602228E7FB215F629C09B6B37C9AF817A0F148315FA1AA61C1CA78DC0046F4

Uniqueness

Uniqueness Score: -1.00%

Function 00703820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,007A1444,?,006EFDF5,?,?,006DA976,00000010,007A1440,006D13FC,?,006D13C6,?,006D1129), ref: 00703852

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 07224ee06ba8bbdae8e40ca07ef8ee1516b08c0374c19c0fcf1cdc2d67d875c3
Instruction ID: 09fa9a2ec818a8685a1700816b2f390152e1071dd1a73c792986c850c77d881d
Opcode Fuzzy Hash: 07224ee06ba8bbdae8e40ca07ef8ee1516b08c0374c19c0fcf1cdc2d67d875c3
Instruction Fuzzy Hash: EEE0E531101228DAE7212A669C01BAB37CEAF827B0F0582A5FD05928C0CB59DE0182F4

Uniqueness

Uniqueness Score: -1.00%

Function 006D4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4F6D

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 6f379503e744c828ed5a7a4d3527db2dc167e4f66e722b20b2b062dffc90dd9a
Instruction ID: b1c3d25e88725391489fe39014f31fdd2428bd8c71544a5fa44e7e858eb0eb40
Opcode Fuzzy Hash: 6f379503e744c828ed5a7a4d3527db2dc167e4f66e722b20b2b062dffc90dd9a
Instruction Fuzzy Hash: 79F01571905752CFDB389F64D490862BBE6AF54329320C96FE2EA82721CB329C44DB50

Uniqueness

Uniqueness Score: -1.00%

Function 006D2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 006D2DC4

Part of subcall function 006D6B57: _wcslen.LIBCMT ref: 006D6B6A

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 563135c96dd1cd83bd4d3c0f82aa29a19eab532faf434f93fec962cb82b71e52
Instruction ID: 96d139bb0ee0fadfac485d8c487a3b054639c80b056c9e4d9a34d1f3b425df6e
Opcode Fuzzy Hash: 563135c96dd1cd83bd4d3c0f82aa29a19eab532faf434f93fec962cb82b71e52
Instruction Fuzzy Hash: 48E0CD72A042245BC711A258DC05FEA77EDDFC8790F044076FD09D7248D964AD808554

Uniqueness

Uniqueness Score: -1.00%

Function 00742693 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 007426B5

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 62c4ae1466583100269b95fce18df2779376e23d7999e61a0ae1b5108404e028
Instruction ID: 5af7a22c18f3a1d3a3e355b2a7601ce10ab7de3fbd559ca8b801ade10961ad6c
Opcode Fuzzy Hash: 62c4ae1466583100269b95fce18df2779376e23d7999e61a0ae1b5108404e028
Instruction Fuzzy Hash: 9CE048B06097005FDF395E28A8517B677D59F49340F00045EF69B83653E6726856864D

Uniqueness

Uniqueness Score: -1.00%

Function 006D2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 006D3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 006D3908

Part of subcall function 006DD730: GetInputState.USER32 ref: 006DD807

SetCurrentDirectoryW.KERNEL32(?), ref: 006D2B6B

Part of subcall function 006D30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 006D314E

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 8e08083ccb4785e4b37018182a35aefbb346bb1311863634109e1ca0bef28834
Instruction ID: edef477a271c63e4342d898df42b961692f0689ed6ecfbeef44e16163f68a6d8
Opcode Fuzzy Hash: 8e08083ccb4785e4b37018182a35aefbb346bb1311863634109e1ca0bef28834
Instruction Fuzzy Hash: 5DE08621F0425406CA48BB75A8525BDB75B9BD6355F40553FF14283362CE684945426B

Uniqueness

Uniqueness Score: -1.00%

Function 0071039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00710704,?,?,00000000,?,00710704,00000000,0000000C), ref: 007103B7

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4e6aa5a6ef8f924cad1b38639b3a92f54c517a509182a61a8fd547d73fc8e583
Instruction ID: d477e03677c6218b0e6dc21e58d2b071fe16924a180e92311d64b03e088f60c5
Opcode Fuzzy Hash: 4e6aa5a6ef8f924cad1b38639b3a92f54c517a509182a61a8fd547d73fc8e583
Instruction Fuzzy Hash: 57D06C3204020DBBDF028F84DD06EDA3BAAFB48714F018000FE5856020C776E821AB94

Uniqueness

Uniqueness Score: -1.00%

Function 006D1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 006D1CBC

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 23e464ea5a9d661a48ab30560df067c658f9e8b9fc96428defa99192b8fb3478
Instruction ID: 437d8e80dc457f589fb94835ac0b8ea9e3086a13963fd3a3fd871fd89376ef4c
Opcode Fuzzy Hash: 23e464ea5a9d661a48ab30560df067c658f9e8b9fc96428defa99192b8fb3478
Instruction Fuzzy Hash: DFC09B352803049FF6154B84BC5AF107754B389B10F54C001F64A555E3C3E51430DA58

Uniqueness

Uniqueness Score: -1.00%

Function 0074744A Relevance: 1.5, APIs: 1, Instructions: 220COMMON

Download Yara Rule

APIs

Part of subcall function 006D5745: CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,006D949C,?,00008000), ref: 006D5773

GetLastError.KERNEL32(00000002,00000000), ref: 007476DE

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: 9139217b49f0d6fbf8306fcccd8b4d4264967c36d87a3ec3481ef98cc3a16f15
Instruction ID: 3af75a5d5b8f53d49ffd51c9acb6b61f9fb134d8550b67a20c25b822f1501558
Opcode Fuzzy Hash: 9139217b49f0d6fbf8306fcccd8b4d4264967c36d87a3ec3481ef98cc3a16f15
Instruction Fuzzy Hash: 0781A2306087019FCB59EF28C491B69B7E2BF89310F05491EF8865B392DB34ED45CB96

Uniqueness

Uniqueness Score: -1.00%

Function 006EFC70 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 006EFD1F

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 25dd7bffc6e890be414f4559e2f7636999aa0405ef473f3cd4b0355041b4ef49
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 8031F575A01249DBD718CF5AD4809A9FBA2FF49310B7486A5E809CB755E731EDC1CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 01542300 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 01542311

Memory Dump Source

Source File: 00000000.00000002.2100886020.0000000001540000.00000040.00001000.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FAR.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: ada75789803c6da979cb7e7b43b0521b0eda98a82c4fc1e18519e2a71427ceca
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: BDE0E67494010DDFDB00EFB4D54969E7FB4FF04701F100561FD01D2281D6309D508A72

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00769576 Relevance: 74.1, APIs: 39, Strings: 3, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 006E9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 006E9BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0076961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0076965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0076969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 007696C9
SendMessageW.USER32 ref: 007696F2
GetKeyState.USER32(00000011), ref: 0076978B
GetKeyState.USER32(00000009), ref: 00769798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 007697AE
GetKeyState.USER32(00000010), ref: 007697B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 007697E9
SendMessageW.USER32 ref: 00769810
SendMessageW.USER32(?,00001030,?,00767E95), ref: 00769918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0076992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00769941
SetCapture.USER32(?), ref: 0076994A
ClientToScreen.USER32(?,?), ref: 007699AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 007699BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 007699D6
ReleaseCapture.USER32 ref: 007699E1
GetCursorPos.USER32(?), ref: 00769A19
ScreenToClient.USER32(?,?), ref: 00769A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00769A80
SendMessageW.USER32 ref: 00769AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00769AEB
SendMessageW.USER32 ref: 00769B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00769B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00769B4A
GetCursorPos.USER32(?), ref: 00769B68
ScreenToClient.USER32(?,?), ref: 00769B75
GetParent.USER32(?), ref: 00769B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00769BFA
SendMessageW.USER32 ref: 00769C2B
ClientToScreen.USER32(?,?), ref: 00769C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00769CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00769CDE
SendMessageW.USER32 ref: 00769D01
ClientToScreen.USER32(?,?), ref: 00769D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00769D82

Part of subcall function 006E9944: GetWindowLongW.USER32(?,000000EB), ref: 006E9952

GetWindowLongW.USER32(?,000000F0), ref: 00769E05

Strings

p#z, xrefs: 00769990
F, xrefs: 00769D07
@GUI_DRAGID, xrefs: 0076997D

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F$p#z
API String ID: 3429851547-1540955567
Opcode ID: 18407d5d379044c738a14a471f30f9b7a152623ffde180bb60533c7ac23c1760
Instruction ID: 7a275131c28007e500befe792f2272de77986f046660e3848057fefe466901d2
Opcode Fuzzy Hash: 18407d5d379044c738a14a471f30f9b7a152623ffde180bb60533c7ac23c1760
Instruction Fuzzy Hash: 44429C34204341EFDB25CF28CC44AAABBE9FF89310F14465DFA9A872A1D779E850CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00764873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 007648F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00764908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00764927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 0076494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 0076495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 0076497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 007649AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 007649D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00764A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00764A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00764A7E
IsMenu.USER32(?), ref: 00764A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00764AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00764B20
GetWindowLongW.USER32(?,000000F0), ref: 00764B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00764BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00764C82
wsprintfW.USER32 ref: 00764CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00764CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00764CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00764D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00764D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00764D5A

Strings

%d/%02d/%02d, xrefs: 00764CA8

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: d5d44792b1b92751a0229674857614c4d5ea4eeedd68674eb412d0029f4cd1d8
Instruction ID: ad4ffb4d250d748a69cbfe89c402f1c4327c732937e39f5e5be5d4a7b59b8de7
Opcode Fuzzy Hash: d5d44792b1b92751a0229674857614c4d5ea4eeedd68674eb412d0029f4cd1d8
Instruction Fuzzy Hash: CB12FD71600345ABEB258F24DC49FBE7BF8EF45310F148169F916EB2A1DBB89940CB54

Uniqueness

Uniqueness Score: -1.00%

Function 006EF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 006EF998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0072F474
IsIconic.USER32(00000000), ref: 0072F47D
ShowWindow.USER32(00000000,00000009), ref: 0072F48A
SetForegroundWindow.USER32(00000000), ref: 0072F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0072F4AA
GetCurrentThreadId.KERNEL32 ref: 0072F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0072F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 0072F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 0072F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 0072F4DE
SetForegroundWindow.USER32(00000000), ref: 0072F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 0072F4F6
keybd_event.USER32(00000012,00000000), ref: 0072F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 0072F50B
keybd_event.USER32(00000012,00000000), ref: 0072F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 0072F519
keybd_event.USER32(00000012,00000000), ref: 0072F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 0072F528
keybd_event.USER32(00000012,00000000), ref: 0072F52D
SetForegroundWindow.USER32(00000000), ref: 0072F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 0072F557

Strings

Shell_TrayWnd, xrefs: 0072F46F

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 17de642866ee97a1ccacce39f5d04e374aea8e4a31b135403823bef0630b0f23
Instruction ID: 926c1e45b0aee2b34e01e9e6b845a478888befba4b1de5e980da59b5c3e4829e
Opcode Fuzzy Hash: 17de642866ee97a1ccacce39f5d04e374aea8e4a31b135403823bef0630b0f23
Instruction Fuzzy Hash: F2319671A403187BEB216FB65C4AFBF7E7CEB44B50F204065F602E61D1C6F55D10AA64

Uniqueness

Uniqueness Score: -1.00%

Function 00731201 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 007316C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0073170D
Part of subcall function 007316C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0073173A
Part of subcall function 007316C3: GetLastError.KERNEL32 ref: 0073174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00731286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 007312A8
CloseHandle.KERNEL32(?), ref: 007312B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 007312D1
GetProcessWindowStation.USER32 ref: 007312EA
SetProcessWindowStation.USER32(00000000), ref: 007312F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00731310

Part of subcall function 007310BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,007311FC), ref: 007310D4
Part of subcall function 007310BF: CloseHandle.KERNEL32(?,?,007311FC), ref: 007310E9

Strings

, xrefs: 0073125A
Zy, xrefs: 00731392
winsta0, xrefs: 007312CC
default, xrefs: 0073130B

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0$Zy
API String ID: 22674027-3658735108
Opcode ID: 26597b89d09fd08367231ad6219be8908724a0f2f93460ee0d6e83ae2b29a5be
Instruction ID: 2286707e369433f30c1929e76b8c96cb9e6e2cba471c3f6a0c462a38e4463468
Opcode Fuzzy Hash: 26597b89d09fd08367231ad6219be8908724a0f2f93460ee0d6e83ae2b29a5be
Instruction Fuzzy Hash: AB81AC71900349AFEF219FA4DC49FFE7BB9EF04700F188129F911A61A2CB798944CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00730B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 007310F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00731114
Part of subcall function 007310F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00730B9B,?,?,?), ref: 00731120
Part of subcall function 007310F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00730B9B,?,?,?), ref: 0073112F
Part of subcall function 007310F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00730B9B,?,?,?), ref: 00731136
Part of subcall function 007310F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0073114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00730BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00730C00
GetLengthSid.ADVAPI32(?), ref: 00730C17
GetAce.ADVAPI32(?,00000000,?), ref: 00730C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00730C6D
GetLengthSid.ADVAPI32(?), ref: 00730C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00730C8C
HeapAlloc.KERNEL32(00000000), ref: 00730C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00730CB4
CopySid.ADVAPI32(00000000), ref: 00730CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00730CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00730D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00730D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00730D45
HeapFree.KERNEL32(00000000), ref: 00730D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00730D55
HeapFree.KERNEL32(00000000), ref: 00730D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00730D65
HeapFree.KERNEL32(00000000), ref: 00730D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00730D78
HeapFree.KERNEL32(00000000), ref: 00730D7F

Part of subcall function 00731193: GetProcessHeap.KERNEL32(00000008,00730BB1,?,00000000,?,00730BB1,?), ref: 007311A1
Part of subcall function 00731193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00730BB1,?), ref: 007311A8
Part of subcall function 00731193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00730BB1,?), ref: 007311B7

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: d0da6c846c2da9ede811e80dd3f2df1d32031d6f1a5231efb55b3de6e90706bc
Instruction ID: 2e4cc43748dea0ee93f3fc4515fb786a8a89af4e5da4d4779ff994940bc917d0
Opcode Fuzzy Hash: d0da6c846c2da9ede811e80dd3f2df1d32031d6f1a5231efb55b3de6e90706bc
Instruction Fuzzy Hash: 13717D72A0020AABEF11DFA4DC45FEEBBB8BF04300F048555E955A7192D7B9A905CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 0074EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0076CC08), ref: 0074EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 0074EB37
GetClipboardData.USER32(0000000D), ref: 0074EB43
CloseClipboard.USER32 ref: 0074EB4F
GlobalLock.KERNEL32(00000000), ref: 0074EB87
CloseClipboard.USER32 ref: 0074EB91
GlobalUnlock.KERNEL32(00000000,00000000), ref: 0074EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 0074EBC9
GetClipboardData.USER32(00000001), ref: 0074EBD1
GlobalLock.KERNEL32(00000000), ref: 0074EBE2
GlobalUnlock.KERNEL32(00000000,?), ref: 0074EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 0074EC38
GetClipboardData.USER32(0000000F), ref: 0074EC44
GlobalLock.KERNEL32(00000000), ref: 0074EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 0074EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0074EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0074ECD2
GlobalUnlock.KERNEL32(00000000,?,?), ref: 0074ECF3
CountClipboardFormats.USER32 ref: 0074ED14
CloseClipboard.USER32 ref: 0074ED59

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: e6de626559e3714a5b2a4c68e8a654830f8243c08acc1ddeee093c2b34f3a24c
Instruction ID: 26bca0bc1d2f79236c8b5b7e59c8c7fe617b200fc349f9ecedf46cbd8b36394c
Opcode Fuzzy Hash: e6de626559e3714a5b2a4c68e8a654830f8243c08acc1ddeee093c2b34f3a24c
Instruction Fuzzy Hash: E661AC742043019FD301EF24D898F3A77A5FF84724F08855EF896872A2CB79E905CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0074698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 007469BE
FindClose.KERNEL32(00000000), ref: 00746A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00746A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00746A75

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00746AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00746ADF

Strings

%4d%02d%02d%02d%02d%02d%03d, xrefs: 00746B32
%02d, xrefs: 00746C00, 00746C0A, 00746C5A, 00746CAA, 00746CFA, 00746D4A
%4d, xrefs: 00746BB1
%03d, xrefs: 00746DA2
%4d%02d%02d%02d%02d%02d, xrefs: 00746B6A

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: ce5ab46fd1609299e68eb528a3760ec7fe76e7fba490e43b7a37ed0cebaf3dc8
Instruction ID: fe9c467129c160baf71d1a7cbb9fe03151f040d5701f3ae4040243f957447cb9
Opcode Fuzzy Hash: ce5ab46fd1609299e68eb528a3760ec7fe76e7fba490e43b7a37ed0cebaf3dc8
Instruction Fuzzy Hash: 42D173B1908340AFC754EBA4D891EABB7EDBF88704F44491EF585C7291EB74DA04CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00749642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 00749663
GetFileAttributesW.KERNEL32(?), ref: 007496A1
SetFileAttributesW.KERNEL32(?,?), ref: 007496BB
FindNextFileW.KERNEL32(00000000,?), ref: 007496D3
FindClose.KERNEL32(00000000), ref: 007496DE
FindFirstFileW.KERNEL32(*.*,?), ref: 007496FA
SetCurrentDirectoryW.KERNEL32(?), ref: 0074974A
SetCurrentDirectoryW.KERNEL32(00796B7C), ref: 00749768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00749772
FindClose.KERNEL32(00000000), ref: 0074977F
FindClose.KERNEL32(00000000), ref: 0074978F

Strings

*.*, xrefs: 007496F5

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 6a189900d562fd0f3cfdd0de180322517b7f1be12165ae9442f54888fe8bf475
Instruction ID: 9dd12a5f6265c9a0a3a34b12d2d3c94abe420f8161b55ac953df22588976fcbd
Opcode Fuzzy Hash: 6a189900d562fd0f3cfdd0de180322517b7f1be12165ae9442f54888fe8bf475
Instruction Fuzzy Hash: B731F9725402196EDF11EFB4DC09AEF77ACAF09320F148156FA56E2190EB78DE448B14

Uniqueness

Uniqueness Score: -1.00%

Function 0074979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 007497BE
FindNextFileW.KERNEL32(00000000,?), ref: 00749819
FindClose.KERNEL32(00000000), ref: 00749824
FindFirstFileW.KERNEL32(*.*,?), ref: 00749840
SetCurrentDirectoryW.KERNEL32(?), ref: 00749890
SetCurrentDirectoryW.KERNEL32(00796B7C), ref: 007498AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 007498B8
FindClose.KERNEL32(00000000), ref: 007498C5
FindClose.KERNEL32(00000000), ref: 007498D5

Part of subcall function 0073DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 0073DB00

Strings

*.*, xrefs: 0074983B

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: c780874a21ad45ac86f7947febb4d53a835f8b8b8cef2efe8260e8610610cd08
Instruction ID: c049285ddb61d30c35fcd9dfff684781a7d875f4b443f07a49a77d302ff12b77
Opcode Fuzzy Hash: c780874a21ad45ac86f7947febb4d53a835f8b8b8cef2efe8260e8610610cd08
Instruction Fuzzy Hash: C931E4715003196EEF11EFB8EC49AEF77ACAF06320F148256FA51A2191DB78DE44CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00748195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00748257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00748267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00748273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00748310
SetCurrentDirectoryW.KERNEL32(?), ref: 00748324
SetCurrentDirectoryW.KERNEL32(?), ref: 00748356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0074838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00748395

Strings

*.*, xrefs: 0074839B

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 0c3c1c8d972425a22753478f90c2e5629657babe5ecc5d1133feb463515690b3
Instruction ID: b7adcd07df4f8150e2f4655e967cec24d17107c75c5b6f2a12519b71cc609257
Opcode Fuzzy Hash: 0c3c1c8d972425a22753478f90c2e5629657babe5ecc5d1133feb463515690b3
Instruction Fuzzy Hash: 5A616A725043099FCB50EF64D8449AEB3E9FF89310F04891EF989C7251EB39E945CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0073D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006D3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006D3A97,?,?,006D2E7F,?,?,?,00000000), ref: 006D3AC2

Part of subcall function 0073E199: GetFileAttributesW.KERNEL32(?,0073CF95), ref: 0073E19A

FindFirstFileW.KERNEL32(?,?), ref: 0073D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 0073D1DD
MoveFileW.KERNEL32(?,?), ref: 0073D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 0073D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 0073D237

Part of subcall function 0073D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,0073D21C,?,?), ref: 0073D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 0073D253
FindClose.KERNEL32(00000000), ref: 0073D264

Strings

\*.*, xrefs: 0073D0CD, 0073D0D6, 0073D0EB

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 8d8350918ee7d2835e02ad51641f89498d10bb290706d340d4796fa6929d2817
Instruction ID: bce085d378b6d754e39ed4505b7288ef27929317601873dc31b4c67e6b6eb938
Opcode Fuzzy Hash: 8d8350918ee7d2835e02ad51641f89498d10bb290706d340d4796fa6929d2817
Instruction Fuzzy Hash: 75618D31D0110D9FDF15EBE0EA929EEB776AF15300F24416AE40277292EB345F09DB65

Uniqueness

Uniqueness Score: -1.00%

Function 0074ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0074ED91
EmptyClipboard.USER32 ref: 0074ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 0074EDAC
CloseClipboard.USER32 ref: 0074EEA3

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: d7bc9851155d743fe890564f93417b07b91641f4f64ea739b960c5818ef115ae
Instruction ID: 76fd42fe24232da41f34ba76e19fb0f16b4ea39360d2add1a9b01192d92906c7
Opcode Fuzzy Hash: d7bc9851155d743fe890564f93417b07b91641f4f64ea739b960c5818ef115ae
Instruction Fuzzy Hash: 1C417935604611AFE721DF15D888F2ABBA5FF44328F14C099E8568B662C779EC42CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0073E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 007316C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0073170D
Part of subcall function 007316C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0073173A
Part of subcall function 007316C3: GetLastError.KERNEL32 ref: 0073174A

ExitWindowsEx.USER32(?,00000000), ref: 0073E932

Strings

SeShutdownPrivilege, xrefs: 0073E902
@, xrefs: 0073E925
, xrefs: 0073E95C
, xrefs: 0073E920

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 29605785c4c4f674a4c988537f27825083788cba4fe7177f13e150eb66884608
Instruction ID: 7644832773076d6076f8b54017c6d6cdc5ef9e16c7ca41c84611a131e81c1e17
Opcode Fuzzy Hash: 29605785c4c4f674a4c988537f27825083788cba4fe7177f13e150eb66884608
Instruction Fuzzy Hash: 4B01D672610315EBFB5466B49C8ABBB725CA714750F154522FC03E21D3D5AD6C408395

Uniqueness

Uniqueness Score: -1.00%

Function 00751204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00751276
WSAGetLastError.WSOCK32 ref: 00751283
bind.WSOCK32(00000000,?,00000010), ref: 007512BA
WSAGetLastError.WSOCK32 ref: 007512C5
closesocket.WSOCK32(00000000), ref: 007512F4
listen.WSOCK32(00000000,00000005), ref: 00751303
WSAGetLastError.WSOCK32 ref: 0075130D
closesocket.WSOCK32(00000000), ref: 0075133C

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: e11f8cacd6958e878d31d180a7fc7d56a5fac0d13bd429cabf37b67a729695c9
Instruction ID: 4a023fd7b94370d9522c3e88ee3e41cf9f48f41cd75a973526b27d2c490e090f
Opcode Fuzzy Hash: e11f8cacd6958e878d31d180a7fc7d56a5fac0d13bd429cabf37b67a729695c9
Instruction Fuzzy Hash: B6419331A002019FD710DF24C498B69BBE6BF86319F588199D8568F396C7B9EC85CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0070B952 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0070B9D4
_free.LIBCMT ref: 0070B9F8
_free.LIBCMT ref: 0070BB7F
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00773700), ref: 0070BB91
WideCharToMultiByte.KERNEL32(00000000,00000000,007A121C,000000FF,00000000,0000003F,00000000,?,?), ref: 0070BC09
WideCharToMultiByte.KERNEL32(00000000,00000000,007A1270,000000FF,?,0000003F,00000000,?), ref: 0070BC36
_free.LIBCMT ref: 0070BD4B

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: ff62f05893bd03654710251118826394acccf7fcb898ef9175009f9c40334fa1
Instruction ID: 8b73b1cf3add4b2e3befb79fdd0ba1a848c2488a021a9335b104180babde4212
Opcode Fuzzy Hash: ff62f05893bd03654710251118826394acccf7fcb898ef9175009f9c40334fa1
Instruction Fuzzy Hash: A6C118B1A04205DFDB20DF688C45BAABBE9EF82310F64839AE594D72D1D7389F418754

Uniqueness

Uniqueness Score: -1.00%

Function 0073D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006D3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006D3A97,?,?,006D2E7F,?,?,?,00000000), ref: 006D3AC2

Part of subcall function 0073E199: GetFileAttributesW.KERNEL32(?,0073CF95), ref: 0073E19A

FindFirstFileW.KERNEL32(?,?), ref: 0073D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 0073D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 0073D481
FindClose.KERNEL32(00000000), ref: 0073D498
FindClose.KERNEL32(00000000), ref: 0073D4A1

Strings

\*.*, xrefs: 0073D3F2

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 259ae27599149230326c94fc5309cffa0ad0133f2c9da835e2d544ee5b2c9276
Instruction ID: eac0b61cea7083ceae01ddbda10383e577232688b13f8a8e79fb91f9164828a7
Opcode Fuzzy Hash: 259ae27599149230326c94fc5309cffa0ad0133f2c9da835e2d544ee5b2c9276
Instruction Fuzzy Hash: 793190314083819FD315EF60D8918AFB7A9BE91300F444A1EF8D152292EB34AE09C7A7

Uniqueness

Uniqueness Score: -1.00%

Function 0070E4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0070E645

Strings

1#QNAN, xrefs: 0070F84B
1#SNAN, xrefs: 0070F844
1#IND, xrefs: 0070F83D
1#INF, xrefs: 0070F852

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 4e7c5b1c64c152118a28c5fc1936f06ccb31f59c6b77d74653aaee0572b1885b
Instruction ID: fc4c059e3dd3992df76e8b32b6770aea6016ab072556c73e08d9e955c1b7d637
Opcode Fuzzy Hash: 4e7c5b1c64c152118a28c5fc1936f06ccb31f59c6b77d74653aaee0572b1885b
Instruction Fuzzy Hash: C1C22971E04628CFDB65CE289D407EAB7F5EB44314F1446EAD84DE7281E778AE818F40

Uniqueness

Uniqueness Score: -1.00%

Function 0074648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 007464DC
CoInitialize.OLE32(00000000), ref: 00746639
CoCreateInstance.OLE32(0076FCF8,00000000,00000001,0076FB68,?), ref: 00746650
CoUninitialize.OLE32 ref: 007468D4

Strings

.lnk, xrefs: 007464BA, 00746524, 007465E0

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 23728add326f4e8799e038a8273b90ec5e76e3cf346854aa68f885b76ec5ca21
Instruction ID: cb9ef2f34f99fcac94052ca47b1de849c821af0f6a8f52df6ca59be83f865122
Opcode Fuzzy Hash: 23728add326f4e8799e038a8273b90ec5e76e3cf346854aa68f885b76ec5ca21
Instruction Fuzzy Hash: 80D12871908301AFC354EF24C88196BB7E9FF95704F40496DF5958B2A1EB71ED05CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 007522DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 007522E8

Part of subcall function 0074E4EC: GetWindowRect.USER32(?,?), ref: 0074E504

GetDesktopWindow.USER32 ref: 00752312
GetWindowRect.USER32(00000000), ref: 00752319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00752355
GetCursorPos.USER32(?), ref: 00752381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 007523DF

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 765aaeedce4ff849935b1ed7c3d945a0398f145955c4d746b5e8d2adc2ed0767
Instruction ID: ada55b00d8781adb8c5756bfe7e74830e864a914e828ce3784f89565fd000adf
Opcode Fuzzy Hash: 765aaeedce4ff849935b1ed7c3d945a0398f145955c4d746b5e8d2adc2ed0767
Instruction Fuzzy Hash: 1F310072104345AFD720DF54CC48BABBBA9FF85310F000919F98697182DBB8EA09CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00749B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00749B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00749C8B

Part of subcall function 00743874: GetInputState.USER32 ref: 007438CB
Part of subcall function 00743874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00743966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00749BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00749C75

Strings

*.*, xrefs: 00749B5D

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: b3df43d570d51e2f402f6c553749f3b61d804d4bbd63d15b49ce6f7720d72e27
Instruction ID: 182ebe23035464f94f5a1a4284ce08357c866eb50e0760f73a40d2cca932f5be
Opcode Fuzzy Hash: b3df43d570d51e2f402f6c553749f3b61d804d4bbd63d15b49ce6f7720d72e27
Instruction Fuzzy Hash: 6C419071D0020A9FCF55DFB4C989AEEBBB9EF05300F24415AE905A2291EB349E84CF64

Uniqueness

Uniqueness Score: -1.00%

Function 006E997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 006E9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 006E9BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 006E9A4E
GetSysColor.USER32(0000000F), ref: 006E9B23
SetBkColor.GDI32(?,00000000), ref: 006E9B36

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 71d67bfb49a92f646ffba73c8a7da5ac1453249e6257f14826549e441ab62c2c
Instruction ID: 28c86317299bfd33e0a8eb43354ab93956642fb2f3a4ce3490b17ac741a9cfeb
Opcode Fuzzy Hash: 71d67bfb49a92f646ffba73c8a7da5ac1453249e6257f14826549e441ab62c2c
Instruction Fuzzy Hash: 08A1397010A7A0FEE72D9A2E9D59DBB365FDF82304F144229F902C6791CA2D9D02C676

Uniqueness

Uniqueness Score: -1.00%

Function 00751806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0075304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0075307A
Part of subcall function 0075304E: _wcslen.LIBCMT ref: 0075309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 0075185D
WSAGetLastError.WSOCK32 ref: 00751884
bind.WSOCK32(00000000,?,00000010), ref: 007518DB
WSAGetLastError.WSOCK32 ref: 007518E6
closesocket.WSOCK32(00000000), ref: 00751915

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 221ae7fb6fafcf6d4f0d8de9b9a7653b987f2afc802010eae11212d87297ac2e
Instruction ID: c407075c5f2950f4b479861e2bb77e6603acefab2388f9c2327bb913dbe9ed29
Opcode Fuzzy Hash: 221ae7fb6fafcf6d4f0d8de9b9a7653b987f2afc802010eae11212d87297ac2e
Instruction Fuzzy Hash: 5551D471A002009FE720AF24C886F6A77E69B44718F54805DF9469F3C3C7B5AD41CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00761C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00761CC0
IsWindowEnabled.USER32 ref: 00761CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00761CDB
IsIconic.USER32 ref: 00761CE9
IsZoomed.USER32 ref: 00761CF7

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 5469aca9d19c6d7456f4cd595aaae1e6a56209e90352807a8c12b26d45962c13
Instruction ID: 57dad3b70f95f710f34e9ebd65a39afcc3aa1d7c0278e67fac60c56f80b37cf1
Opcode Fuzzy Hash: 5469aca9d19c6d7456f4cd595aaae1e6a56209e90352807a8c12b26d45962c13
Instruction Fuzzy Hash: 7A21B1317406019FD7218F2AC848B6A7BA5EF95324B9D8059EC47CB352CBB9DC42CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 006D8060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 006D83E8
ERCP, xrefs: 006D813C
VUUU, xrefs: 00715DF0
VUUU, xrefs: 006D843C
VUUU, xrefs: 006D83FA

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: ba38798e410491dae5b845a6c3c9afdf7cdbd403ea7af68e1c94db77ac390410
Instruction ID: efcc6938f8e35a1f35dbea4f23efc3e309a218667f0b2e7dc190ecb63132d0b8
Opcode Fuzzy Hash: ba38798e410491dae5b845a6c3c9afdf7cdbd403ea7af68e1c94db77ac390410
Instruction Fuzzy Hash: 1CA23C71E0061ACFDF24CF58C8447EDB7B2BB54314F2481AAE855A7385EB789D81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00738298 Relevance: 6.6, APIs: 1, Strings: 3, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 007382AA

Strings

(, xrefs: 007382F0
tby, xrefs: 007384F4
|, xrefs: 007382DA

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: lstrlen
String ID: ($tby$|
API String ID: 1659193697-2466584908
Opcode ID: 0de242d7e481386d20b9973b7026b7ce26163057704f0b49402403698da2ec18
Instruction ID: ba284e5c921038b52b2eb15278b4e4f79bf28b77b3e0acc91572e785a4e4fe4e
Opcode Fuzzy Hash: 0de242d7e481386d20b9973b7026b7ce26163057704f0b49402403698da2ec18
Instruction Fuzzy Hash: B2323574A00705DFDB68CF59C081A6AB7F1FF48710B15856EE49ADB3A2EB74E941CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0075A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0075A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 0075A6BA

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Process32NextW.KERNEL32(00000000,?), ref: 0075A79C
CloseHandle.KERNEL32(00000000), ref: 0075A7AB

Part of subcall function 006ECE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00713303,?), ref: 006ECE8A

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: b02fa3c39eccef152df7966749a865c0280b53784d8aa20ac033c79fa64ed8b8
Instruction ID: 7846b0c523e5dbecaee7f45f4c12ba40fca8bb249599fd89b8535eaecb573475
Opcode Fuzzy Hash: b02fa3c39eccef152df7966749a865c0280b53784d8aa20ac033c79fa64ed8b8
Instruction Fuzzy Hash: 28518F71908300AFD750DF24C885A6BBBE9FF89754F00892EF98597351EB74D904CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0073AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 0073AAAC
SetKeyboardState.USER32(00000080), ref: 0073AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 0073AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 0073AB88

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 4bd650200eb1c085d6d9ef9c9f27ca8063e517b6d0ee1f2c7e1094429be5ee9a
Instruction ID: 129404737919c7410d2705fcaff36fe9de98f035896fdfe152072b2e7bf3ceb6
Opcode Fuzzy Hash: 4bd650200eb1c085d6d9ef9c9f27ca8063e517b6d0ee1f2c7e1094429be5ee9a
Instruction Fuzzy Hash: E131E7B1A40248BEFF35CB65CC06BFABBAAAB44310F04821AE5C1565D2D37D8981C767

Uniqueness

Uniqueness Score: -1.00%

Function 0074CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 0074CE89
GetLastError.KERNEL32(?,00000000), ref: 0074CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 0074CEFE

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 370d55c21c6df1f56bf593ecd3ddd77ff4c135276c20d69096285406fc835a3a
Instruction ID: 5e83847490e8a6298e77c76b65a89ae602836447611fa2be20e10eb850a88be2
Opcode Fuzzy Hash: 370d55c21c6df1f56bf593ecd3ddd77ff4c135276c20d69096285406fc835a3a
Instruction Fuzzy Hash: 8021CFB2501305DFEB62DFA5C948BA77BFCEB00314F10842EE646D2151E778EE088B54

Uniqueness

Uniqueness Score: -1.00%

Function 00745C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00745CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00745D17
FindClose.KERNEL32(?), ref: 00745D5F

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 73242736e3870168cf8150d49649f91d606bbb03bde18f89c77f7e53cf9faeb4
Instruction ID: a565a0a961876adbc12d59d87389946b627acb421cecd4df7ad2889286429179
Opcode Fuzzy Hash: 73242736e3870168cf8150d49649f91d606bbb03bde18f89c77f7e53cf9faeb4
Instruction Fuzzy Hash: EA516874A04A019FC714DF28C494A9AB7E5FF49324F14855EE99A8B3A2DB34ED04CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00702622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0070271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00702724
UnhandledExceptionFilter.KERNEL32(?), ref: 00702731

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 10c37ab6fa80ee9a3f2465fad78fcb503204293edf5eb32fb2fad4c58867823e
Instruction ID: 6de7ad7c03e04120af60d7a20141a5c827c0e0574be8d558ef923d8ef415efe7
Opcode Fuzzy Hash: 10c37ab6fa80ee9a3f2465fad78fcb503204293edf5eb32fb2fad4c58867823e
Instruction Fuzzy Hash: 9631C47591121C9BCB61DF68DC88798BBB8BF08310F5042EAE90CA6261E7749F818F49

Uniqueness

Uniqueness Score: -1.00%

Function 007451CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 007451DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00745238
SetErrorMode.KERNEL32(00000000), ref: 007452A1

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 1368a1a95e7841840ae6ee3b64f494694afe8f662db0178cf1cb354328d4a80a
Instruction ID: cb428331a942e173e58d8081716f406feec75a5c1e3b666248eb3a6dbb6df7db
Opcode Fuzzy Hash: 1368a1a95e7841840ae6ee3b64f494694afe8f662db0178cf1cb354328d4a80a
Instruction Fuzzy Hash: F3318F75A00608DFDB00DF94D884EADBBB5FF49314F08809AE805AB362DB75EC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 007316C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 006EFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 006F0668
Part of subcall function 006EFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 006F0685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0073170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0073173A
GetLastError.KERNEL32 ref: 0073174A

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: b3972c858636e6ab0fa7aff2e3fdc459fc30a003364eef0cd6d1f50bdbc1210d
Instruction ID: 058585ce52833b0e7ae5efef695a214eb2aea3def8902183c3392c42866e24c2
Opcode Fuzzy Hash: b3972c858636e6ab0fa7aff2e3fdc459fc30a003364eef0cd6d1f50bdbc1210d
Instruction Fuzzy Hash: 0011C1B2404309AFE718AF54DC86D6ABBBDEF04754B24852EE05657242EB75BC418B24

Uniqueness

Uniqueness Score: -1.00%

Function 0073D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0073D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 0073D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0073D650

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 92cd15ec0e4607a55dfc0f5c3501bdad32f40509ec84ba31778af0b7981eb8b4
Instruction ID: 4b94de717043dfe8f0183ecbf240466d265ef23043a4e2c3a595e0f54d22b1a6
Opcode Fuzzy Hash: 92cd15ec0e4607a55dfc0f5c3501bdad32f40509ec84ba31778af0b7981eb8b4
Instruction Fuzzy Hash: 4C117C71E01228BFEB208F95EC45FAFBBBCEB45B50F108111F914E7290C2B44A058BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00731663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0073168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 007316A1
FreeSid.ADVAPI32(?), ref: 007316B1

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: fe61f2be3367b20cc2006f2da4fc4e16b2eacfb869aaa6c095d1f1dea4584750
Instruction ID: ce25ff58142e55fb1f2cacf6199394dbe537d454f2c16ef468f29fa9f995e1fd
Opcode Fuzzy Hash: fe61f2be3367b20cc2006f2da4fc4e16b2eacfb869aaa6c095d1f1dea4584750
Instruction Fuzzy Hash: 29F0F471950309FBEB00DFE49D89AAEBBBCEB08604F508565E601E2181E778AA448A54

Uniqueness

Uniqueness Score: -1.00%

Function 006F4CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(007028E9,?,006F4CBE,007028E9,007988B8,0000000C,006F4E15,007028E9,00000002,00000000,?,007028E9), ref: 006F4D09
TerminateProcess.KERNEL32(00000000,?,006F4CBE,007028E9,007988B8,0000000C,006F4E15,007028E9,00000002,00000000,?,007028E9), ref: 006F4D10
ExitProcess.KERNEL32 ref: 006F4D22

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 1718cc2e888df65891bc45fcf5e540061adf48f7a6a3b0a8cc9986c471beacb1
Instruction ID: 53034d1fc41a8cb638c4b4dab46f84ac2bb22d4284ca608a6440f235a070d544
Opcode Fuzzy Hash: 1718cc2e888df65891bc45fcf5e540061adf48f7a6a3b0a8cc9986c471beacb1
Instruction Fuzzy Hash: A8E0B63100024CABDF12AF55DD09AAA3F6AEF86781B108018FD569A722DB79DD42CA84

Uniqueness

Uniqueness Score: -1.00%

Function 0070C2A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 0070C36C

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 3b70dd2df338deecaea4cae5e0a9675701409c17ec331c537c5c7a859d3da43e
Instruction ID: e4962ac9915e105f42fb9ed5e245cadedddf7245ddaaffb5c048f85a8d2ff4cb
Opcode Fuzzy Hash: 3b70dd2df338deecaea4cae5e0a9675701409c17ec331c537c5c7a859d3da43e
Instruction Fuzzy Hash: 15411372900219EBCB209FB9DC89EBBB7B8EB84314F1083A9F905D71C0E6749D818B50

Uniqueness

Uniqueness Score: -1.00%

Function 0072D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0072D28C

Strings

X64, xrefs: 0072D2A8

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: b8cfc341ca2d6c387d59d4fa769c0111609583b75a211ffec9d90fcdf6681f46
Instruction ID: 1119d53399aea9467d0e0056da3568c405e23970d8a8cd78d314b90c0294ea57
Opcode Fuzzy Hash: b8cfc341ca2d6c387d59d4fa769c0111609583b75a211ffec9d90fcdf6681f46
Instruction Fuzzy Hash: 8BD0C9B480122DEACB90CB90EC88DE9B3BCBB04305F104151F106A2000D77495498F20

Uniqueness

Uniqueness Score: -1.00%

Function 006FCAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: ba0365c1a72ca61a4afb93015a2935d88e6a427ea186bc285cec63f6549ed68a
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 73020B71E0111D9BDF14CFA9C9806EDFBB2EF48324F254169D919EB384D731A941CB94

Uniqueness

Uniqueness Score: -1.00%

Function 006DCAF0 Relevance: 3.2, Strings: 2, Instructions: 659COMMON

Download Yara Rule

Strings

p#z, xrefs: 006DCF7F
Variable is not of type 'Object'., xrefs: 00720C40

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.$p#z
API String ID: 0-3775082255
Opcode ID: e9922dae80c8e01bca960004ccc62ac921d87443b11cc9f9c57d48b7ff8316da
Instruction ID: c77ace521d97e9d5065aeab2a68c06def175dfd7d0993c73d22dcdbcd5200f6e
Opcode Fuzzy Hash: e9922dae80c8e01bca960004ccc62ac921d87443b11cc9f9c57d48b7ff8316da
Instruction Fuzzy Hash: 44327B70D00219DBCF14DF94D895AEDB7B6FF05314F24805AE806AB392D779AE46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 007468EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00746918
FindClose.KERNEL32(00000000), ref: 00746961

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: b0fbcef897da9bea61239b0c047e1023915fba8999aefa7a7093640c398d35d2
Instruction ID: 2b3f235004075b184e7897b598c60a9ae3230abdf1cd7d8b6e16b88bbccaa9a2
Opcode Fuzzy Hash: b0fbcef897da9bea61239b0c047e1023915fba8999aefa7a7093640c398d35d2
Instruction Fuzzy Hash: DC1190716042019FD710DF29D484A26BBE5FF85328F14C69EE8698F3A2CB74EC05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 007437B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00754891,?,?,00000035,?), ref: 007437E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00754891,?,?,00000035,?), ref: 007437F4

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: eeeb3748f0d9b9cd206abbd29b1514b920e9d5f0827959c6d410a24b046f5aba
Instruction ID: 451ca3856260a129efc65e0ee2f8adc78b029877127fe934cec231ddd7e37ac2
Opcode Fuzzy Hash: eeeb3748f0d9b9cd206abbd29b1514b920e9d5f0827959c6d410a24b046f5aba
Instruction Fuzzy Hash: 7CF0E5B06053286AE76117668C8DFEB3AAEEFC4761F004265F509D22C1DAB49944C6B0

Uniqueness

Uniqueness Score: -1.00%

Function 0073B226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 0073B25D
keybd_event.USER32(?,7694C0D0,?,00000000), ref: 0073B270

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 0b9322a0ada63b926752078078164d882f61f2b2d9f033001b7b2244826bcd80
Instruction ID: 6df41ec45da500ad7f6b0bc06ff971cdef3be87976634d45c7f951161a561928
Opcode Fuzzy Hash: 0b9322a0ada63b926752078078164d882f61f2b2d9f033001b7b2244826bcd80
Instruction Fuzzy Hash: F7F0127180424DABDB059FA1C8057BE7BB4FF04305F148009F955A5192C77D86119F94

Uniqueness

Uniqueness Score: -1.00%

Function 007310BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,007311FC), ref: 007310D4
CloseHandle.KERNEL32(?,?,007311FC), ref: 007310E9

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 0c81c028360bf33ce80bfcaa292c82e6c64f4e96744a20b51d712221978ea4f1
Instruction ID: 0472cc47743c23b4a69a508b70ba4da402f138558793fee8756d09e48af970e2
Opcode Fuzzy Hash: 0c81c028360bf33ce80bfcaa292c82e6c64f4e96744a20b51d712221978ea4f1
Instruction Fuzzy Hash: 08E04F32008740AFF7262B12FC05E777BA9EF04310F10C82DF4A6804B1DBA26C90DB14

Uniqueness

Uniqueness Score: -1.00%

Function 0070676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00706766,?,?,00000008,?,?,0070FEFE,00000000), ref: 00706998

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: bafe0fec2148d9f80ad823e64421f9f7561004f523f59739c99b8bdad8f904e5
Instruction ID: 7e1ce935d055ed727ac09b44ab553ceba95f5c1b5a756cb68a1575e2e3a477ea
Opcode Fuzzy Hash: bafe0fec2148d9f80ad823e64421f9f7561004f523f59739c99b8bdad8f904e5
Instruction Fuzzy Hash: D1B10571610608DFDB15CF28C49AB657BE0FB45364F25C658E899CF2E2C339E9A1CB40

Uniqueness

Uniqueness Score: -1.00%

Function 006EB119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 0072851F

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 302f7e0a285ee33d16a564a68d366b9222082ee351ff8102c472410c7a6da864
Instruction ID: 0a38e2fa34a2571865719cf329d9a6ff479ba65fcd3c584dcf644860f6bfdf72
Opcode Fuzzy Hash: 302f7e0a285ee33d16a564a68d366b9222082ee351ff8102c472410c7a6da864
Instruction Fuzzy Hash: 11127F71901229DBCB54CF59D881AEEB7F5FF48310F1481AAE809EB255EB349E81CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0074EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 0074EABD

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: f3d81005c38b7611183402324b452e2980b936fdf5a5f03f3ac515f1accfb41a
Instruction ID: 40037cca7cd9eb2455f7838ba556cfbcf0cf3592421f0df82704f92a4fce4f06
Opcode Fuzzy Hash: f3d81005c38b7611183402324b452e2980b936fdf5a5f03f3ac515f1accfb41a
Instruction Fuzzy Hash: 11E01A312002059FC710EF59D804EAAB7E9BF98770F00C41AFD8AC7361DBB4A8408B94

Uniqueness

Uniqueness Score: -1.00%

Function 006F09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,006F03EE), ref: 006F09DA

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f489ea8c91d0fb0b7a3c1d3df5387af7881b36bf58a62d3a021276c51cd31ab5
Instruction ID: affbd668b4b02449cdead1a49988709635f711dc891ddf25beb500da3dd9948e
Opcode Fuzzy Hash: f489ea8c91d0fb0b7a3c1d3df5387af7881b36bf58a62d3a021276c51cd31ab5
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 006F781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 006F798B

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: 49cd43dd53e8c6a144dd8756219a9541778ea1c39d6a0f3090c4c4d325dec89c
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: 6951797160C70D5BDB388968885E7FE67DB9B12380F18052EEB92D7382CA55DE03D35A

Uniqueness

Uniqueness Score: -1.00%

Function 00742046 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

0&z, xrefs: 00742053

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID:
String ID: 0&z
API String ID: 0-2820941700
Opcode ID: d13d7ad5f396863204dd0080da75ade720c532cb8c51b8f80897acd95b46c113
Instruction ID: 78fa2d245e396c6b82c44dd04dae84c5b4ab51d1a6adbcccf999210eff2e8e03
Opcode Fuzzy Hash: d13d7ad5f396863204dd0080da75ade720c532cb8c51b8f80897acd95b46c113
Instruction Fuzzy Hash: BD21E7323216118BD728CF79C82367E73E5A794310F148A2EE4A7C37D1DE3AA905CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00706DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9c2066cb2894a89233c51479eac4db81d8b812cabec05727c6e5fca42b3365f
Instruction ID: 381d433856c0a6ee5eb19534b33c23f731c6521d023dbd8b145d0cc7e36860a5
Opcode Fuzzy Hash: a9c2066cb2894a89233c51479eac4db81d8b812cabec05727c6e5fca42b3365f
Instruction Fuzzy Hash: 9D32F221D29F418DD7279634CC22335A689AFB73C5F15D737E82AB59AAEB2DD4C38100

Uniqueness

Uniqueness Score: -1.00%

Function 006ECC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e82e2b8fff1fdea07d106e46cdf284e001a0bed0978d97c4c53d528e9ae46c9
Instruction ID: aaca0146c2dc89ad00afd5e2e1306f3546f902c4b8fff4ad2527d53b354d3168
Opcode Fuzzy Hash: 5e82e2b8fff1fdea07d106e46cdf284e001a0bed0978d97c4c53d528e9ae46c9
Instruction Fuzzy Hash: FA323931A002A58BDF26CF29E490ABD77B2EF55310F38816AE449DB391D63CDD82DB51

Uniqueness

Uniqueness Score: -1.00%

Function 006D7920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c34daaeaa1e2ede023197de2a985f2165b0b22d79c905658dc180e700dfae4
Instruction ID: a7fd4614074684c2e14e2281b999083a289a15b8dd61a8c58ccfec64ab8c6b87
Opcode Fuzzy Hash: 74c34daaeaa1e2ede023197de2a985f2165b0b22d79c905658dc180e700dfae4
Instruction Fuzzy Hash: A7229F70E04609DFDF18CF68C881AEEB7B6FF44300F14462AE816A7391EB39A955CB55

Uniqueness

Uniqueness Score: -1.00%

Function 006D91C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 396ddd88ece3eff881530101071a19e93c03552739033ea832a2ab20e5b013c8
Instruction ID: 019e2c88f922e2e323763c35d3a9862419e3fe54cc70df31c9e81240140fddc2
Opcode Fuzzy Hash: 396ddd88ece3eff881530101071a19e93c03552739033ea832a2ab20e5b013c8
Instruction Fuzzy Hash: 7E02A6B1E0020AEBDB14DF58D881AADB7B2FF44300F118169E8569B3D1EB35EE51CB95

Uniqueness

Uniqueness Score: -1.00%

Function 006F7A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a27130f7ea7df12b1d90b501ae831a013f3873148f0a08b9036079981984457
Instruction ID: 6834b538051ee04cdaa27bc7852b169284fef0925481475f05999aaa2a527a22
Opcode Fuzzy Hash: 4a27130f7ea7df12b1d90b501ae831a013f3873148f0a08b9036079981984457
Instruction Fuzzy Hash: 5461677120C70E9AEE749E2C8D95BFE2397DF52704F10095EEB42DB381DA51AE42C319

Uniqueness

Uniqueness Score: -1.00%

Function 006F7CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ce18890b009c9d1ea0a50a033c640a930bf900d30e7c0a9526041f981020174
Instruction ID: c0bb6f476d9b33720590524def0e98de7b3ce2365d4b6b4e72c523cbe3c40260
Opcode Fuzzy Hash: 7ce18890b009c9d1ea0a50a033c640a930bf900d30e7c0a9526041f981020174
Instruction Fuzzy Hash: 2E61693160870D56DE388A289856BFF239BEF42704F90195EEB42DB381DA529D42C359

Uniqueness

Uniqueness Score: -1.00%

Function 01543680 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100886020.0000000001540000.00000040.00001000.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FAR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction ID: 4febe6097c4eec187ce9222b9cec745e906c6974684e1b8264e52157b12fbf0c
Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction Fuzzy Hash: 5741C271D1051CEBCF48CFADC991AAEBBF2AF88201F548299D516AB345D730AB41DB80

Uniqueness

Uniqueness Score: -1.00%

Function 01543570 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100886020.0000000001540000.00000040.00001000.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FAR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction ID: fec4eca32dc9b5af95bbc7d2ca2a2ca4e8970ac961b711122957024943aa15f6
Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction Fuzzy Hash: 28019278A01109EFCB84DF98C5909AEF7F5FF48314F208599D909AB311E730AE41DB80

Uniqueness

Uniqueness Score: -1.00%

Function 01543510 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100886020.0000000001540000.00000040.00001000.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FAR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction ID: 99535082c281f7c589f7f5a2a36de1887b0c6d32c5694867b9668e3d919e15a9
Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction Fuzzy Hash: C9019278A00109EFCB85DF98C5909AEF7F5FB48314F208599D819AB311D730AE41DB80

Uniqueness

Uniqueness Score: -1.00%

Function 01541ED0 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100886020.0000000001540000.00000040.00001000.00020000.00000000.sdmp, Offset: 01540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1540000_FAR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48

Uniqueness

Uniqueness Score: -1.00%

Function 00752ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00752B30
DeleteObject.GDI32(00000000), ref: 00752B43
DestroyWindow.USER32 ref: 00752B52
GetDesktopWindow.USER32 ref: 00752B6D
GetWindowRect.USER32(00000000), ref: 00752B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00752CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00752CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752CF8
GetClientRect.USER32(00000000,?), ref: 00752D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00752D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752D80
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752D98
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752DA8
GlobalFree.KERNEL32(00000000), ref: 00752DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,0076FC38,00000000), ref: 00752DDB
GlobalFree.KERNEL32(00000000), ref: 00752DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00752E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00752E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00752E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0075303F

Strings

static, xrefs: 00752D3A, 00752E91
DISPLAY, xrefs: 00752EA2
, xrefs: 00752FC5
AutoIt v3, xrefs: 00752CF2

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: f5595ed05157340c7329c10a2d959f1f58b19d3bff0d5c2eab9e6e32c35dd2e4
Instruction ID: 14c82aa4abbbfd0fa01d2a284d004b6a8ef68a0de11b8e12991e8fc07b1321b2
Opcode Fuzzy Hash: f5595ed05157340c7329c10a2d959f1f58b19d3bff0d5c2eab9e6e32c35dd2e4
Instruction Fuzzy Hash: 89029F71900209EFDB15DF64DC89EAE7BB9FB49311F008109F915AB2A1DBB8AD05CF64

Uniqueness

Uniqueness Score: -1.00%

Function 007670D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0076712F
GetSysColorBrush.USER32(0000000F), ref: 00767160
GetSysColor.USER32(0000000F), ref: 0076716C
SetBkColor.GDI32(?,000000FF), ref: 00767186
SelectObject.GDI32(?,?), ref: 00767195
InflateRect.USER32(?,000000FF,000000FF), ref: 007671C0
GetSysColor.USER32(00000010), ref: 007671C8
CreateSolidBrush.GDI32(00000000), ref: 007671CF
FrameRect.USER32(?,?,00000000), ref: 007671DE
DeleteObject.GDI32(00000000), ref: 007671E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00767230
FillRect.USER32(?,?,?), ref: 00767262
GetWindowLongW.USER32(?,000000F0), ref: 00767284

Part of subcall function 007673E8: GetSysColor.USER32(00000012), ref: 00767421
Part of subcall function 007673E8: SetTextColor.GDI32(?,?), ref: 00767425
Part of subcall function 007673E8: GetSysColorBrush.USER32(0000000F), ref: 0076743B
Part of subcall function 007673E8: GetSysColor.USER32(0000000F), ref: 00767446
Part of subcall function 007673E8: GetSysColor.USER32(00000011), ref: 00767463
Part of subcall function 007673E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00767471
Part of subcall function 007673E8: SelectObject.GDI32(?,00000000), ref: 00767482
Part of subcall function 007673E8: SetBkColor.GDI32(?,00000000), ref: 0076748B
Part of subcall function 007673E8: SelectObject.GDI32(?,?), ref: 00767498
Part of subcall function 007673E8: InflateRect.USER32(?,000000FF,000000FF), ref: 007674B7
Part of subcall function 007673E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 007674CE
Part of subcall function 007673E8: GetWindowLongW.USER32(00000000,000000F0), ref: 007674DB

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 527a456a0f2a23dffb19e1cb182c3a74db89f48813fbf6d5ea85849cd04e7438
Instruction ID: 4b0e5bbc4b233345bf4b39c2bd8dd3a77010c4f2737830aa4d694ecc755e83cf
Opcode Fuzzy Hash: 527a456a0f2a23dffb19e1cb182c3a74db89f48813fbf6d5ea85849cd04e7438
Instruction Fuzzy Hash: F6A1C172008305EFDB069F60DC48E6B7BA9FF89364F104A19F9A3961E1D7B8E844CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00752711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 0075273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0075286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 007528A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 007528B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00752900
GetClientRect.USER32(00000000,?), ref: 0075290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00752955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00752964
GetStockObject.GDI32(00000011), ref: 00752974
SelectObject.GDI32(00000000,00000000), ref: 00752978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00752988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00752991
DeleteDC.GDI32(00000000), ref: 0075299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 007529C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 007529DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00752A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00752A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00752A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00752A77
GetStockObject.GDI32(00000011), ref: 00752A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00752A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00752A97

Strings

static, xrefs: 0075294F, 00752A71
DISPLAY, xrefs: 0075295A
msctls_progress32, xrefs: 00752A13
AutoIt v3, xrefs: 007528F8

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: e46c81caba3f7c2be75e273f40b999662f3c021ce17b873d71caf55c3614345e
Instruction ID: 3b431d28ec751e0e2ab31efd205dc064d2ec17bd1ac2c34280db8d5a36c3aeaa
Opcode Fuzzy Hash: e46c81caba3f7c2be75e273f40b999662f3c021ce17b873d71caf55c3614345e
Instruction Fuzzy Hash: 6EB19FB1A00215AFEB14DFA8DC45FAE7BA9EB49711F008115F915E7291D7B8ED00CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00744ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00744AED
GetDriveTypeW.KERNEL32(?,0076CB68,?,\\.\,0076CC08), ref: 00744BCA
SetErrorMode.KERNEL32(00000000,0076CB68,?,\\.\,0076CC08), ref: 00744D36

Strings

Fibre, xrefs: 00744CAD
Network, xrefs: 00744C02
USB, xrefs: 00744CB4
Virtual, xrefs: 00744CE5
Fixed, xrefs: 00744C09
PhysicalDrive, xrefs: 00744B76
ATAPI, xrefs: 00744C91
\\.\, xrefs: 00744B3F
RAMDisk, xrefs: 00744BF4
SSD, xrefs: 00744C4A
CDROM, xrefs: 00744BFB
SAS, xrefs: 00744CC9
Removable, xrefs: 00744C10, 00744C15
ATA, xrefs: 00744C98
RAID, xrefs: 00744CBB
MMC, xrefs: 00744CDE
SATA, xrefs: 00744CD0
SCSI, xrefs: 00744C8A
SSA, xrefs: 00744CA6
Unknown, xrefs: 00744BED, 00744C83
FileBackedVirtual, xrefs: 00744CEC
iSCSI, xrefs: 00744CC2
1394, xrefs: 00744C9F

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 529dcb761114f399433c4dfc1f8dca62882209177102c791c74b0f918ba0c289
Instruction ID: 3a58bc7a985b63cb0183a992cc02bb70f01550bdfcd92e2eeda452b9ffbda9ef
Opcode Fuzzy Hash: 529dcb761114f399433c4dfc1f8dca62882209177102c791c74b0f918ba0c289
Instruction Fuzzy Hash: 7E61AFB0B05205DBCF04DF24DAD2A78B7B1EB05341B28851AF806AB691DB3DED41FB65

Uniqueness

Uniqueness Score: -1.00%

Function 007673E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00767421
SetTextColor.GDI32(?,?), ref: 00767425
GetSysColorBrush.USER32(0000000F), ref: 0076743B
GetSysColor.USER32(0000000F), ref: 00767446
CreateSolidBrush.GDI32(?), ref: 0076744B
GetSysColor.USER32(00000011), ref: 00767463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00767471
SelectObject.GDI32(?,00000000), ref: 00767482
SetBkColor.GDI32(?,00000000), ref: 0076748B
SelectObject.GDI32(?,?), ref: 00767498
InflateRect.USER32(?,000000FF,000000FF), ref: 007674B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 007674CE
GetWindowLongW.USER32(00000000,000000F0), ref: 007674DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0076752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00767554
InflateRect.USER32(?,000000FD,000000FD), ref: 00767572
DrawFocusRect.USER32(?,?), ref: 0076757D
GetSysColor.USER32(00000011), ref: 0076758E
SetTextColor.GDI32(?,00000000), ref: 00767596
DrawTextW.USER32(?,007670F5,000000FF,?,00000000), ref: 007675A8
SelectObject.GDI32(?,?), ref: 007675BF
DeleteObject.GDI32(?), ref: 007675CA
SelectObject.GDI32(?,?), ref: 007675D0
DeleteObject.GDI32(?), ref: 007675D5
SetTextColor.GDI32(?,?), ref: 007675DB
SetBkColor.GDI32(?,?), ref: 007675E5

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: cb74cac0860a11caf90fa6b305049b0bb34769fa4e808fe997a03dabbe834f6b
Instruction ID: 5e77953fe0ae5e53e073ba6c4d726d11ad724c936057cc3fc1a2ae2c0381b77a
Opcode Fuzzy Hash: cb74cac0860a11caf90fa6b305049b0bb34769fa4e808fe997a03dabbe834f6b
Instruction Fuzzy Hash: 2C616072900218AFDF069FA4DC49EAE7F79EF09360F118115F916AB2A1D7B89940CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00760FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00761128
GetDesktopWindow.USER32 ref: 0076113D
GetWindowRect.USER32(00000000), ref: 00761144
GetWindowLongW.USER32(?,000000F0), ref: 00761199
DestroyWindow.USER32(?), ref: 007611B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 007611ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0076120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0076121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00761232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00761245
IsWindowVisible.USER32(00000000), ref: 007612A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 007612BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 007612D0
GetWindowRect.USER32(00000000,?), ref: 007612E8
MonitorFromPoint.USER32(?,?,00000002), ref: 0076130E
GetMonitorInfoW.USER32(00000000,?), ref: 00761328
CopyRect.USER32(?,?), ref: 0076133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 007613AA

Strings

0, xrefs: 007610D3
(, xrefs: 0076131B
tooltips_class32, xrefs: 007611E6

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 51f1f5a2ef300bdacf789e752000f07e32a24241baa57f5194a2af815d7a2a3f
Instruction ID: dfedbd7fac7fcbcedf2abbcb37c2fb22ad7444279f19c7ed3efc658e5483ad75
Opcode Fuzzy Hash: 51f1f5a2ef300bdacf789e752000f07e32a24241baa57f5194a2af815d7a2a3f
Instruction Fuzzy Hash: 90B1BC71604341AFDB44DF64C888B6ABBE4FF88300F44891DF99A9B2A1C774E844CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00760241 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 007602E5
_wcslen.LIBCMT ref: 0076031F
_wcslen.LIBCMT ref: 00760389
_wcslen.LIBCMT ref: 007603F1
_wcslen.LIBCMT ref: 00760475
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 007604C5
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00760504

Part of subcall function 006EF9F2: _wcslen.LIBCMT ref: 006EF9FD

Part of subcall function 0073223F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00732258
Part of subcall function 0073223F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 0073228A

Strings

SELECT, xrefs: 00760548
SELECTALL, xrefs: 00760515
FINDITEM, xrefs: 00760627
DESELECT, xrefs: 0076059C
GETITEMCOUNT, xrefs: 00760316, 00760337
SELECTCLEAR, xrefs: 0076052D
GETSUBITEMCOUNT, xrefs: 00760384, 0076039F
GETTEXT, xrefs: 007603EC, 00760407
SELECTINVERT, xrefs: 0076057E
GETSELECTEDCOUNT, xrefs: 00760470, 0076048B
GETSELECTED, xrefs: 007605E1
ISSELECTED, xrefs: 007604DD
VIEWCHANGE, xrefs: 00760675

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: fc4a58411b16676a63654272b80aff399db1f349fb966ceca5eb29331b47fc16
Instruction ID: 66262d7673ca1f9feee3293f4e2ffc4d412a22eedae870d1cc206f5c3b4961b6
Opcode Fuzzy Hash: fc4a58411b16676a63654272b80aff399db1f349fb966ceca5eb29331b47fc16
Instruction Fuzzy Hash: 75E19C312182418FCB28DF24C45083BB7E6BF89314B14496DF8979B3A2DB38ED45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 006E8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 006E8968
GetSystemMetrics.USER32(00000007), ref: 006E8970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 006E899B
GetSystemMetrics.USER32(00000008), ref: 006E89A3
GetSystemMetrics.USER32(00000004), ref: 006E89C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 006E89E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 006E89F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 006E8A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 006E8A3C
GetClientRect.USER32(00000000,000000FF), ref: 006E8A5A
GetStockObject.GDI32(00000011), ref: 006E8A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 006E8A81

Part of subcall function 006E912D: GetCursorPos.USER32(?), ref: 006E9141
Part of subcall function 006E912D: ScreenToClient.USER32(00000000,?), ref: 006E915E
Part of subcall function 006E912D: GetAsyncKeyState.USER32(00000001), ref: 006E9183
Part of subcall function 006E912D: GetAsyncKeyState.USER32(00000002), ref: 006E919D

SetTimer.USER32(00000000,00000000,00000028,006E90FC), ref: 006E8AA8

Strings

AutoIt v3 GUI, xrefs: 006E8A20

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 90ca036b657eb90872723f3038cff3e8c8f60c3b23119ed548afd0cfc702bdf6
Instruction ID: fe331e6d99001d01456d9528e8ce7a5db171a5cce4727d6a11fed194aaf2b0c1
Opcode Fuzzy Hash: 90ca036b657eb90872723f3038cff3e8c8f60c3b23119ed548afd0cfc702bdf6
Instruction Fuzzy Hash: 00B18F75A003599FDB14DFA8DC45BAE3BB5FB48314F10822AFA16A7290DB78E841CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00730D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 007310F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00731114
Part of subcall function 007310F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00730B9B,?,?,?), ref: 00731120
Part of subcall function 007310F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00730B9B,?,?,?), ref: 0073112F
Part of subcall function 007310F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00730B9B,?,?,?), ref: 00731136
Part of subcall function 007310F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0073114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00730DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00730E29
GetLengthSid.ADVAPI32(?), ref: 00730E40
GetAce.ADVAPI32(?,00000000,?), ref: 00730E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00730E96
GetLengthSid.ADVAPI32(?), ref: 00730EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00730EB5
HeapAlloc.KERNEL32(00000000), ref: 00730EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00730EDD
CopySid.ADVAPI32(00000000), ref: 00730EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00730F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00730F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00730F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00730F6E
HeapFree.KERNEL32(00000000), ref: 00730F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00730F7E
HeapFree.KERNEL32(00000000), ref: 00730F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00730F8E
HeapFree.KERNEL32(00000000), ref: 00730F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00730FA1
HeapFree.KERNEL32(00000000), ref: 00730FA8

Part of subcall function 00731193: GetProcessHeap.KERNEL32(00000008,00730BB1,?,00000000,?,00730BB1,?), ref: 007311A1
Part of subcall function 00731193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00730BB1,?), ref: 007311A8
Part of subcall function 00731193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00730BB1,?), ref: 007311B7

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: e0830977437497ec22398bdbf383c3b791d1770c116ca8d3355a8563cac0c123
Instruction ID: c366cb2ccd8912e91f2d12477ee66689e63de2c464b4d817d65b030004802b09
Opcode Fuzzy Hash: e0830977437497ec22398bdbf383c3b791d1770c116ca8d3355a8563cac0c123
Instruction Fuzzy Hash: 79715FB190020AEBEF219FA4DC49FBEBBB8BF05700F048115F959A6152D7799A05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0075C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0075C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,0076CC08,00000000,?,00000000,?,?), ref: 0075C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 0075C5A4
_wcslen.LIBCMT ref: 0075C5F4
_wcslen.LIBCMT ref: 0075C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 0075C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 0075C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 0075C84D
RegCloseKey.ADVAPI32(?), ref: 0075C881
RegCloseKey.ADVAPI32(00000000), ref: 0075C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 0075C960

Strings

REG_SZ, xrefs: 0075C644
REG_EXPAND_SZ, xrefs: 0075C5CD
REG_QWORD, xrefs: 0075C8C3
REG_BINARY, xrefs: 0075C913
REG_DWORD, xrefs: 0075C804
REG_MULTI_SZ, xrefs: 0075C6F5

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: 312461ecf753c85b271b79878967602b90c60accc2b7b562fc9fb7dac0fceb21
Instruction ID: 3d1e5a5c1bf9f969cf39678abe4ae1ea190436f0a9e9305c36b4f5bb90e4cf64
Opcode Fuzzy Hash: 312461ecf753c85b271b79878967602b90c60accc2b7b562fc9fb7dac0fceb21
Instruction Fuzzy Hash: 041265316043019FDB15DF14C881B6AB7E6EF88714F04889DF88A9B3A2DB75ED45CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0076091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 007609C6
_wcslen.LIBCMT ref: 00760A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00760A54
_wcslen.LIBCMT ref: 00760A8A
_wcslen.LIBCMT ref: 00760B06
_wcslen.LIBCMT ref: 00760B81

Part of subcall function 006EF9F2: _wcslen.LIBCMT ref: 006EF9FD

Part of subcall function 00732BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00732BFA

Strings

GETTEXT, xrefs: 00760C97
CHECK, xrefs: 00760A85, 00760AA0
COLLAPSE, xrefs: 00760B01, 00760B1C
SELECT, xrefs: 00760D11
GETTOTALCOUNT, xrefs: 007609F2, 00760A17
EXPAND, xrefs: 00760BF8
EXISTS, xrefs: 00760B7C, 00760B97
GETITEMCOUNT, xrefs: 00760C1E
GETSELECTED, xrefs: 00760C4E
UNCHECK, xrefs: 00760D3E
ISCHECKED, xrefs: 00760CE1

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 849569dcbd39db08d92af3e14125bbf71dd8ca933a1238d87ec62dd52fc07bc5
Instruction ID: 04dbe636cf8e561c7d453acd2a8e7893e6bc889a1034b387f0f490ce66d3a86b
Opcode Fuzzy Hash: 849569dcbd39db08d92af3e14125bbf71dd8ca933a1238d87ec62dd52fc07bc5
Instruction Fuzzy Hash: B1E19B716087018FCB14DF24C45092BB7E2BF98354F148A5DF89A9B3A2DB39ED45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0075C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0075B6AE,?,?), ref: 0075C9B5
_wcslen.LIBCMT ref: 0075C9F1
_wcslen.LIBCMT ref: 0075CA68
_wcslen.LIBCMT ref: 0075CA9E
_wcslen.LIBCMT ref: 0075CAF9
_wcslen.LIBCMT ref: 0075CB2F
_wcslen.LIBCMT ref: 0075CB7F

Strings

HKCR, xrefs: 0075CB29, 0075CB2E
HKEY_USERS, xrefs: 0075CBDF
HKU, xrefs: 0075CBF0
HKCU, xrefs: 0075CBCE
HKLM, xrefs: 0075CA98, 0075CA9D
HKCC, xrefs: 0075CBAC
HKEY_CURRENT_USER, xrefs: 0075CBBD
HKEY_CLASSES_ROOT, xrefs: 0075CAF3, 0075CAF8
HKEY_LOCAL_MACHINE, xrefs: 0075CA62, 0075CA67
HKEY_CURRENT_CONFIG, xrefs: 0075CB79, 0075CB7E

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: de7dfea91e7efa3be898fd113bfdd0781fe4e29cbb1a4b5c8a086a0451928232
Instruction ID: f87b5bd4aac68ed4e85dc9caf4e280d90faeda04030946cff4c211237e982e9c
Opcode Fuzzy Hash: de7dfea91e7efa3be898fd113bfdd0781fe4e29cbb1a4b5c8a086a0451928232
Instruction Fuzzy Hash: 2171163260036A8FCF22DE7CCD417FB37929B61751B244528FC56A7284EAB9CD48C3A4

Uniqueness

Uniqueness Score: -1.00%

Function 0076833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0076835A
_wcslen.LIBCMT ref: 0076836E
_wcslen.LIBCMT ref: 00768391
_wcslen.LIBCMT ref: 007683B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 007683F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00765BF2), ref: 0076844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00768487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 007684CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00768501
FreeLibrary.KERNEL32(?), ref: 0076850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0076851D
DestroyIcon.USER32(?,?,?,?,?,00765BF2), ref: 0076852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00768549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00768555

Strings

.dll, xrefs: 007683AB
.icl, xrefs: 00768368
.exe, xrefs: 00768388

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: d1ff607b6ce1307a88a1248954ea99055940d1b6e9293a6d181f2625c7cc5108
Instruction ID: 9ed7bf26ed66169a14c575a7095c0dc1af235f3b816747f53ebc24dd89417597
Opcode Fuzzy Hash: d1ff607b6ce1307a88a1248954ea99055940d1b6e9293a6d181f2625c7cc5108
Instruction Fuzzy Hash: E861D171540219BAEB54DF64CC41BBF7BA8FB04711F10860AFD16D61D1DFB8AA50C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 006D7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#include, xrefs: 006D7847
", xrefs: 00715153
#comments-end, xrefs: 006D78D9
#ce, xrefs: 006D78ED
', xrefs: 00715169
#pragma compile, xrefs: 006D77D3
#requireadmin, xrefs: 006D77FF
#include-once, xrefs: 006D782F
Bad directive syntax error, xrefs: 0071519A
#OnAutoItStartRegister, xrefs: 006D7817
#comments-start, xrefs: 006D785F, 006D78B1
Unterminated group of comments, xrefs: 0071528C
Cannot parse #include, xrefs: 00715279
#notrayicon, xrefs: 006D77E7
#cs, xrefs: 006D7873, 006D78C5

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: f215f933b9444e66847754d62809eea4f394157034e41ca83cbf5add4b7def94
Instruction ID: 38c1538164f9b5bcfe7b821dc5538857447e3ed4f05df522a62635104860f13a
Opcode Fuzzy Hash: f215f933b9444e66847754d62809eea4f394157034e41ca83cbf5add4b7def94
Instruction Fuzzy Hash: 978119B1A00209BBDB25AF64DC42FFE3766AF55300F04442AF905AB292FB74D941D7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00735A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00735A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00735A40
SetWindowTextW.USER32(?,?), ref: 00735A57
GetDlgItem.USER32(?,000003EA), ref: 00735A6C
SetWindowTextW.USER32(00000000,?), ref: 00735A72
GetDlgItem.USER32(?,000003E9), ref: 00735A82
SetWindowTextW.USER32(00000000,?), ref: 00735A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00735AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00735AC3
GetWindowRect.USER32(?,?), ref: 00735ACC
_wcslen.LIBCMT ref: 00735B33
SetWindowTextW.USER32(?,?), ref: 00735B6F
GetDesktopWindow.USER32 ref: 00735B75
GetWindowRect.USER32(00000000), ref: 00735B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00735BD3
GetClientRect.USER32(?,?), ref: 00735BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00735C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00735C2F

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: bd7462111b9fd9440a9b398c3dd00e82ef9826fbbcf745ab37f591e42f29a42c
Instruction ID: e5fc60b5c4976b6e09ffbd9301ec72b4a315fc50e295a05c331f14811f42206d
Opcode Fuzzy Hash: bd7462111b9fd9440a9b398c3dd00e82ef9826fbbcf745ab37f591e42f29a42c
Instruction Fuzzy Hash: 79718E71900B09EFEB21DFA8CE85BAEBBF5FF48704F104518E582A25A1D779E940CB54

Uniqueness

Uniqueness Score: -1.00%

Function 007330F7 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0073318D
_wcslen.LIBCMT ref: 007331F8

Strings

CLASS, xrefs: 00733188, 007331A5
NAME, xrefs: 00733335, 00733346
TEXT, xrefs: 0073347C
[y, xrefs: 0073339A
CLASSNN, xrefs: 007331F3, 00733204
INSTANCE, xrefs: 00733453
REGEXPCLASS, xrefs: 00733255, 00733266

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT$[y
API String ID: 176396367-3387399910
Opcode ID: f5f3ce1916eb6aafc11b2f378f6e5e6581fdafc6b4c5e24f730f717e83a3babe
Instruction ID: 040b674cb789fe72fafa46d0a0cce46a2112abe4a959f54d375696d2b52a7210
Opcode Fuzzy Hash: f5f3ce1916eb6aafc11b2f378f6e5e6581fdafc6b4c5e24f730f717e83a3babe
Instruction Fuzzy Hash: 0FE1E632A005269BEF359FB8C4516FEFBB1BF44710F54812AE456E7242DB38AE4587D0

Uniqueness

Uniqueness Score: -1.00%

Function 006F00C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 006F00C6

Part of subcall function 006F00ED: InitializeCriticalSectionAndSpinCount.KERNEL32(007A070C,00000FA0,79826AD7,?,?,?,?,007123B3,000000FF), ref: 006F011C
Part of subcall function 006F00ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,007123B3,000000FF), ref: 006F0127
Part of subcall function 006F00ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,007123B3,000000FF), ref: 006F0138
Part of subcall function 006F00ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 006F014E
Part of subcall function 006F00ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 006F015C
Part of subcall function 006F00ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 006F016A
Part of subcall function 006F00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 006F0195
Part of subcall function 006F00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 006F01A0

___scrt_fastfail.LIBCMT ref: 006F00E7

Part of subcall function 006F00A3: __onexit.LIBCMT ref: 006F00A9

Strings

kernel32.dll, xrefs: 006F0133
InitializeConditionVariable, xrefs: 006F0148
api-ms-win-core-synch-l1-2-0.dll, xrefs: 006F0122
SleepConditionVariableCS, xrefs: 006F0154
WakeAllConditionVariable, xrefs: 006F0162

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 6bd65af9ed493c8fa03855f3d70aad972db18e670e984b24461f714dbbb2fee1
Instruction ID: e24a7f522972086bf83ff5013222f03e4ca6482920ad853d092288d3f28995da
Opcode Fuzzy Hash: 6bd65af9ed493c8fa03855f3d70aad972db18e670e984b24461f714dbbb2fee1
Instruction Fuzzy Hash: D1210E726457196BFB11ABF4AC05B7A3396EB46B51F104539FD0293392DFBC6C008A98

Uniqueness

Uniqueness Score: -1.00%

Function 007444C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,0076CC08), ref: 00744527
_wcslen.LIBCMT ref: 0074453B
_wcslen.LIBCMT ref: 00744599
_wcslen.LIBCMT ref: 007445F4
_wcslen.LIBCMT ref: 0074463F
_wcslen.LIBCMT ref: 007446A7

Part of subcall function 006EF9F2: _wcslen.LIBCMT ref: 006EF9FD

GetDriveTypeW.KERNEL32(?,00796BF0,00000061), ref: 00744743

Strings

unknown, xrefs: 00744708
cdrom, xrefs: 0074458F, 00744594
removable, xrefs: 007445EA, 007445EF
fixed, xrefs: 00744635, 0074463A
all, xrefs: 00744531, 00744536
network, xrefs: 0074469D, 007446A2
ramdisk, xrefs: 007446F1

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 2ff707f14f4fd79194ab6d13c4dbddac39cc9da941895c77acb8ac107f70ef58
Instruction ID: f34687a7da7809d218eba8213f9a73587bcce700bb4f577d60b9a33e96ab7d58
Opcode Fuzzy Hash: 2ff707f14f4fd79194ab6d13c4dbddac39cc9da941895c77acb8ac107f70ef58
Instruction Fuzzy Hash: D0B1F2716083029FC710DF28D890A7AB7E5BFA6760F504A1DF496C7291EB38D845DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0076911E Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 006E9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 006E9BB2

DragQueryPoint.SHELL32(?,?), ref: 00769147

Part of subcall function 00767674: ClientToScreen.USER32(?,?), ref: 0076769A
Part of subcall function 00767674: GetWindowRect.USER32(?,?), ref: 00767710
Part of subcall function 00767674: PtInRect.USER32(?,?,00768B89), ref: 00767720

SendMessageW.USER32(?,000000B0,?,?), ref: 007691B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 007691BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 007691DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00769225
SendMessageW.USER32(?,000000B0,?,?), ref: 0076923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00769255
SendMessageW.USER32(?,000000B1,?,?), ref: 00769277
DragFinish.SHELL32(?), ref: 0076927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00769371

Strings

p#z, xrefs: 007692BB
@GUI_DRAGFILE, xrefs: 00769320
@GUI_DROPID, xrefs: 0076929E
@GUI_DRAGID, xrefs: 007692E9

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$p#z
API String ID: 221274066-3231298687
Opcode ID: 756ad91427686e561ccce6e17cecd414268d9a8f7f0373d83dae252c36d10f58
Instruction ID: 20594622f7e8b337e6cbfa15bc3dedc2908bf26f51c96fc560a9fcf049e175f2
Opcode Fuzzy Hash: 756ad91427686e561ccce6e17cecd414268d9a8f7f0373d83dae252c36d10f58
Instruction Fuzzy Hash: 8E619B71508301AFC701DF60DC85DAFBBE9EFC9750F00492EF596922A0DB749A09CB66

Uniqueness

Uniqueness Score: -1.00%

Function 0075AFF9 Relevance: 24.4, APIs: 16, Instructions: 418processCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0075B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0075B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0075B1D4
_wcslen.LIBCMT ref: 0075B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0075B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0075B236
_wcslen.LIBCMT ref: 0075B332

Part of subcall function 007405A7: GetStdHandle.KERNEL32(000000F6), ref: 007405C6

_wcslen.LIBCMT ref: 0075B34B
_wcslen.LIBCMT ref: 0075B366
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0075B3B6
GetLastError.KERNEL32(00000000), ref: 0075B407
CloseHandle.KERNEL32(?), ref: 0075B439
CloseHandle.KERNEL32(00000000), ref: 0075B44A
CloseHandle.KERNEL32(00000000), ref: 0075B45C
CloseHandle.KERNEL32(00000000), ref: 0075B46E
CloseHandle.KERNEL32(?), ref: 0075B4E3

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: aa6edde7c18cd8ebfa2b83af6b0c29d6277af6acd0ce55e50773468056dc4b14
Instruction ID: 8a069dc9506b9730d9e87a6e3fe8491c36a3174ce7ac5b834e27a111a506f05e
Opcode Fuzzy Hash: aa6edde7c18cd8ebfa2b83af6b0c29d6277af6acd0ce55e50773468056dc4b14
Instruction Fuzzy Hash: C7F18C31604340DFC764EF24C891B6EBBE1AF85310F14855EF8999B2A2DB75EC48CB96

Uniqueness

Uniqueness Score: -1.00%

Function 006D326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(007A1990), ref: 00712F8D
GetMenuItemCount.USER32(007A1990), ref: 0071303D
GetCursorPos.USER32(?), ref: 00713081
SetForegroundWindow.USER32(00000000), ref: 0071308A
TrackPopupMenuEx.USER32(007A1990,00000000,?,00000000,00000000,00000000), ref: 0071309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 007130A9

Strings

0, xrefs: 006D327D

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 48c1bc70b071fdbbcfdfe5dda439fcff4eb2da154057c46928184aaa816b0f13
Instruction ID: 312b12dc30439dbbb5635d9f7e9a28ea5d2ad112ed8205ad4770f427095123e0
Opcode Fuzzy Hash: 48c1bc70b071fdbbcfdfe5dda439fcff4eb2da154057c46928184aaa816b0f13
Instruction Fuzzy Hash: FB712A70A44215BEFB218F28CC49FEABF69FF04324F204207F5156A2E1C7B9A965CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00766CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00766DEB

Part of subcall function 006D6B57: _wcslen.LIBCMT ref: 006D6B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00766E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00766E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00766E94
DestroyWindow.USER32(?), ref: 00766EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,006D0000,00000000), ref: 00766EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00766EFD
GetDesktopWindow.USER32 ref: 00766F16
GetWindowRect.USER32(00000000), ref: 00766F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00766F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00766F4D

Part of subcall function 006E9944: GetWindowLongW.USER32(?,000000EB), ref: 006E9952

Strings

0, xrefs: 00766D98
tooltips_class32, xrefs: 00766E58, 00766EDD

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 191b8d542b2494c2e41f250a23be50da6f5f320f2bbf34e9c88cdaa78826e270
Instruction ID: d87ebba7d47b521b59e25487d28d154e75642803ade32e3ee881fafeca5263a7
Opcode Fuzzy Hash: 191b8d542b2494c2e41f250a23be50da6f5f320f2bbf34e9c88cdaa78826e270
Instruction Fuzzy Hash: D2716674104340AFEB21CF18D844EBABBE9FB99304F84445EF99A87261C779E916CB19

Uniqueness

Uniqueness Score: -1.00%

Function 0074C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0074C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0074C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0074C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0074C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0074C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0074C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0074C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0074C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0074C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0074C5F0
InternetCloseHandle.WININET(00000000), ref: 0074C5FB

Strings

, xrefs: 0074C575

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: d3eaba74513dce57d48ef928219fc7d48b4ce0d210665a889e09e64584309048
Instruction ID: c7cd51456fce75c2fe57731f67fd84d72ab91f73504c1b401c987aa4210b7f58
Opcode Fuzzy Hash: d3eaba74513dce57d48ef928219fc7d48b4ce0d210665a889e09e64584309048
Instruction Fuzzy Hash: F9518EB1501308BFDB629F65C948ABBBBFCFF08344F108419F98696210DB78E914DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0076856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00000000,?,000000EC), ref: 00768592
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 007685A2
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 007685AD
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 007685BA
GlobalLock.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 007685C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 007685D7
GlobalUnlock.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 007685E0
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 007685E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,000000F0,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 007685F8
OleLoadPicture.OLEAUT32(000000F0,00000000,00000000,0076FC38,?), ref: 00768611
GlobalFree.KERNEL32(00000000), ref: 00768621
GetObjectW.GDI32(?,00000018,?), ref: 00768641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00768671
DeleteObject.GDI32(?), ref: 00768699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 007686AF

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: eb3c30d5affcfa0ccd82823cd27a89650dc7dd919516fa932f8fecbc162b5ce3
Instruction ID: 5ebb3cbf9c5c1b90859c4d049f1c11b3e252c764ba5b04a3f02b637f2a98c6dd
Opcode Fuzzy Hash: eb3c30d5affcfa0ccd82823cd27a89650dc7dd919516fa932f8fecbc162b5ce3
Instruction Fuzzy Hash: A8412875600208AFDB129FA5CC48EAA7BB8FF89B11F108159FD46E7261DB789D01CF25

Uniqueness

Uniqueness Score: -1.00%

Function 007414BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00741502
VariantCopy.OLEAUT32(?,?), ref: 0074150B
VariantClear.OLEAUT32(?), ref: 00741517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 007415FB
VarR8FromDec.OLEAUT32(?,?), ref: 00741657
VariantInit.OLEAUT32(?), ref: 00741708
SysFreeString.OLEAUT32(?), ref: 0074178C
VariantClear.OLEAUT32(?), ref: 007417D8
VariantClear.OLEAUT32(?), ref: 007417E7
VariantInit.OLEAUT32(00000000), ref: 00741823

Strings

Default, xrefs: 007416AF
%4d%02d%02d%02d%02d%02d, xrefs: 00741625

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 05228d4c3f8b1cc9573b3d7f44bef767aa7c55e9fb1e4406a7e8f8bc1c33183b
Instruction ID: 5e126d131e37f5975fa5dc322948794febb279cdd899d2c5552e4875c3c40ff9
Opcode Fuzzy Hash: 05228d4c3f8b1cc9573b3d7f44bef767aa7c55e9fb1e4406a7e8f8bc1c33183b
Instruction Fuzzy Hash: 4DD1E271A00219DBDB00FF65D885BB9FBB6BF44700F54815AF446AB280DB38EC91DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0075B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Part of subcall function 0075C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0075B6AE,?,?), ref: 0075C9B5
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075C9F1
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075CA68
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0075B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0075B772
RegDeleteValueW.ADVAPI32(?,?), ref: 0075B80A
RegCloseKey.ADVAPI32(?), ref: 0075B87E
RegCloseKey.ADVAPI32(?), ref: 0075B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 0075B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0075B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 0075B922
FreeLibrary.KERNEL32(00000000), ref: 0075B983
RegCloseKey.ADVAPI32(00000000), ref: 0075B994

Strings

RegDeleteKeyExW, xrefs: 0075B8FE
advapi32.dll, xrefs: 0075B8ED

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: ce366675221b07dc4a002bc98296aed2713ea70288fc0038b65e222dd3ddce04
Instruction ID: da68f1e1edd1ca2d0e375a5f745c1c7fdb33612ca775d12da4eda411db99b46f
Opcode Fuzzy Hash: ce366675221b07dc4a002bc98296aed2713ea70288fc0038b65e222dd3ddce04
Instruction Fuzzy Hash: 5FC16C30604201EFD714DF14C495F6ABBE5AF84319F14859DF89A8B3A2CBB9EC49CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0075255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 007525D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 007525E8
CreateCompatibleDC.GDI32(?), ref: 007525F4
SelectObject.GDI32(00000000,?), ref: 00752601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 0075266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 007526AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 007526D0
SelectObject.GDI32(?,?), ref: 007526D8
DeleteObject.GDI32(?), ref: 007526E1
DeleteDC.GDI32(?), ref: 007526E8
ReleaseDC.USER32(00000000,?), ref: 007526F3

Strings

(, xrefs: 0075268D

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 2762c069e0fe0fafc6130e63fdfd8ea5b1c2774ebf9e007482994c0e38a6d9ec
Instruction ID: 339b68b6ccc4e8b2b747b313eb488de7da2ea882d66853ce70fb172437d29f44
Opcode Fuzzy Hash: 2762c069e0fe0fafc6130e63fdfd8ea5b1c2774ebf9e007482994c0e38a6d9ec
Instruction Fuzzy Hash: FA6105B5D00219EFCF05CFA4D884AAEBBF5FF48310F208529E956A7251E7B4A941CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0070DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0070DAA1

Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D659
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D66B
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D67D
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D68F
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D6A1
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D6B3
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D6C5
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D6D7
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D6E9
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D6FB
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D70D
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D71F
Part of subcall function 0070D63C: _free.LIBCMT ref: 0070D731

_free.LIBCMT ref: 0070DA96

Part of subcall function 007029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000), ref: 007029DE
Part of subcall function 007029C8: GetLastError.KERNEL32(00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000,00000000), ref: 007029F0

_free.LIBCMT ref: 0070DAB8
_free.LIBCMT ref: 0070DACD
_free.LIBCMT ref: 0070DAD8
_free.LIBCMT ref: 0070DAFA
_free.LIBCMT ref: 0070DB0D
_free.LIBCMT ref: 0070DB1B
_free.LIBCMT ref: 0070DB26
_free.LIBCMT ref: 0070DB5E
_free.LIBCMT ref: 0070DB65
_free.LIBCMT ref: 0070DB82
_free.LIBCMT ref: 0070DB9A

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 0b50f2e46493ae6a8fa6652d446d4f72f3fbf7efdec349bbdef2f80f4d200b3d
Instruction ID: 6018ebed41e9d267bea4c28b79fa41bbac574d83e224d63c9a569dc357b537f2
Opcode Fuzzy Hash: 0b50f2e46493ae6a8fa6652d446d4f72f3fbf7efdec349bbdef2f80f4d200b3d
Instruction Fuzzy Hash: B0313BB2604305DFEB31AAB9E849B5677E9FF00310F254629E449E71E2DB79BC41CB20

Uniqueness

Uniqueness Score: -1.00%

Function 0073365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0073369C
_wcslen.LIBCMT ref: 007336A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00733797
GetClassNameW.USER32(?,?,00000400), ref: 0073380C
GetDlgCtrlID.USER32(?), ref: 0073385D
GetWindowRect.USER32(?,?), ref: 00733882
GetParent.USER32(?), ref: 007338A0
ScreenToClient.USER32(00000000), ref: 007338A7
GetClassNameW.USER32(?,?,00000100), ref: 00733921
GetWindowTextW.USER32(?,?,00000400), ref: 0073395D

Strings

%s%u, xrefs: 00733734

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: 5b86906b69c6d471b1fb5825197008676316b16e2cc47cdb9842836720eeaff3
Instruction ID: 77a44cab104a3df3e87f57f2509f6c521f3c2253fe6fecfc8bcadcfbe7e3cc6a
Opcode Fuzzy Hash: 5b86906b69c6d471b1fb5825197008676316b16e2cc47cdb9842836720eeaff3
Instruction Fuzzy Hash: FC91B371204706EFE725DF24C885BEAF7A9FF44314F008619FA9AC2151DB78EA45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00734954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00734994
GetWindowTextW.USER32(?,?,00000400), ref: 007349DA
_wcslen.LIBCMT ref: 007349EB
CharUpperBuffW.USER32(?,00000000), ref: 007349F7
_wcsstr.LIBVCRUNTIME ref: 00734A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00734A64
GetWindowTextW.USER32(?,?,00000400), ref: 00734A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00734AE6
GetClassNameW.USER32(?,?,00000400), ref: 00734B20
GetWindowRect.USER32(?,?), ref: 00734B8B

Strings

ThumbnailClass, xrefs: 00734A6F, 00734AF1

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: cc00528501475ab3f434850dab90e39b297c74276aaec789c25e82aa852bc4cc
Instruction ID: 3fb23d8e35cc4b88847fddd582befdc8fbffc90a06de1bce9d5188855df0817b
Opcode Fuzzy Hash: cc00528501475ab3f434850dab90e39b297c74276aaec789c25e82aa852bc4cc
Instruction Fuzzy Hash: 8691DE711042099FEB08CF14C985BBAB7E9FF84314F04846AFD869A196DB38FD45CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00768D0E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006E9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 006E9BB2

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00768D5A
GetFocus.USER32 ref: 00768D6A
GetDlgCtrlID.USER32(00000000), ref: 00768D75
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?,?,?,?), ref: 00768E1D
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00768ECF
GetMenuItemCount.USER32(?), ref: 00768EEC
GetMenuItemID.USER32(?,00000000), ref: 00768EFC
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00768F2E
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00768F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00768FA1

Strings

0, xrefs: 00768E9F

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0
API String ID: 1026556194-4108050209
Opcode ID: 5d0b466d17f744cfb62589d16a58c63abf2e7167682eb7868730a09a1a35c803
Instruction ID: 10a2a4f5845e8c3d90b36a96496ba7b2a45b6c59256668b71782eab77808b2e2
Opcode Fuzzy Hash: 5d0b466d17f744cfb62589d16a58c63abf2e7167682eb7868730a09a1a35c803
Instruction Fuzzy Hash: 8F81E071508301AFDB50CF24C884AAB7BE9FF88314F144A1DFD9697291DB79E904CB66

Uniqueness

Uniqueness Score: -1.00%

Function 0073DC0E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 0073DC20
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 0073DC46
_wcslen.LIBCMT ref: 0073DC50
_wcsstr.LIBVCRUNTIME ref: 0073DCA0
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 0073DCBC

Strings

04090000, xrefs: 0073DCF2
DefaultLangCodepage, xrefs: 0073DD1F
%u.%u.%u.%u, xrefs: 0073DD9A
\VarFileInfo\Translation, xrefs: 0073DCB4
StringFileInfo\, xrefs: 0073DC8F

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 1939486746-1459072770
Opcode ID: 7926164579818308cb09b79c014fa0e7776a4aa343cae8f5612e1c05484d6f59
Instruction ID: 4e0c656834795dcbc8da0990e1a3d0b0a0b5c1a438bb8f401d60f3dae81764ce
Opcode Fuzzy Hash: 7926164579818308cb09b79c014fa0e7776a4aa343cae8f5612e1c05484d6f59
Instruction Fuzzy Hash: 7D41F772A403047BEB55A775AC43EBF776DDF42750F10406EFA01A6183EB79AE0186B8

Uniqueness

Uniqueness Score: -1.00%

Function 0075CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0075CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 0075CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0075CD48

Part of subcall function 0075CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0075CCAA
Part of subcall function 0075CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 0075CCBD
Part of subcall function 0075CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0075CCCF
Part of subcall function 0075CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0075CD05
Part of subcall function 0075CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0075CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 0075CCF3

Strings

RegDeleteKeyExW, xrefs: 0075CCC9
advapi32.dll, xrefs: 0075CCB8

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 57230b7916e5c44c7b99b1be2f0fb1987dc9807ef0004c05555a77df9ebdcab5
Instruction ID: b8ba0860d2586482295cdb6391ca90cd043205d7a179a3e936eb068bd3f112d6
Opcode Fuzzy Hash: 57230b7916e5c44c7b99b1be2f0fb1987dc9807ef0004c05555a77df9ebdcab5
Instruction Fuzzy Hash: AF3170B1A01318BFDB229B90DC88EFFBB7CEF05741F004165E906E6140D6B89E49DAB4

Uniqueness

Uniqueness Score: -1.00%

Function 00743D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00743D40
_wcslen.LIBCMT ref: 00743D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00743D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00743DBE
RemoveDirectoryW.KERNEL32(?), ref: 00743DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00743E55
CloseHandle.KERNEL32(00000000), ref: 00743E60
CloseHandle.KERNEL32(00000000), ref: 00743E6B

Strings

\??\%s, xrefs: 00743D5B
\, xrefs: 00743D77
:, xrefs: 00743D82

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: 3beba508eb6fb765d907c1012c108067378ff24e783ea408df0fe7f4e70cde52
Instruction ID: 3e2694ff55ff1c8c69f8b126240d10e10e447081ab6b0b1f6786e06245e609f3
Opcode Fuzzy Hash: 3beba508eb6fb765d907c1012c108067378ff24e783ea408df0fe7f4e70cde52
Instruction Fuzzy Hash: 3831B471A00209ABDB219BA1DC49FEF37BDEF89700F1041B5F619D6150E77897448B68

Uniqueness

Uniqueness Score: -1.00%

Function 0073E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0073E6B4

Part of subcall function 006EE551: timeGetTime.WINMM(?,?,0073E6D4), ref: 006EE555

Sleep.KERNEL32(0000000A), ref: 0073E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 0073E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0073E727
SetActiveWindow.USER32 ref: 0073E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0073E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 0073E773
Sleep.KERNEL32(000000FA), ref: 0073E77E
IsWindow.USER32 ref: 0073E78A
EndDialog.USER32(00000000), ref: 0073E79B

Strings

BUTTON, xrefs: 0073E719

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: fc667f9e1056235d70f9d9d2e829fa35b1041ac5780bf39ff9e35c545dc4f876
Instruction ID: 45b46c6be4eaf3b4137bb4aeeb3ae404af5ceccf8a5c06e72832753c35833b95
Opcode Fuzzy Hash: fc667f9e1056235d70f9d9d2e829fa35b1041ac5780bf39ff9e35c545dc4f876
Instruction Fuzzy Hash: 0D2184B0241305EFFB125F64EC99A353B69F796348F108425F55682AE3DBBD9C118B2C

Uniqueness

Uniqueness Score: -1.00%

Function 0073E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0073EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0073EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0073EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0073EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0073EAA7

Strings

alias PlayMe, xrefs: 0073EA36
play PlayMe, xrefs: 0073EAA2
open , xrefs: 0073EA0C
status PlayMe mode, xrefs: 0073EA58
play PlayMe wait, xrefs: 0073EA91
close PlayMe, xrefs: 0073EA6E, 0073EA9B

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 7bf90f6dafb71b8cf3497a45f062c5af8be2aaa790c8b2f9799816e7afe02a1a
Instruction ID: 8c738fe0caa5d1a88ce1add17fe38ff80b08772ae4c49754e8bac7581892db83
Opcode Fuzzy Hash: 7bf90f6dafb71b8cf3497a45f062c5af8be2aaa790c8b2f9799816e7afe02a1a
Instruction Fuzzy Hash: C6117371A5026979EB20A7A2EC4AEFF6B7CEBD1F50F00452EB401A21D1EEB45D05C5B0

Uniqueness

Uniqueness Score: -1.00%

Function 00735CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00735CE2
GetWindowRect.USER32(00000000,?), ref: 00735CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00735D59
GetDlgItem.USER32(?,00000002), ref: 00735D69
GetWindowRect.USER32(00000000,?), ref: 00735D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00735DCF
GetDlgItem.USER32(?,000003E9), ref: 00735DDD
GetWindowRect.USER32(00000000,?), ref: 00735DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00735E31
GetDlgItem.USER32(?,000003EA), ref: 00735E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00735E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00735E67

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 84c38101670eb317aa8a9116b6d30fffbca60a82bfc25b16431c40b213f7cd46
Instruction ID: 270efe1b0e20eff5c49428aa34c8725e81bc6462c3f629ca918c95c07a98c087
Opcode Fuzzy Hash: 84c38101670eb317aa8a9116b6d30fffbca60a82bfc25b16431c40b213f7cd46
Instruction Fuzzy Hash: 49512FB1B10705AFDB18CF68CD89AAE7BB5FB48301F148129F516E7291D7B49E00CB54

Uniqueness

Uniqueness Score: -1.00%

Function 006E8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 006E8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,006E8BE8,?,00000000,?,?,?,?,006E8BBA,00000000,?), ref: 006E8FC5

DestroyWindow.USER32(?), ref: 006E8C81
KillTimer.USER32(00000000,?,?,?,?,006E8BBA,00000000,?), ref: 006E8D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00726973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,006E8BBA,00000000,?), ref: 007269A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,006E8BBA,00000000,?), ref: 007269B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,006E8BBA,00000000), ref: 007269D4
DeleteObject.GDI32(00000000), ref: 007269E6

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 4bb26aec956ead845dbad22fb697a3635e9652425212de7769618bfd86d23a28
Instruction ID: c532157a4ffe608edce663264216bfb64cc7f2faa5811376aa32e0b3253d1f69
Opcode Fuzzy Hash: 4bb26aec956ead845dbad22fb697a3635e9652425212de7769618bfd86d23a28
Instruction Fuzzy Hash: E861AF30003790DFDB229F16D94872677F2FB82712F64851DE0869B660CB79B981CF98

Uniqueness

Uniqueness Score: -1.00%

Function 006E9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 006E9944: GetWindowLongW.USER32(?,000000EB), ref: 006E9952

GetSysColor.USER32(0000000F), ref: 006E9862

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: f2cb288920d473719dd114cdb5f38dd60a17ceecf1f6f24acf7a6f9c6bf5cb41
Instruction ID: f2ec25cf4292dc54dc20e237437823fe99ca42be3dae8a77c56f510eeffe5df2
Opcode Fuzzy Hash: f2cb288920d473719dd114cdb5f38dd60a17ceecf1f6f24acf7a6f9c6bf5cb41
Instruction Fuzzy Hash: 8B41E2311017949FDB255F399C84BBA3B66AF06330F248A05F9A28B2F2D3749C42DB21

Uniqueness

Uniqueness Score: -1.00%

Function 007396E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,0071F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00739717
LoadStringW.USER32(00000000,?,0071F7F8,00000001), ref: 00739720

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,0071F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00739742
LoadStringW.USER32(00000000,?,0071F7F8,00000001), ref: 00739745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00739866

Strings

Line %d (File "%s"):, xrefs: 0073978F
%s (%d) : ==> %s: %s %s, xrefs: 0073984A
^ ERROR, xrefs: 007397FB
Error: , xrefs: 0073981D
Line %d:, xrefs: 007397A0

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: a0b434aca8f55dad4b28e0eeab1aed15579c73b28106b53d5bff374f8aea8f2d
Instruction ID: b73178ec05fd28a1bbcd66298862a916ee90a2b44c65ef12ab536a63cca4b8ad
Opcode Fuzzy Hash: a0b434aca8f55dad4b28e0eeab1aed15579c73b28106b53d5bff374f8aea8f2d
Instruction Fuzzy Hash: EB416F72D00219AADF44EBE0DE86DEE7379AF55740F10012AF60172292EB796F48CB75

Uniqueness

Uniqueness Score: -1.00%

Function 007306DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 006D6B57: _wcslen.LIBCMT ref: 006D6B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 007307A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 007307BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 007307DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00730804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 0073082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00730837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0073083C

Strings

SOFTWARE\Classes\, xrefs: 0073070E
\IPC$, xrefs: 00730784
\CLSID, xrefs: 00730724

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: cfb9c19c16f42b70bf31833d3ba84efbc11f4b4f6bd1da4e63659d21e7fca732
Instruction ID: 95c8acfcb59d74591375d26b5b1ddc976a2b038311719d0d3ca05f91431dd805
Opcode Fuzzy Hash: cfb9c19c16f42b70bf31833d3ba84efbc11f4b4f6bd1da4e63659d21e7fca732
Instruction Fuzzy Hash: 4E413872C10229ABDF15EBA4DC95CFDB779FF04350F04412AE901A32A1EB74AE04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00753C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00753C5C
CoInitialize.OLE32(00000000), ref: 00753C8A
CoUninitialize.OLE32 ref: 00753C94
_wcslen.LIBCMT ref: 00753D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00753DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00753ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00753F0E
CoGetObject.OLE32(?,00000000,0076FB98,?), ref: 00753F2D
SetErrorMode.KERNEL32(00000000), ref: 00753F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00753FC4
VariantClear.OLEAUT32(?), ref: 00753FD8

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 1ee407a23cb2d8df8c45d521919288e2c7b5a920656552f23e890d2d55d3a0fc
Instruction ID: 841770becafaa3893e06454ff6e696ba423a71e296c377707055a0e028d4a502
Opcode Fuzzy Hash: 1ee407a23cb2d8df8c45d521919288e2c7b5a920656552f23e890d2d55d3a0fc
Instruction Fuzzy Hash: B0C135716083059FD700DF64C88496BB7E9FF89785F00491DF98A9B260DBB5ED09CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00747A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00747AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00747B8F
SHGetDesktopFolder.SHELL32(?), ref: 00747BA3
CoCreateInstance.OLE32(0076FD08,00000000,00000001,00796E6C,?), ref: 00747BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00747C74
CoTaskMemFree.OLE32(?,?), ref: 00747CCC
SHBrowseForFolderW.SHELL32(?), ref: 00747D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00747D7A
CoTaskMemFree.OLE32(00000000), ref: 00747D81
CoTaskMemFree.OLE32(00000000), ref: 00747DD6
CoUninitialize.OLE32 ref: 00747DDC

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 336efb01a9b17f2d91b6f9a7c54d470ee070cbf344fc729576b345c46eac765d
Instruction ID: 88fa4f46b2ed3f8bcd1c0b43ce7eeebb851591999076f28b77f8412965df9cd9
Opcode Fuzzy Hash: 336efb01a9b17f2d91b6f9a7c54d470ee070cbf344fc729576b345c46eac765d
Instruction Fuzzy Hash: 0DC12B75A04209AFCB14DFA4C884DAEBBF9FF48314B148499E81A9B361DB34ED45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0076541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00765504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00765515
CharNextW.USER32(00000158), ref: 00765544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00765585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0076559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 007655AC

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: a9f19b519fba1ca7e1668433fffe26b91a0a4dee532c32914e6578a40c3d989e
Instruction ID: a9d3765b25db9d9cb9c25acf3f0b136b4d4e2724887bcd4f0457ca8e471b50d3
Opcode Fuzzy Hash: a9f19b519fba1ca7e1668433fffe26b91a0a4dee532c32914e6578a40c3d989e
Instruction Fuzzy Hash: FB618E30900609EFDF118F64CC84DFE7BB9EB05724F108185F967A6291DB7C9A80EB60

Uniqueness

Uniqueness Score: -1.00%

Function 0072FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 0072FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 0072FB08
VariantInit.OLEAUT32(?), ref: 0072FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 0072FB3A
VariantCopy.OLEAUT32(?,?), ref: 0072FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 0072FBA1
VariantClear.OLEAUT32(?), ref: 0072FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 0072FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0072FBCC
VariantClear.OLEAUT32(?), ref: 0072FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0072FBE9

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 087bfa131f44d690eacc3a97a6ded732074b4658513fc3f214a4300d00ee15d7
Instruction ID: 510550fcb4b1984d36b7978bfcc8d2588bb2ad7a7bbf485244397592e94b6b2f
Opcode Fuzzy Hash: 087bfa131f44d690eacc3a97a6ded732074b4658513fc3f214a4300d00ee15d7
Instruction Fuzzy Hash: 26418E75A00269DFCB01DF64D8589AEBFB9EF08354F00C039E946A7261CB78A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00739C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00739CA1
GetAsyncKeyState.USER32(000000A0), ref: 00739D22
GetKeyState.USER32(000000A0), ref: 00739D3D
GetAsyncKeyState.USER32(000000A1), ref: 00739D57
GetKeyState.USER32(000000A1), ref: 00739D6C
GetAsyncKeyState.USER32(00000011), ref: 00739D84
GetKeyState.USER32(00000011), ref: 00739D96
GetAsyncKeyState.USER32(00000012), ref: 00739DAE
GetKeyState.USER32(00000012), ref: 00739DC0
GetAsyncKeyState.USER32(0000005B), ref: 00739DD8
GetKeyState.USER32(0000005B), ref: 00739DEA

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: fb361379aad0776e414fa5a19382949fe7b27a2882a2f76306813bcc5f1e7414
Instruction ID: 6d32a2f2b0f9efbf5ff9596b3831d434f2d91112b2025aa6cb171632a572426d
Opcode Fuzzy Hash: fb361379aad0776e414fa5a19382949fe7b27a2882a2f76306813bcc5f1e7414
Instruction Fuzzy Hash: BC41B5346047CA69FF719674C8053B6BEA06F11344F08805ADBC7566C3EBED99D8CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0075055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 007505BC
inet_addr.WSOCK32(?), ref: 0075061C
gethostbyname.WSOCK32(?), ref: 00750628
IcmpCreateFile.IPHLPAPI ref: 00750636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 007506C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 007506E5
IcmpCloseHandle.IPHLPAPI(?), ref: 007507B9
WSACleanup.WSOCK32 ref: 007507BF

Strings

Ping, xrefs: 00750676

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 3d0551ae519d38d9f73b255a06cb717fa7b4d2c880b2c17cb72265b180e75a89
Instruction ID: feb911616852a11f65a144d2db004482e7efd395c37ba8469346978a71fce0e8
Opcode Fuzzy Hash: 3d0551ae519d38d9f73b255a06cb717fa7b4d2c880b2c17cb72265b180e75a89
Instruction Fuzzy Hash: 7B918D755042019FD720CF15C488F5ABBE1EF48318F1489A9E86A8B7A2D7B8ED49CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 00758CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00758CF3

Part of subcall function 00738E54: _wcslen.LIBCMT ref: 00738E77

_wcslen.LIBCMT ref: 00758D4E
_wcslen.LIBCMT ref: 00758D9C
_wcslen.LIBCMT ref: 00758DDC
_wcslen.LIBCMT ref: 00758E6E

Strings

cdecl, xrefs: 00758D48, 00758D4D
none, xrefs: 00758E65, 00758E6A
stdcall, xrefs: 00758DD6, 00758DDB
winapi, xrefs: 00758D96, 00758D9B

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 5c643f9dc279783118a9dc3de1e2d3a1fd070a837c8a66843c51095ff92acf33
Instruction ID: a7b34931148121a93e99812c5ecf47b64bce4b8377e0ade6bc4057e9b4f34c78
Opcode Fuzzy Hash: 5c643f9dc279783118a9dc3de1e2d3a1fd070a837c8a66843c51095ff92acf33
Instruction Fuzzy Hash: 8751AE31A001169BCB94DF68C8419FEB3B2AF69721B204229E866F7284DFB9DD44C791

Uniqueness

Uniqueness Score: -1.00%

Function 0075372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00753774
CoUninitialize.OLE32 ref: 0075377F
CoCreateInstance.OLE32(?,00000000,00000017,0076FB78,?), ref: 007537D9
IIDFromString.OLE32(?,?), ref: 0075384C
VariantInit.OLEAUT32(?), ref: 007538E4
VariantClear.OLEAUT32(?), ref: 00753936

Strings

NULL Pointer assignment, xrefs: 0075381E
Failed to create object, xrefs: 007537E4, 0075389A
Invalid parameter, xrefs: 00753865

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 4cc741089aa3eeca5cf264f1aa6b29aff0cb5bc83ac1cd052b50c9dec4f16bd3
Instruction ID: 463e6d4598e71809c39e55dd969ee3055a8d7088d5a7e92745fe8f3fa9fb499c
Opcode Fuzzy Hash: 4cc741089aa3eeca5cf264f1aa6b29aff0cb5bc83ac1cd052b50c9dec4f16bd3
Instruction Fuzzy Hash: 1861C4B06083019FD315DF54C889FAABBE4EF48755F00490DF985972A1D7B8EE48CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00768B02 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006E9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 006E9BB2

Part of subcall function 006E912D: GetCursorPos.USER32(?), ref: 006E9141
Part of subcall function 006E912D: ScreenToClient.USER32(00000000,?), ref: 006E915E
Part of subcall function 006E912D: GetAsyncKeyState.USER32(00000001), ref: 006E9183
Part of subcall function 006E912D: GetAsyncKeyState.USER32(00000002), ref: 006E919D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?,?), ref: 00768B6B
ImageList_EndDrag.COMCTL32 ref: 00768B71
ReleaseCapture.USER32 ref: 00768B77
SetWindowTextW.USER32(?,00000000), ref: 00768C12
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00768C25
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?,?), ref: 00768CFF

Strings

@GUI_DRAGFILE, xrefs: 00768C9A
@GUI_DROPID, xrefs: 00768C51
p#z, xrefs: 00768C71

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID$p#z
API String ID: 1924731296-3428299791
Opcode ID: d09c2f1fd0388035152ca006513814f274069e0585bf28f786c765d95c8412c7
Instruction ID: 0427278163f4a04506eda5804f82da71ebc179f050c7d3a8171f01216d4815d6
Opcode Fuzzy Hash: d09c2f1fd0388035152ca006513814f274069e0585bf28f786c765d95c8412c7
Instruction Fuzzy Hash: 4D51AB70504340AFE744DF14DC5AFAA77E5FB88710F40062EF996972A2CB78AD04CB66

Uniqueness

Uniqueness Score: -1.00%

Function 00743388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 007433CF

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 007433F0

Strings

"%s" (%d) : ==> %s:, xrefs: 00743522
Incorrect parameters to object property !, xrefs: 007434AB
^ ERROR , xrefs: 0074349E
Line %d (File "%s"):, xrefs: 00743443, 0074345C
Error: , xrefs: 007434D1
"%s" (%d) : ==> %s:%s%s, xrefs: 00743504

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 4d5f1c91b362c3c5f27dc170850a04f9fce42670f2beb50ddbc39bf69c709e38
Instruction ID: a179a63fe67848d848bab646894733614720871dcb4199b9bc08650f7e9364d0
Opcode Fuzzy Hash: 4d5f1c91b362c3c5f27dc170850a04f9fce42670f2beb50ddbc39bf69c709e38
Instruction Fuzzy Hash: 3E51F471D00219AAEF15EBE0DD46EEEB779EF04340F10416AF10572252EB392F58DB65

Uniqueness

Uniqueness Score: -1.00%

Function 0073B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 0073B5FC
_wcslen.LIBCMT ref: 0073B608
_wcslen.LIBCMT ref: 0073B64D
_wcslen.LIBCMT ref: 0073B68C
_wcslen.LIBCMT ref: 0073B6C7

Strings

APPEND, xrefs: 0073B6C1, 0073B6C6
EXISTS, xrefs: 0073B686, 0073B68B
KEYS, xrefs: 0073B647, 0073B64C
REMOVE, xrefs: 0073B602, 0073B607

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 5aa0e9982f3e774866ad0446cf34bef2aa17330b8e9f8bbb5af3296760146114
Instruction ID: bcff0bc1f5e9aa95ec3128bd82eed675067377857034562d704d549b8473f148
Opcode Fuzzy Hash: 5aa0e9982f3e774866ad0446cf34bef2aa17330b8e9f8bbb5af3296760146114
Instruction Fuzzy Hash: 27410632A01026DBDB205F7DC8925BE77A5AFA1754F24422AE621DB287E739CD81C790

Uniqueness

Uniqueness Score: -1.00%

Function 00745393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 007453A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00745416
GetLastError.KERNEL32 ref: 00745420
SetErrorMode.KERNEL32(00000000,READY), ref: 007454A7

Strings

NOTREADY, xrefs: 0074544B
INVALID, xrefs: 00745459
READONLY, xrefs: 00745452
READY, xrefs: 00745460, 00745468
UNKNOWN, xrefs: 00745444

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 9f732e74d15cd74c6a5dc1c8ca7b74b3e253f004fedcd62343a2a524719d2b2f
Instruction ID: 1cc20de00ed15d343bb3e455532a33f1a24b0991f87a91e164da613ff53cf3b2
Opcode Fuzzy Hash: 9f732e74d15cd74c6a5dc1c8ca7b74b3e253f004fedcd62343a2a524719d2b2f
Instruction Fuzzy Hash: 4231A075A006449FCB11DF6CD484AAA7BB4EF05305F148169E806CF393DB79DD82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00763C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00763C79
SetMenu.USER32(?,00000000), ref: 00763C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00763D10
IsMenu.USER32(?), ref: 00763D24
CreatePopupMenu.USER32 ref: 00763D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00763D5B
DrawMenuBar.USER32 ref: 00763D63

Strings

F, xrefs: 00763D4E
0, xrefs: 00763C54

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 549217a9828e82331cc62d4842b9258a51f048a7693b53ec5a57310431a70f22
Instruction ID: 27af17df993fd9e34caa83d4de14066fea2ee4d35bbf643e0bfa4782297f9842
Opcode Fuzzy Hash: 549217a9828e82331cc62d4842b9258a51f048a7693b53ec5a57310431a70f22
Instruction Fuzzy Hash: B7415679A01209AFDB14CFA4DC84AAA7BB5FF49351F144029FD47A7360D778AA10CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00763A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00763A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00763AA0
GetWindowLongW.USER32(?,000000F0), ref: 00763AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00763AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00763B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00763BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00763BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00763BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00763BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00763C13

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 06fecd392efad6acfc20318499c4c7634008b34adbf417c5e8e45a513dab8665
Instruction ID: 585b4753c3fc8015170728b2b2a26f47687aceef2413ce54bc42cf5aedaaa587
Opcode Fuzzy Hash: 06fecd392efad6acfc20318499c4c7634008b34adbf417c5e8e45a513dab8665
Instruction Fuzzy Hash: 21618C75900248AFDB11DFA8CC81EEE77B8EF49700F104199FA16E72A1C778AE45DB64

Uniqueness

Uniqueness Score: -1.00%

Function 00702C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00702C94

Part of subcall function 007029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000), ref: 007029DE
Part of subcall function 007029C8: GetLastError.KERNEL32(00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000,00000000), ref: 007029F0

_free.LIBCMT ref: 00702CA0
_free.LIBCMT ref: 00702CAB
_free.LIBCMT ref: 00702CB6
_free.LIBCMT ref: 00702CC1
_free.LIBCMT ref: 00702CCC
_free.LIBCMT ref: 00702CD7
_free.LIBCMT ref: 00702CE2
_free.LIBCMT ref: 00702CED
_free.LIBCMT ref: 00702CFB

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6935c87624f14a5b7efff48327b01aa265184bce4f8e246b693c8540741c1431
Instruction ID: 43a0959efaac3c4b7e5f12627f2c72cc55203aa6845d242f33339e1b85032b3b
Opcode Fuzzy Hash: 6935c87624f14a5b7efff48327b01aa265184bce4f8e246b693c8540741c1431
Instruction Fuzzy Hash: 00119676110108EFCB02EF54D84ACDD3BA9FF05350F6146A5F9486B272D635FA519F90

Uniqueness

Uniqueness Score: -1.00%

Function 006D1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 006D1459
OleUninitialize.OLE32(?,00000000), ref: 006D14F8
UnregisterHotKey.USER32(?), ref: 006D16DD
DestroyWindow.USER32(?), ref: 007124B9
FreeLibrary.KERNEL32(?), ref: 0071251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 0071254B

Strings

close all, xrefs: 006D1454

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: f8023f493b59dfed156aba84ac7d78b95ed47f13adcee9215d66654ff7f8af9c
Instruction ID: c17395baa87b00ac904a9ad7e1a1b948bdfc85369b5e74a749bd6d1861ab054b
Opcode Fuzzy Hash: f8023f493b59dfed156aba84ac7d78b95ed47f13adcee9215d66654ff7f8af9c
Instruction Fuzzy Hash: 4FD16D31B01212DFCB19EF19C495A69F7A2BF05700F1441AEE84A6B3A2DB74AD63CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00747DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00747FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00747FC1
GetFileAttributesW.KERNEL32(?), ref: 00747FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00748005
SetCurrentDirectoryW.KERNEL32(?), ref: 00748017
SetCurrentDirectoryW.KERNEL32(?), ref: 00748060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 007480B0

Strings

*.*, xrefs: 00748066

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: de616332944360a87375cce75d148429d260ea4fe46966c0e704702855175b5c
Instruction ID: f83278e341b416f2564c520f03558f0fa2fe61f9545a79924b1ce55110d14b4d
Opcode Fuzzy Hash: de616332944360a87375cce75d148429d260ea4fe46966c0e704702855175b5c
Instruction Fuzzy Hash: 7181AF725082559BCB68EF14C8849AEB3E9BF88310F544D5EF885C7260EB39DD49CB92

Uniqueness

Uniqueness Score: -1.00%

Function 006D5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 006D5C7A

Part of subcall function 006D5D0A: GetClientRect.USER32(?,?), ref: 006D5D30
Part of subcall function 006D5D0A: GetWindowRect.USER32(?,?), ref: 006D5D71
Part of subcall function 006D5D0A: ScreenToClient.USER32(?,?), ref: 006D5D99

GetDC.USER32 ref: 007146F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00714708
SelectObject.GDI32(00000000,00000000), ref: 00714716
SelectObject.GDI32(00000000,00000000), ref: 0071472B
ReleaseDC.USER32(?,00000000), ref: 00714733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 007147C4

Strings

U, xrefs: 00714693

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: bd4fbbfd26edb954e1b415a4186b5d3f5323206b42ef5421f56b6b6277849dca
Instruction ID: c93a29ae5c24e2397aebaa55694c1800c22f43e1d9e75eaa266f2639d9a167bf
Opcode Fuzzy Hash: bd4fbbfd26edb954e1b415a4186b5d3f5323206b42ef5421f56b6b6277849dca
Instruction Fuzzy Hash: A371E131900205DFCF218F68C984AFA3BB6FF4A365F14426AED565A2E6C7399C81DF50

Uniqueness

Uniqueness Score: -1.00%

Function 0074359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 007435E4

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

LoadStringW.USER32(007A2390,?,00000FFF,?), ref: 0074360A

Strings

"%s" (%d) : ==> %s:, xrefs: 00743742
Line %d (File "%s"):, xrefs: 0074366B
^ ERROR, xrefs: 007436C9
Error: , xrefs: 007436EF
"%s" (%d) : ==> %s:%s%s, xrefs: 00743724

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: ff30329075effff287e0f063cac1a140231ec31b7f70b66b10eaf0dfd9c83950
Instruction ID: c37b5d2820cea2601d1c3ef607c6a45cb201f7257c41707420e4e929b4182f98
Opcode Fuzzy Hash: ff30329075effff287e0f063cac1a140231ec31b7f70b66b10eaf0dfd9c83950
Instruction Fuzzy Hash: C1517171D00259BADF15EBA0DC46EEDBB39AF04300F14412AF505722A1DB751B98DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0074C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0074C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0074C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0074C2CA
GetLastError.KERNEL32 ref: 0074C322
SetEvent.KERNEL32(?), ref: 0074C336
InternetCloseHandle.WININET(00000000), ref: 0074C341

Strings

, xrefs: 0074C2BB

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 0c5acad495dd7ddf09b2099c0a44ef209630204c09c445ec2434493035c1d27e
Instruction ID: b6dc6416ff79f7a39856ffcb307c316dc0c164a0353473d73fd3f198d18aef88
Opcode Fuzzy Hash: 0c5acad495dd7ddf09b2099c0a44ef209630204c09c445ec2434493035c1d27e
Instruction Fuzzy Hash: 49317CB1601308AFD7629FA5CC88ABB7BFCEB49744F14851EF486D2210DB78DD049B65

Uniqueness

Uniqueness Score: -1.00%

Function 0073989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00713AAF,?,?,Bad directive syntax error,0076CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 007398BC
LoadStringW.USER32(00000000,?,00713AAF,?), ref: 007398C3

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00739987

Strings

Line %d (File "%s"):, xrefs: 0073992D
., xrefs: 0073996D
%s (%d) : ==> %s.: %s %s, xrefs: 007398F1
Error: , xrefs: 00739955
Line %d:, xrefs: 00739912

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: a9e269a17ab2d6e4b35a7943a4fb53368661db7443857effa26837f5dc1a28be
Instruction ID: 7928cdc2cf152a5156d6d48401b141ff6506439a16a4085b603d4843ce78d35e
Opcode Fuzzy Hash: a9e269a17ab2d6e4b35a7943a4fb53368661db7443857effa26837f5dc1a28be
Instruction Fuzzy Hash: D521B471D0025EEBDF15AF90CC06EED7736FF18300F04441AF515661A2DB79A628DB25

Uniqueness

Uniqueness Score: -1.00%

Function 0073209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 007320AB
GetClassNameW.USER32(00000000,?,00000100), ref: 007320C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 0073214D

Strings

list, xrefs: 0073212F
smallicons, xrefs: 00732115
largeicons, xrefs: 007320E1
details, xrefs: 007320FB
SHELLDLL_DefView, xrefs: 007320CC

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: f107ac6b18a28d8a41e2f7b7e177f5c65d3bf0f582e46efe92c045a524f06f60
Instruction ID: 8dfd014febe5f36b1f5b6f436b1fbff5c0959fcdb5cac0f76a40a8e2bfdff386
Opcode Fuzzy Hash: f107ac6b18a28d8a41e2f7b7e177f5c65d3bf0f582e46efe92c045a524f06f60
Instruction Fuzzy Hash: 8A11E3B668871EB9FA022224ED06DB7379CCB04324F20015AFB05A50E7FEA969035618

Uniqueness

Uniqueness Score: -1.00%

Function 0070CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0070CEB7
_free.LIBCMT ref: 0070CF22
_free.LIBCMT ref: 0070CF48
_free.LIBCMT ref: 0070CF71
_free.LIBCMT ref: 0070CFA9
_free.LIBCMT ref: 0070CFDA
_free.LIBCMT ref: 0070D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 0070D09C
_free.LIBCMT ref: 0070D0B5

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 98eaf1aa8db762972f091f95f26b90050fa767fb2b08d1bb0985a8c7704c0b8d
Instruction ID: 2fc5c6819e06a99f8a3af5397176a69a7ca00f161ca8030ff2e4312c7df0eaa8
Opcode Fuzzy Hash: 98eaf1aa8db762972f091f95f26b90050fa767fb2b08d1bb0985a8c7704c0b8d
Instruction Fuzzy Hash: 78614973A04302EFDB22AFB4D88966E7BE5AF05310F14476DF945A72C2D63DAD018791

Uniqueness

Uniqueness Score: -1.00%

Function 007650D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00765186
ShowWindow.USER32(?,00000000), ref: 007651C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 007651CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 007651D1

Part of subcall function 00766FBA: DeleteObject.GDI32(00000000), ref: 00766FE6

GetWindowLongW.USER32(?,000000F0), ref: 0076520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0076521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0076524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00765287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00765296

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 623fea6e7e9f8b648037a5c459cf90159b9ed8ee681cd02ee3d60994a4558418
Instruction ID: 8bdb8b99762e30df70c46ed8709839f7201a762aca9e505ea10b152bf054ec04
Opcode Fuzzy Hash: 623fea6e7e9f8b648037a5c459cf90159b9ed8ee681cd02ee3d60994a4558418
Instruction Fuzzy Hash: 0A519270A41A08FEEF249F28CC59BD93B65FB06321F148111FD17962E0C3BDA990EB55

Uniqueness

Uniqueness Score: -1.00%

Function 006E8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00726890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 007268A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 007268B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 007268D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 007268F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,006E8874,00000000,00000000,00000000,000000FF,00000000), ref: 00726901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0072691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,006E8874,00000000,00000000,00000000,000000FF,00000000), ref: 0072692D

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: d6b9c59ff612a45e63d3e0f52d23b6f980a4598fa293e220072b0de570e12e60
Instruction ID: a5536db9ac273d6ff36c92aff29d4a13d05fd7370b0bb7d3c9081560d95670b3
Opcode Fuzzy Hash: d6b9c59ff612a45e63d3e0f52d23b6f980a4598fa293e220072b0de570e12e60
Instruction Fuzzy Hash: BE51A870600349EFDB20CF25CC95BAA7BB6EF88350F108519F946972A0DBB8E991DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0074C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0074C182
GetLastError.KERNEL32 ref: 0074C195
SetEvent.KERNEL32(?), ref: 0074C1A9

Part of subcall function 0074C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0074C272
Part of subcall function 0074C253: GetLastError.KERNEL32 ref: 0074C322
Part of subcall function 0074C253: SetEvent.KERNEL32(?), ref: 0074C336
Part of subcall function 0074C253: InternetCloseHandle.WININET(00000000), ref: 0074C341

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 0680e363e104d739e0b94aee18874776dc03688f1318fa73f1858981511b0b0e
Instruction ID: 98ef851e4a431c5ce2d4ef5473934a91c362f7f8047d6e0182cb193791330184
Opcode Fuzzy Hash: 0680e363e104d739e0b94aee18874776dc03688f1318fa73f1858981511b0b0e
Instruction Fuzzy Hash: DD31AF71202745EFDB629FB5DC04A76BBF8FF18300B04842DF99686620D7B9E8149B60

Uniqueness

Uniqueness Score: -1.00%

Function 007325A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00733A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00733A57
Part of subcall function 00733A3D: GetCurrentThreadId.KERNEL32 ref: 00733A5E
Part of subcall function 00733A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,007325B3), ref: 00733A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 007325BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 007325DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 007325DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 007325E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00732601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00732605
MapVirtualKeyW.USER32(00000025,00000000), ref: 0073260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00732623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00732627

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: e9c4d3b46787181fda0e4f9fc104202ad761656a1e39a24fe3e88b9f6e2d7599
Instruction ID: 58749824395ef0a3cd213885e9637fcb0f503eef39c5a056950e5e8f64cbda7a
Opcode Fuzzy Hash: e9c4d3b46787181fda0e4f9fc104202ad761656a1e39a24fe3e88b9f6e2d7599
Instruction Fuzzy Hash: 0901B170390314BBFB206768DC8FF693E59DB4AB12F104041F359AE0E2C9EA28458A6D

Uniqueness

Uniqueness Score: -1.00%

Function 00731803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00731449,?,?,00000000), ref: 0073180C
HeapAlloc.KERNEL32(00000000,?,00731449,?,?,00000000), ref: 00731813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00731449,?,?,00000000), ref: 00731828
GetCurrentProcess.KERNEL32(?,00000000,?,00731449,?,?,00000000), ref: 00731830
DuplicateHandle.KERNEL32(00000000,?,00731449,?,?,00000000), ref: 00731833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00731449,?,?,00000000), ref: 00731843
GetCurrentProcess.KERNEL32(00731449,00000000,?,00731449,?,?,00000000), ref: 0073184B
DuplicateHandle.KERNEL32(00000000,?,00731449,?,?,00000000), ref: 0073184E
CreateThread.KERNEL32(00000000,00000000,00731874,00000000,00000000,00000000), ref: 00731868

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: bba34851ef44c44349ff529f565cf02bcadf1eb55fc13f5368194b4992b6db62
Instruction ID: 7af4586682d79fdd02922e4202f9aea89e0a75d119d406d5ee64f6d68ef4e480
Opcode Fuzzy Hash: bba34851ef44c44349ff529f565cf02bcadf1eb55fc13f5368194b4992b6db62
Instruction Fuzzy Hash: DE01BFB5240348BFE711AB65DC4EF673B6CEB8AB11F418411FA45DB191C6B59C00CB34

Uniqueness

Uniqueness Score: -1.00%

Function 0075A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 0073D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 0073D501
Part of subcall function 0073D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 0073D50F
Part of subcall function 0073D4DC: CloseHandle.KERNEL32(00000000), ref: 0073D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0075A16D
GetLastError.KERNEL32 ref: 0075A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0075A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 0075A268
GetLastError.KERNEL32(00000000), ref: 0075A273
CloseHandle.KERNEL32(00000000), ref: 0075A2C4

Strings

SeDebugPrivilege, xrefs: 0075A18F

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: a113764b83badd6d8d7ccc8dffd7bd66d3a5f4dd373e8a4efb2b348a3950ccb6
Instruction ID: 2d5076510f2ac23343b7d3232febcbdc6b508e1886fbf137faa63d9ed84abe1f
Opcode Fuzzy Hash: a113764b83badd6d8d7ccc8dffd7bd66d3a5f4dd373e8a4efb2b348a3950ccb6
Instruction Fuzzy Hash: E761B171204242AFD710DF19C495F65BBE1BF84318F14859CE8568B7A3C7BAEC49CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00763886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00763925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 0076393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00763954
_wcslen.LIBCMT ref: 00763999
SendMessageW.USER32(?,00001057,00000000,?), ref: 007639C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 007639F4

Strings

SysListView32, xrefs: 007638F7

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 5c7dcfc4952fdc0402e8fbca96f5d5dd2ce03124b1360d96417510374086a4bd
Instruction ID: b19383b339d33875891d6c9d52597726938d4ef7b59656340d169247639685a7
Opcode Fuzzy Hash: 5c7dcfc4952fdc0402e8fbca96f5d5dd2ce03124b1360d96417510374086a4bd
Instruction Fuzzy Hash: 6441D871A00319ABEF219F64CC49FEA77A9EF08354F10016AF955E7281D7B99D80CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0073BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0073BCFD
IsMenu.USER32(00000000), ref: 0073BD1D
CreatePopupMenu.USER32 ref: 0073BD53
GetMenuItemCount.USER32(015C6BC0), ref: 0073BDA4
InsertMenuItemW.USER32(015C6BC0,?,00000001,00000030), ref: 0073BDCC

Strings

0, xrefs: 0073BCA8
2, xrefs: 0073BD37

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 0323591d10505c7d26d13da446df9f309b7e2fbf9c4bc6e12816507217e2b0c8
Instruction ID: 4e9dfb1b1616064414aab30670b2a3bad5e1b172d9c8b18e9ec3d228bc5b5a39
Opcode Fuzzy Hash: 0323591d10505c7d26d13da446df9f309b7e2fbf9c4bc6e12816507217e2b0c8
Instruction Fuzzy Hash: EA51D270B10309DBEF11DFA8D888BAEBBF4BF45314F248119E642D7292D778A940CB61

Uniqueness

Uniqueness Score: -1.00%

Function 006F2D20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 006F2D4B
___except_validate_context_record.LIBVCRUNTIME ref: 006F2D53
_ValidateLocalCookies.LIBCMT ref: 006F2DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 006F2E0C
_ValidateLocalCookies.LIBCMT ref: 006F2E61

Strings

csm, xrefs: 006F2DF6
&Ho, xrefs: 006F2DFE, 006F2E07, 006F2E18

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: &Ho$csm
API String ID: 1170836740-2077702024
Opcode ID: f6a94c6f19235291afb56e7521eb9cc2da098255eacefc04e7aa7ffc6c5fd22d
Instruction ID: f703c9eea8bb3f9fb39bf99ab3fd6a378596394a0355c0b63e31ddac373f0123
Opcode Fuzzy Hash: f6a94c6f19235291afb56e7521eb9cc2da098255eacefc04e7aa7ffc6c5fd22d
Instruction Fuzzy Hash: F141A434A0021EABCF10DF68C855AEEBBB6BF45354F148155EA14AB392D7359A11CFD0

Uniqueness

Uniqueness Score: -1.00%

Function 0073C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 0073C913

Strings

warning, xrefs: 0073C8FC
blank, xrefs: 0073C895
question, xrefs: 0073C8CC
stop, xrefs: 0073C8E4
info, xrefs: 0073C8B4

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 08e135b5ef8f20f1f7049caa3c0956f4cb09f55a839453ff335c4f3606bd45b9
Instruction ID: 7719464671d4327051e223bf23474e459e5ed616b19606c50cd7e6a43706e579
Opcode Fuzzy Hash: 08e135b5ef8f20f1f7049caa3c0956f4cb09f55a839453ff335c4f3606bd45b9
Instruction Fuzzy Hash: D511EB3268930ABEBB029B55AC82DAB779CDF15754F11006EF500B6183EBAD7F005368

Uniqueness

Uniqueness Score: -1.00%

Function 0073ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0073ED2A
_wcslen.LIBCMT ref: 0073ED3B
_wcslen.LIBCMT ref: 0073ED79
_wcslen.LIBCMT ref: 0073EDAF
_wcslen.LIBCMT ref: 0073EDDF
_wcslen.LIBCMT ref: 0073EDEF
_wcslen.LIBCMT ref: 0073EE2B
_wcslen.LIBCMT ref: 0073EE5A

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: e4b8644315091cb30925ac25193e0e5a6c09641022a926cd9cf728660350de70
Instruction ID: 953233d71ce4e2f53a67f8cd337d2b747e19839fe56707d770a17ad22f643e5b
Opcode Fuzzy Hash: e4b8644315091cb30925ac25193e0e5a6c09641022a926cd9cf728660350de70
Instruction Fuzzy Hash: 9D41B065D1021C75DB51EBB4C88A9DFB3AAAF45700F40846AF618E3162FB38E345C3E9

Uniqueness

Uniqueness Score: -1.00%

Function 006EF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0072682C,00000004,00000000,00000000), ref: 006EF953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,0072682C,00000004,00000000,00000000), ref: 0072F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0072682C,00000004,00000000,00000000), ref: 0072F454

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 184ced469cb754abed815b45902d6965275a994cd9434f4cb57d7512b3803563
Instruction ID: 062bb6544e084ecf765a34ef74093c6220656b5b4e65e697ae4fde4e97b97505
Opcode Fuzzy Hash: 184ced469cb754abed815b45902d6965275a994cd9434f4cb57d7512b3803563
Instruction Fuzzy Hash: 8F412A302197C0BBC7399B2AD88877A7BA3AB46310F15843DF0C757663C679A881CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00762D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00762D1B
GetDC.USER32(00000000), ref: 00762D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00762D2E
ReleaseDC.USER32(00000000,00000000), ref: 00762D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00762D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00762D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00765A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00762DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00762DE1

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 2eca772ffb24327bd19ee26f9e20a0da3daa88bd3f8c08ae26a0a95bf0d7b13c
Instruction ID: e59e62a9a3103ee56d2bdecc53e4818e11792e9de70ddbf83036de619ca0352e
Opcode Fuzzy Hash: 2eca772ffb24327bd19ee26f9e20a0da3daa88bd3f8c08ae26a0a95bf0d7b13c
Instruction Fuzzy Hash: F5319172201614BFEB154F50CC49FFB3BADEF09715F044055FE499A192C6B99C41CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00735622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00735637
_memcmp.LIBVCRUNTIME ref: 00735659
_memcmp.LIBVCRUNTIME ref: 00735671
_memcmp.LIBVCRUNTIME ref: 00735684
_memcmp.LIBVCRUNTIME ref: 0073569E
_memcmp.LIBVCRUNTIME ref: 007356B1
_memcmp.LIBVCRUNTIME ref: 007356C9
_memcmp.LIBVCRUNTIME ref: 007356E4

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: f8a383b01382925de88b3a6bec6e558427d412a982814cdc32fd625fbda12b39
Instruction ID: a3821fdb972465b6239d3089ef810889410c7ee1e6a05f45d263ee81356c419d
Opcode Fuzzy Hash: f8a383b01382925de88b3a6bec6e558427d412a982814cdc32fd625fbda12b39
Instruction Fuzzy Hash: C92195F2644A19F7F21456209D93FBA235EAF217C4F840024FE059A586FB28ED10C2E9

Uniqueness

Uniqueness Score: -1.00%

Function 00754FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00755007
NULL Pointer assignment, xrefs: 0075502E, 00755383

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 1ac967cb8125c39fa490fd6e91bd019d607088124ff5c9b5a6d286be9bef4192
Instruction ID: c35b2652cbaf4d0dc1c6a0f84f1a077113bc1f6baf5f659c0d7a13d13f336851
Opcode Fuzzy Hash: 1ac967cb8125c39fa490fd6e91bd019d607088124ff5c9b5a6d286be9bef4192
Instruction Fuzzy Hash: 7ED1D671A0060A9FDF10CFA8C891BEEB7B5BF48354F148069ED15AB281E7B4DD49CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00711522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,007117FB,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 007115CE
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,007117FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00711651
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,007117FB,?,007117FB,00000000,00000000,?,00000000,?,?,?,?), ref: 007116E4
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,007117FB,00000000,00000000,?,00000000,?,?,?,?), ref: 007116FB

Part of subcall function 00703820: RtlAllocateHeap.NTDLL(00000000,?,007A1444,?,006EFDF5,?,?,006DA976,00000010,007A1440,006D13FC,?,006D13C6,?,006D1129), ref: 00703852

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,007117FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00711777
__freea.LIBCMT ref: 007117A2
__freea.LIBCMT ref: 007117AE

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: aab147aaecb947bb0a71e2b8c7b8681f88a8f495e400caf70a91402220c61039
Instruction ID: d2d2d582cccc64d57dd6f074ab0d7af80b43fb83db76196ec2c143f09337c0c8
Opcode Fuzzy Hash: aab147aaecb947bb0a71e2b8c7b8681f88a8f495e400caf70a91402220c61039
Instruction Fuzzy Hash: 6191A571E102169ADB218E78CC45AEE7BB69F49710F984659EA01EF2C1DB3DDD80C760

Uniqueness

Uniqueness Score: -1.00%

Function 00754523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00754648
VariantInit.OLEAUT32(?), ref: 00754749
VariantClear.OLEAUT32(?), ref: 00754753
VariantClear.OLEAUT32(?), ref: 007547B0

Strings

Null Object assignment in FOR..IN loop, xrefs: 007545D8, 00754706, 007547BE
Incorrect Object type in FOR..IN loop, xrefs: 0075472C

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: dbc7b1ddb6a78b93f7b62fc69db7702a34d65500c4f250de9eb86af2eea5d0c3
Instruction ID: 4312fbc68a478a746e81e2f87e755001f8efa236fbb38830d26e8f835f4e9a57
Opcode Fuzzy Hash: dbc7b1ddb6a78b93f7b62fc69db7702a34d65500c4f250de9eb86af2eea5d0c3
Instruction Fuzzy Hash: EE91A471A00219ABDF24CFA5CC44FEE7BB8EF45715F108559F905AB280D7B89989CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00741187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 0074125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00741284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 007412A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 007412D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 0074135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 007413C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00741430

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 6574b68f10876c1e48cb1dd31a85b3af0d2b2be96a3f76e1d94924ba27f77129
Instruction ID: a2317020f907cf3f7b95684436d4509797e82e16ea7a1fde8206d1cb2cd6df47
Opcode Fuzzy Hash: 6574b68f10876c1e48cb1dd31a85b3af0d2b2be96a3f76e1d94924ba27f77129
Instruction Fuzzy Hash: D391F475A00219DFDB01EF98C884BBE77B5FF44324F548029EA51EB291D7BCA981CB94

Uniqueness

Uniqueness Score: -1.00%

Function 006E948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 16c06dcb0ebd52a45c32db97c2e5b955270900eabe12ec971a41447f058989b0
Instruction ID: 19f580b0c245ad83f8e8d802c037397c12a892cf10e1bf49b0ef69849a9c9685
Opcode Fuzzy Hash: 16c06dcb0ebd52a45c32db97c2e5b955270900eabe12ec971a41447f058989b0
Instruction Fuzzy Hash: AA914671D01259EFCB15CFAACC84AEEBBB9FF48320F148049E516B7251D378A942CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00753947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0075396B
CharUpperBuffW.USER32(?,?), ref: 00753A7A
_wcslen.LIBCMT ref: 00753A8A
VariantClear.OLEAUT32(?), ref: 00753C1F

Part of subcall function 00740CDF: VariantInit.OLEAUT32(00000000), ref: 00740D1F
Part of subcall function 00740CDF: VariantCopy.OLEAUT32(?,?), ref: 00740D28
Part of subcall function 00740CDF: VariantClear.OLEAUT32(?), ref: 00740D34

Strings

AUTOIT.ERROR, xrefs: 00753A80, 00753A85
Incorrect Parameter format, xrefs: 007539A6, 00753BA1

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: a7cbad24f4df9ae44887431e5a47fd727101c57ee977313d44e3ca3931166d54
Instruction ID: 5d284730851b6570eed9cfbeeef0dfbfff5b826238345ecd082dbe18555951bd
Opcode Fuzzy Hash: a7cbad24f4df9ae44887431e5a47fd727101c57ee977313d44e3ca3931166d54
Instruction Fuzzy Hash: B491AE746083059FC704DF24C48086AB7E5FF88355F04892EF8899B361DB75EE09CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00754BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 0073000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0072FF41,80070057,?,?,?,0073035E), ref: 0073002B
Part of subcall function 0073000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0072FF41,80070057,?,?), ref: 00730046
Part of subcall function 0073000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0072FF41,80070057,?,?), ref: 00730054
Part of subcall function 0073000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0072FF41,80070057,?), ref: 00730064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00754C51
_wcslen.LIBCMT ref: 00754D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00754DCF
CoTaskMemFree.OLE32(?), ref: 00754DDA

Strings

NULL Pointer assignment, xrefs: 00754E23, 00754E52

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 7f878ffe02e4f9e84c74592824c7a9a93292b1a935157c3de5f30665637ff0c5
Instruction ID: d78b41c4609d6784e53fbdf8502645fcea7b105df21da408e2e9b59d9c0b5954
Opcode Fuzzy Hash: 7f878ffe02e4f9e84c74592824c7a9a93292b1a935157c3de5f30665637ff0c5
Instruction Fuzzy Hash: F1912671D0021DEFDF14DFA4D891AEEB7B9BF08314F10856AE915A7241DB749A48CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 007620FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00762183
GetMenuItemCount.USER32(00000000), ref: 007621B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 007621DD
_wcslen.LIBCMT ref: 00762213
GetMenuItemID.USER32(?,?), ref: 0076224D
GetSubMenu.USER32(?,?), ref: 0076225B

Part of subcall function 00733A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00733A57
Part of subcall function 00733A3D: GetCurrentThreadId.KERNEL32 ref: 00733A5E
Part of subcall function 00733A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,007325B3), ref: 00733A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 007622E3

Part of subcall function 0073E97B: Sleep.KERNEL32 ref: 0073E9F3

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: 3fe6e7773eefb7cd3391db606cf61227cf9cd7ddc67c54420ce9d47e4bc49f3c
Instruction ID: efdd7c7be3d1e1bba6bee4cdc73c57dc5c410da23ee467c2bff943000afaf806
Opcode Fuzzy Hash: 3fe6e7773eefb7cd3391db606cf61227cf9cd7ddc67c54420ce9d47e4bc49f3c
Instruction Fuzzy Hash: 02719F35E00605AFCB54DF64C845AAEB7F6FF88320F158459E817EB352DB78AD428B90

Uniqueness

Uniqueness Score: -1.00%

Function 0073AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0073AEF9
GetKeyboardState.USER32(?), ref: 0073AF0E
SetKeyboardState.USER32(?), ref: 0073AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 0073AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 0073AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 0073AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 0073B020

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: c6b0677d31a133b0d5b3dc77feeb8cfc124040251a42e2102a794be778532668
Instruction ID: 16a6b96ed0d673094e6aa13202e88f6780cdc55d6e41ce18a1dd90e1f356f48a
Opcode Fuzzy Hash: c6b0677d31a133b0d5b3dc77feeb8cfc124040251a42e2102a794be778532668
Instruction Fuzzy Hash: 9E5182A06047D63DFB364234C84ABBBBEA95B06304F088589E2D9594D3D3DDEDC8D751

Uniqueness

Uniqueness Score: -1.00%

Function 0073ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 0073AD19
GetKeyboardState.USER32(?), ref: 0073AD2E
SetKeyboardState.USER32(?), ref: 0073AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 0073ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 0073ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 0073AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 0073AE38

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: af5ae70e6b4cd819382befcc31a51b298cd98d25e86410dd415f496c1cd5ffad
Instruction ID: 0447e52ab97c429342cdcf0af972e4bdb83a60a4f4b22822ef6659b011641b9f
Opcode Fuzzy Hash: af5ae70e6b4cd819382befcc31a51b298cd98d25e86410dd415f496c1cd5ffad
Instruction Fuzzy Hash: 5551D2A1A547D53DFB378334CC57B7ABEA86B46300F088588E1D54A8C3D29CEC88D762

Uniqueness

Uniqueness Score: -1.00%

Function 0070542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00713CD6,?,?,?,?,?,?,?,?,00705BA3,?,?,00713CD6,?,?), ref: 00705470
__fassign.LIBCMT ref: 007054EB
__fassign.LIBCMT ref: 00705506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00713CD6,00000005,00000000,00000000), ref: 0070552C
WriteFile.KERNEL32(?,00713CD6,00000000,00705BA3,00000000,?,?,?,?,?,?,?,?,?,00705BA3,?), ref: 0070554B
WriteFile.KERNEL32(?,?,00000001,00705BA3,00000000,?,?,?,?,?,?,?,?,?,00705BA3,?), ref: 00705584

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 72148edba0950030cd261861e038906098e80c9f425ffcf3c2ccfba6e8bb0a1d
Instruction ID: 93e5faad942c77b0f136366034d5f8c680b91afc7a060824a6dc58f200d304ff
Opcode Fuzzy Hash: 72148edba0950030cd261861e038906098e80c9f425ffcf3c2ccfba6e8bb0a1d
Instruction Fuzzy Hash: 3351D1B0A00648DFDB11CFA8DC45AEEBBFAEF09300F14421AF546E3291E6349A51CF64

Uniqueness

Uniqueness Score: -1.00%

Function 007510B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0075304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0075307A
Part of subcall function 0075304E: _wcslen.LIBCMT ref: 0075309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00751112
WSAGetLastError.WSOCK32 ref: 00751121
WSAGetLastError.WSOCK32 ref: 007511C9
closesocket.WSOCK32(00000000), ref: 007511F9

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: cc31d782b140be486cd05b6e0f5af7f5728540ecf732877cb0a390cfa3051aa6
Instruction ID: feb7fcc3ecfa8e6373ac689c27c791dc93df588096a601cf97eda304a8dc937c
Opcode Fuzzy Hash: cc31d782b140be486cd05b6e0f5af7f5728540ecf732877cb0a390cfa3051aa6
Instruction Fuzzy Hash: 73412731600608AFDB109F24C884BE9B7EAEF44326F148099FD469B291C7B8ED45CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0073CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0073DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0073CF22,?), ref: 0073DDFD

Part of subcall function 0073DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0073CF22,?), ref: 0073DE16

lstrcmpiW.KERNEL32(?,?), ref: 0073CF45
MoveFileW.KERNEL32(?,?), ref: 0073CF7F
_wcslen.LIBCMT ref: 0073D005
_wcslen.LIBCMT ref: 0073D01B
SHFileOperationW.SHELL32(?), ref: 0073D061

Strings

\*.*, xrefs: 0073CFF3

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 373d02fcb99c48e86bf8d21b40618f4b2438aaaa9cbbe721821abaf7dd37aecd
Instruction ID: 9601f03266f9bd683ce9cf6b0f7c8f76a9196e5331cd82915d131985145e2991
Opcode Fuzzy Hash: 373d02fcb99c48e86bf8d21b40618f4b2438aaaa9cbbe721821abaf7dd37aecd
Instruction Fuzzy Hash: 06414672D0521D9EEF16EBA4D985AEE77B9AF08340F0000E6E545EB142EB38AA44CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00762DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00762E1C
GetWindowLongW.USER32(00000000,000000F0), ref: 00762E4F
GetWindowLongW.USER32(00000000,000000F0), ref: 00762E84
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00762EB6
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00762EE0
GetWindowLongW.USER32(00000000,000000F0), ref: 00762EF1
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00762F0B

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 7a5ad5d8c28bb9b865106da4adab3ab8c8fc295b98a752fb29028662771842c9
Instruction ID: b9434c6ee2478be88427f775a08e3c143a25a46c4fd52119f2fb3df546c61c9b
Opcode Fuzzy Hash: 7a5ad5d8c28bb9b865106da4adab3ab8c8fc295b98a752fb29028662771842c9
Instruction Fuzzy Hash: C23139306446409FEB61CF58DC88F6537E0FB9A710F1541A5F9529F2B2CBBAAC41DB09

Uniqueness

Uniqueness Score: -1.00%

Function 00737726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00737769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0073778F
SysAllocString.OLEAUT32(00000000), ref: 00737792
SysAllocString.OLEAUT32(?), ref: 007377B0
SysFreeString.OLEAUT32(?), ref: 007377B9
StringFromGUID2.OLE32(?,?,00000028), ref: 007377DE
SysAllocString.OLEAUT32(?), ref: 007377EC

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: bbee886bc1201473723df13575450ecd2ae27f144eb46fb41041cd64c617f75c
Instruction ID: 905302cf645ea7bf19f148562bf9405b07415cf1316ca88ab69910b5868b256d
Opcode Fuzzy Hash: bbee886bc1201473723df13575450ecd2ae27f144eb46fb41041cd64c617f75c
Instruction Fuzzy Hash: 4721C4B6609219AFEF24DFA9CC88CBB77ACEB09364B008025F905DB151DAB8DC41C764

Uniqueness

Uniqueness Score: -1.00%

Function 007377FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00737842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00737868
SysAllocString.OLEAUT32(00000000), ref: 0073786B
SysAllocString.OLEAUT32 ref: 0073788C
SysFreeString.OLEAUT32 ref: 00737895
StringFromGUID2.OLE32(?,?,00000028), ref: 007378AF
SysAllocString.OLEAUT32(?), ref: 007378BD

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 5d48b144ddeacd98e9265a6c0794f6036c1ec03c5df8591cbd294b8bda0f6a2a
Instruction ID: e8c4cc6ed81ea05ec160518e5ebf34c4d69a3caa67b58542d631519cc673d62e
Opcode Fuzzy Hash: 5d48b144ddeacd98e9265a6c0794f6036c1ec03c5df8591cbd294b8bda0f6a2a
Instruction Fuzzy Hash: 3921C771605305BFEB249FA9CC88DBA77ECEB09360B108025F955DB1A1DA78DC41CB68

Uniqueness

Uniqueness Score: -1.00%

Function 007404D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 007404F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0074052E

Strings

nul, xrefs: 00740567

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: a3b9fd20309b675d013962801efb4031f8a59f66ce1eaac0174a8aa3c32314d0
Instruction ID: 1ed6b0ae9746cf76329a977088bf188d6789a4ecf8eb0a35fe2322b87cdec4d2
Opcode Fuzzy Hash: a3b9fd20309b675d013962801efb4031f8a59f66ce1eaac0174a8aa3c32314d0
Instruction Fuzzy Hash: D72162755003059FDF209F29DC44E5AB7A4FF45724F204A19F9A1E72E0D7749960CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 007405A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 007405C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00740601

Strings

nul, xrefs: 00740639

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: bcd0efed980d3023c39921f52fa58164d8d19dbd06c047e5e0b18597057b5c57
Instruction ID: b03be76a21f565ee09cbc3a2660e6efd93a7f04d0da6d579e47c2e76eeaef315
Opcode Fuzzy Hash: bcd0efed980d3023c39921f52fa58164d8d19dbd06c047e5e0b18597057b5c57
Instruction Fuzzy Hash: 7421A3755003059FDB209F698C08A6A77E4BF85720F204A19FEA2E72D0D7B49860CB95

Uniqueness

Uniqueness Score: -1.00%

Function 007640AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006D600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 006D604C
Part of subcall function 006D600E: GetStockObject.GDI32(00000011), ref: 006D6060
Part of subcall function 006D600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 006D606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00764112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0076411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0076412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00764139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00764145

Strings

Msctls_Progress32, xrefs: 007640E3

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 3ecfc59030ac7d15fad0aa5f2d1c86abb04ce2bb1f493cc7eba3eb5208b7fe63
Instruction ID: 93e9be30a6fade97cbfa1dfe121dc6c79434937424a38b0d17747306aba4796b
Opcode Fuzzy Hash: 3ecfc59030ac7d15fad0aa5f2d1c86abb04ce2bb1f493cc7eba3eb5208b7fe63
Instruction Fuzzy Hash: 2811B2B215021DBEEF119F64CC85EE77F9DEF09798F008111FB18A2150C6769C61DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0070D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0070D7A3: _free.LIBCMT ref: 0070D7CC

_free.LIBCMT ref: 0070D82D

Part of subcall function 007029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000), ref: 007029DE
Part of subcall function 007029C8: GetLastError.KERNEL32(00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000,00000000), ref: 007029F0

_free.LIBCMT ref: 0070D838
_free.LIBCMT ref: 0070D843
_free.LIBCMT ref: 0070D897
_free.LIBCMT ref: 0070D8A2
_free.LIBCMT ref: 0070D8AD
_free.LIBCMT ref: 0070D8B8

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 024ac15da0b9ead7d85a1111eb4275f0f5704047666e8745ef4d7d909c2409d9
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 4D111F72540B04EAD531BFF4CC4FFCB7BDC6F44700F405A25B299A64E3DA69B9064A50

Uniqueness

Uniqueness Score: -1.00%

Function 0073DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0073DA74
LoadStringW.USER32(00000000), ref: 0073DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0073DA91
LoadStringW.USER32(00000000), ref: 0073DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0073DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0073DAB9

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: f647ab84417c0893590261e75d3c1f7d0b3d07478031c99ad41f574c072ce597
Instruction ID: 0058098c906b0a97d094fa9ce3aede9b8d9f6a5691325e5b7c5e842c360f8389
Opcode Fuzzy Hash: f647ab84417c0893590261e75d3c1f7d0b3d07478031c99ad41f574c072ce597
Instruction Fuzzy Hash: 8501FFF6500308BBF7129BA49D89EF6766CE708701F408596F786E2042E6B89E844B78

Uniqueness

Uniqueness Score: -1.00%

Function 0074096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(015BE408,015BE408), ref: 0074097B
EnterCriticalSection.KERNEL32(015BE3E8,00000000), ref: 0074098D
TerminateThread.KERNEL32(00000000,000001F6), ref: 0074099B
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 007409A9
CloseHandle.KERNEL32(00000000), ref: 007409B8
InterlockedExchange.KERNEL32(015BE408,000001F6), ref: 007409C8
LeaveCriticalSection.KERNEL32(015BE3E8), ref: 007409CF

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 29e0ea2f7e5493783159cc9e6b0c0d07287a7c6a370f32ca219b43f5a54b5196
Instruction ID: 85db687b73f16f64aa41c217686148b59ab7c0e1b06ea22aaf8513662847196b
Opcode Fuzzy Hash: 29e0ea2f7e5493783159cc9e6b0c0d07287a7c6a370f32ca219b43f5a54b5196
Instruction Fuzzy Hash: 24F03131442602BFD7425FA5EE9DBE67B35FF01702F405015F242608A0C7B9A465CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00751C60 Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00751DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00751DE1
WSAGetLastError.WSOCK32 ref: 00751DF2
htons.WSOCK32(?,?,?,?,?), ref: 00751EDB
inet_ntoa.WSOCK32(?), ref: 00751E8C

Part of subcall function 007339E8: _strlen.LIBCMT ref: 007339F2

Part of subcall function 00753224: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,0074EC0C), ref: 00753240

_strlen.LIBCMT ref: 00751F35

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
String ID:
API String ID: 3203458085-0
Opcode ID: 04e2c90ffad47352b7aa839a69768a504bf406d3c02da006cc9409f46c8555f6
Instruction ID: 1de4affccaffc7d261ae86323e0dea41cfb4fc672c44a56443b080907fa203ed
Opcode Fuzzy Hash: 04e2c90ffad47352b7aa839a69768a504bf406d3c02da006cc9409f46c8555f6
Instruction Fuzzy Hash: 89B1D030604340AFD324DF24C885F6A77E6AF84319F94894CF8565B2E2DBB5ED46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 006D5D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 006D5D30
GetWindowRect.USER32(?,?), ref: 006D5D71
ScreenToClient.USER32(?,?), ref: 006D5D99
GetClientRect.USER32(?,?), ref: 006D5ED7
GetWindowRect.USER32(?,?), ref: 006D5EF8

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: d3800465b3f7920259353dffe9251212d64265f9d6896ad315226f14f4b12853
Instruction ID: d26d6dae8906151cc31e128eb10724c17de96b92b6bd2bec4a994c9578a27b11
Opcode Fuzzy Hash: d3800465b3f7920259353dffe9251212d64265f9d6896ad315226f14f4b12853
Instruction Fuzzy Hash: 1EB16A34A0074ADBDB10DFA9C4407EEB7F2FF58310F14851AE8AAD7690DB34AA91DB54

Uniqueness

Uniqueness Score: -1.00%

Function 007001B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 007000BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007000D6
__allrem.LIBCMT ref: 007000ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0070010B
__allrem.LIBCMT ref: 00700122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00700140

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction ID: f49cd91cffde22e3993c3d97fd14a2f106fb5a77b9949b683dd6bac3631d9c37
Opcode Fuzzy Hash: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction Fuzzy Hash: 2E810872A01B0ADBE7209F68CC45BAE73EAAF41734F24463EF651D62C1E778D9408790

Uniqueness

Uniqueness Score: -1.00%

Function 007061FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,006F82D9,006F82D9,?,?,?,0070644F,00000001,00000001,8BE85006), ref: 00706258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0070644F,00000001,00000001,8BE85006,?,?,?), ref: 007062DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 007063D8
__freea.LIBCMT ref: 007063E5

Part of subcall function 00703820: RtlAllocateHeap.NTDLL(00000000,?,007A1444,?,006EFDF5,?,?,006DA976,00000010,007A1440,006D13FC,?,006D13C6,?,006D1129), ref: 00703852

__freea.LIBCMT ref: 007063EE
__freea.LIBCMT ref: 00706413

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: af83f7516c0654e0fecd1d957314104961cf34eb2aa30535d4abe13ed594feda
Instruction ID: 8b64dd50df4397370da4e6f25fc985e084d4730df93016cf20860a7b9b143cdd
Opcode Fuzzy Hash: af83f7516c0654e0fecd1d957314104961cf34eb2aa30535d4abe13ed594feda
Instruction Fuzzy Hash: EC51AF72600216EBEB258F64CC95EBFB6E9EB44754F144729F905D61C1DB38DC60C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 0075BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Part of subcall function 0075C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0075B6AE,?,?), ref: 0075C9B5
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075C9F1
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075CA68
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0075BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0075BD25
RegCloseKey.ADVAPI32(00000000), ref: 0075BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0075BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0075BDF3
RegCloseKey.ADVAPI32(?), ref: 0075BDFF

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 7567ad5930ce32df04395b6759ba4935ac3db005a3e56b53cd1efa08914053fa
Instruction ID: d2654c93a04d55d8f3bc9f8b90b4b1613de51ef239718020df0784aef7d00bc5
Opcode Fuzzy Hash: 7567ad5930ce32df04395b6759ba4935ac3db005a3e56b53cd1efa08914053fa
Instruction Fuzzy Hash: 34818C30208341AFD715DF24C895E6ABBE5FF84308F14895DF8964B2A2DB75ED09CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0072F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 0072F7B9
SysAllocString.OLEAUT32(00000001), ref: 0072F860
VariantCopy.OLEAUT32(0072FA64,00000000), ref: 0072F889
VariantClear.OLEAUT32(0072FA64), ref: 0072F8AD
VariantCopy.OLEAUT32(0072FA64,00000000), ref: 0072F8B1
VariantClear.OLEAUT32(?), ref: 0072F8BB

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: cfb57628a9fb640819e94aa3dd7481cb340a5377d92fa589116c5c90239ff6bc
Instruction ID: 3fa2ff2b4617be4cf224a4d7478e514ae739d5d5904191b57e8f6754f3a75f48
Opcode Fuzzy Hash: cfb57628a9fb640819e94aa3dd7481cb340a5377d92fa589116c5c90239ff6bc
Instruction Fuzzy Hash: BB51D631501320FBCF10AB65E895B39B7B5EF45310B20947BE846DF295DB789C80CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0074910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 006D7620: _wcslen.LIBCMT ref: 006D7625

Part of subcall function 006D6B57: _wcslen.LIBCMT ref: 006D6B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 007494E5
_wcslen.LIBCMT ref: 00749506
_wcslen.LIBCMT ref: 0074952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00749585

Strings

X, xrefs: 00749412

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: e4498fdccb8eef497c068f8f1c7e5b0aab4f918d534c868fe676c27c1c88557a
Instruction ID: 850dce11c78de4b7de1c64a23cf7f15604053cf3f47aa04a0c535898a727285d
Opcode Fuzzy Hash: e4498fdccb8eef497c068f8f1c7e5b0aab4f918d534c868fe676c27c1c88557a
Instruction Fuzzy Hash: CDE1AE31A083409FC764DF24C881A6BB7E1BF85314F14896DF9899B3A2EB35DD05CB96

Uniqueness

Uniqueness Score: -1.00%

Function 006E920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 006E9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 006E9BB2

BeginPaint.USER32(?,?,?), ref: 006E9241
GetWindowRect.USER32(?,?), ref: 006E92A5
ScreenToClient.USER32(?,?), ref: 006E92C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 006E92D3
EndPaint.USER32(?,?,?,?,?), ref: 006E9321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 007271EA

Part of subcall function 006E9339: BeginPath.GDI32(00000000), ref: 006E9357

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 38ea0b68587e41847d58a21dbd254755bf241000b0f46e1f5c7ee1a16015cdea
Instruction ID: 406f56c88ab487128e234f3c1157ec71c64a1cf9239508a59b34d8c4eb5b0573
Opcode Fuzzy Hash: 38ea0b68587e41847d58a21dbd254755bf241000b0f46e1f5c7ee1a16015cdea
Instruction Fuzzy Hash: 7941E030105340AFE711DF25DC84FBB7BA9EF86320F104229FAA5872E1C774A845DB66

Uniqueness

Uniqueness Score: -1.00%

Function 007407EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0074080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00740847
EnterCriticalSection.KERNEL32(?), ref: 00740863
LeaveCriticalSection.KERNEL32(?), ref: 007408DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 007408F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00740921

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 1af9cc5f6559b8fd1685641086149a329bf502f71b01aa0adddb8685a01fe495
Instruction ID: 176038c1395d604e9a5befa5a508e98b62bc0755d1b71423d633178c50660099
Opcode Fuzzy Hash: 1af9cc5f6559b8fd1685641086149a329bf502f71b01aa0adddb8685a01fe495
Instruction Fuzzy Hash: 28419C71900205EFEF05AF54DC85A6A7779FF04300F1080A9EE00AA297DB74EE65DBA8

Uniqueness

Uniqueness Score: -1.00%

Function 007681DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,0072F3AB,00000000,?,?,00000000,?,0072682C,00000004,00000000,00000000), ref: 0076824C
EnableWindow.USER32(00000000,00000000), ref: 00768272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 007682D1
ShowWindow.USER32(00000000,00000004), ref: 007682E5
EnableWindow.USER32(00000000,00000001), ref: 0076830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0076832F

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 2ac1a5c29f5fe90d9aac1d4f4f798fbe6ce6075ddb300de8d99bb6ea6498d3be
Instruction ID: 496c3847ef0e472e8fc63a7f21895a7a5a06340e9cf15d6852dc64cdd15b8fdd
Opcode Fuzzy Hash: 2ac1a5c29f5fe90d9aac1d4f4f798fbe6ce6075ddb300de8d99bb6ea6498d3be
Instruction Fuzzy Hash: 7241E830601640EFDB56CF15C8A9BE87BE0FB46714F1843A9E94A4F272CB39A841CB46

Uniqueness

Uniqueness Score: -1.00%

Function 00734C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00734C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00734CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00734CEA
_wcslen.LIBCMT ref: 00734D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00734D10
_wcsstr.LIBVCRUNTIME ref: 00734D1A

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: cf7ab9a263a14f81e6901db5c862dfa4a9c21a712c2d6c8a17b1be01a5b67906
Instruction ID: 652acf3116213d61dedf365a65aee826ed49ec27f3cca9cf57ff2e2045c466d2
Opcode Fuzzy Hash: cf7ab9a263a14f81e6901db5c862dfa4a9c21a712c2d6c8a17b1be01a5b67906
Instruction Fuzzy Hash: B2212932305304BBFB195B35EC09E7B7B9DDF45750F10806DF905CA192EEA9EC0086A4

Uniqueness

Uniqueness Score: -1.00%

Function 0074581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 006D3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006D3A97,?,?,006D2E7F,?,?,?,00000000), ref: 006D3AC2

_wcslen.LIBCMT ref: 0074587B
CoInitialize.OLE32(00000000), ref: 00745995
CoCreateInstance.OLE32(0076FCF8,00000000,00000001,0076FB68,?), ref: 007459AE
CoUninitialize.OLE32 ref: 007459CC

Strings

.lnk, xrefs: 00745876, 007458C1, 00745985

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: c94bdcb5356e88c5c068ab8dba1a093f5b7c3958d45d01a1fe4b443b555559cf
Instruction ID: 34272237e39419d327b684f75dea15cc4c646b881185779a39875e0e21873e5a
Opcode Fuzzy Hash: c94bdcb5356e88c5c068ab8dba1a093f5b7c3958d45d01a1fe4b443b555559cf
Instruction Fuzzy Hash: 7ED143B1A08701DFC714DF24C48492ABBE6EF89710F14895DF88A9B362DB35EC45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0073175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00730FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00730FCA
Part of subcall function 00730FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00730FD6
Part of subcall function 00730FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00730FE5
Part of subcall function 00730FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00730FEC
Part of subcall function 00730FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00731002

GetLengthSid.ADVAPI32(?,00000000,00731335), ref: 007317AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 007317BA
HeapAlloc.KERNEL32(00000000), ref: 007317C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 007317DA
GetProcessHeap.KERNEL32(00000000,00000000,00731335), ref: 007317EE
HeapFree.KERNEL32(00000000), ref: 007317F5

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: ef3157d1178847a0f2e254d23b2e48c8bef6dc1568ed7cfab561c10aea7ddfd2
Instruction ID: ce9f4102562c6a17b14b863ccf99e89bef7022874a9e246e2233330f1cbae1e7
Opcode Fuzzy Hash: ef3157d1178847a0f2e254d23b2e48c8bef6dc1568ed7cfab561c10aea7ddfd2
Instruction Fuzzy Hash: FC11BE71500205FFEB259FA4CC49BBE7BA9EB42355F588018F48297212D77AAD44CB70

Uniqueness

Uniqueness Score: -1.00%

Function 007314CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 007314FF
OpenProcessToken.ADVAPI32(00000000), ref: 00731506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00731515
CloseHandle.KERNEL32(00000004), ref: 00731520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0073154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00731563

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 30ace8396ff4b67202ace4f4f5582e1ac98434b35af4cc632e69d70966ce7b31
Instruction ID: 7752e96556bf7098752836b9a4189164ee6656ee30418db30c411410b39aff72
Opcode Fuzzy Hash: 30ace8396ff4b67202ace4f4f5582e1ac98434b35af4cc632e69d70966ce7b31
Instruction Fuzzy Hash: E9116A7250024DEBEF128F98DD49FEE7BA9EF48744F048015FA06A2160C3B9CE60DB60

Uniqueness

Uniqueness Score: -1.00%

Function 006F3382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,006F3379,006F2FE5), ref: 006F3390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 006F339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 006F33B7
SetLastError.KERNEL32(00000000,?,006F3379,006F2FE5), ref: 006F3409

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 5e8d5aa230d56d240fcb7788c7ad66c8a91b4fbc19379eb3681a03ceac465f8e
Instruction ID: 9529aa9e34b84ad00dae042c4f8f1d4d761b0bd74a4551f670112d56e64e3996
Opcode Fuzzy Hash: 5e8d5aa230d56d240fcb7788c7ad66c8a91b4fbc19379eb3681a03ceac465f8e
Instruction Fuzzy Hash: 35012433208339BEAA2627787C85AB72A96EB15379B20422EF710C43F0EF554D12514C

Uniqueness

Uniqueness Score: -1.00%

Function 00702D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00705686,00713CD6,?,00000000,?,00705B6A,?,?,?,?,?,006FE6D1,?,00798A48), ref: 00702D78
_free.LIBCMT ref: 00702DAB
_free.LIBCMT ref: 00702DD3
SetLastError.KERNEL32(00000000,?,?,?,?,006FE6D1,?,00798A48,00000010,006D4F4A,?,?,00000000,00713CD6), ref: 00702DE0
SetLastError.KERNEL32(00000000,?,?,?,?,006FE6D1,?,00798A48,00000010,006D4F4A,?,?,00000000,00713CD6), ref: 00702DEC
_abort.LIBCMT ref: 00702DF2

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 1bf2c61ca496c118ac84d8d4ab22444a04b3b128eba0b0ea8065ae74983b2727
Instruction ID: 6cfdca0e940aa55a786ef650f56660886d82423e6a7976676cc39de376e08ec3
Opcode Fuzzy Hash: 1bf2c61ca496c118ac84d8d4ab22444a04b3b128eba0b0ea8065ae74983b2727
Instruction Fuzzy Hash: 40F0A477644600F7C6137735AC0EA2A26D9AFC27A5B358719F825922E3EE6C9C034165

Uniqueness

Uniqueness Score: -1.00%

Function 00768A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 006E9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 006E9693
Part of subcall function 006E9639: SelectObject.GDI32(?,00000000), ref: 006E96A2
Part of subcall function 006E9639: BeginPath.GDI32(?), ref: 006E96B9
Part of subcall function 006E9639: SelectObject.GDI32(?,00000000), ref: 006E96E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00768A4E
LineTo.GDI32(?,00000003,00000000), ref: 00768A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00768A70
LineTo.GDI32(?,00000000,00000003), ref: 00768A80
EndPath.GDI32(?), ref: 00768A90
StrokePath.GDI32(?), ref: 00768AA0

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: f550b3b9478693dd57922e8204f6d2f56b350bbdddb44621cd323f9a5b4d8501
Instruction ID: 52592dd170973d18b7b48f2c46c376cab8ae405443b3a318e06d09a373665f71
Opcode Fuzzy Hash: f550b3b9478693dd57922e8204f6d2f56b350bbdddb44621cd323f9a5b4d8501
Instruction Fuzzy Hash: 6011FA7600024CFFEB129F94DC48EAA7F6DEB08350F00C012FA5699161C7759D55DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 007351FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00735218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00735229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00735230
ReleaseDC.USER32(00000000,00000000), ref: 00735238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0073524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00735261

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 76eabd7d5670af19740b4cf0828191f4f75e8da2679fba080eb5bd5d5bf2d6e3
Instruction ID: 2e758272dbe18e8a85b09aafdbf5d1e91300496cf326e1cbe9440c3b58ecdc2d
Opcode Fuzzy Hash: 76eabd7d5670af19740b4cf0828191f4f75e8da2679fba080eb5bd5d5bf2d6e3
Instruction Fuzzy Hash: 65018FB5A00718BBEB119BA5DC49A5EBFB8FB48351F048066FA05A7281D6B49800CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 006D1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 006D1BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 006D1BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 006D1C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 006D1C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 006D1C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 006D1C22

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: f8f573ff264a3accc1374b1108628eac8e54e81d8ab5dede308f89756a343562
Instruction ID: 04f8397cd30ee4ca6652d0ca47f51ccfab23aec15ea65f99ff32b51637731597
Opcode Fuzzy Hash: f8f573ff264a3accc1374b1108628eac8e54e81d8ab5dede308f89756a343562
Instruction Fuzzy Hash: B50148B090275A7DE3008F5A8C85A52FEA8FF19354F00415B915C47941C7F5A864CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0073EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0073EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0073EB46
GetWindowThreadProcessId.USER32(?,?), ref: 0073EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0073EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0073EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0073EB75

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 97f5b6ac5880c7a9c23156c82bb810a0581617701c6eb053d980895b06a0684a
Instruction ID: e84d1ee2c240ca9e514bce230c3ac318a71878f39679f3d13464842d4fe44adc
Opcode Fuzzy Hash: 97f5b6ac5880c7a9c23156c82bb810a0581617701c6eb053d980895b06a0684a
Instruction Fuzzy Hash: BCF01DB2140258BBE6226752DC0EEBB7A7CEFCAB11F008158F642E119196E85A0186B9

Uniqueness

Uniqueness Score: -1.00%

Function 00727439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00727452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00727469
GetWindowDC.USER32(?), ref: 00727475
GetPixel.GDI32(00000000,?,?), ref: 00727484
ReleaseDC.USER32(?,00000000), ref: 00727496
GetSysColor.USER32(00000005), ref: 007274B0

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 56e8d662c2ec022928b0fc2c3a009533f9be6e994307af506aef4df51e9a94cc
Instruction ID: dcf92beec899307d520581f1c77654c3c05a388ef2c6bbd20112727ae290b071
Opcode Fuzzy Hash: 56e8d662c2ec022928b0fc2c3a009533f9be6e994307af506aef4df51e9a94cc
Instruction Fuzzy Hash: D801AD31400355EFEB126FA4EC08BBA7BB5FF04311F608060F956A21A1CB791E51EB54

Uniqueness

Uniqueness Score: -1.00%

Function 00731874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0073187F
UnloadUserProfile.USERENV(?,?), ref: 0073188B
CloseHandle.KERNEL32(?), ref: 00731894
CloseHandle.KERNEL32(?), ref: 0073189C
GetProcessHeap.KERNEL32(00000000,?), ref: 007318A5
HeapFree.KERNEL32(00000000), ref: 007318AC

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: c1923dbc58f787326767a73917f90bf901ac767ab05dcdeec0e15f16198bfdc0
Instruction ID: 141c59215779c5d4788b32c57112b7e50769a73c984b7c135b9074fcd14691a2
Opcode Fuzzy Hash: c1923dbc58f787326767a73917f90bf901ac767ab05dcdeec0e15f16198bfdc0
Instruction Fuzzy Hash: D1E0ED76004205BBDB026FA2ED0C915BF39FF4A722710C221F26691170CBB65420DF64

Uniqueness

Uniqueness Score: -1.00%

Function 006DBBE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 232COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 006DBEB3

Strings

D%zD%z, xrefs: 006DBCA5
D%z, xrefs: 006DBCA2
D%z, xrefs: 006DBDED, 006DBD91, 006DBD1B
D%z, xrefs: 006DBE9A

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Init_thread_footer
String ID: D%z$D%z$D%z$D%zD%z
API String ID: 1385522511-3299656855
Opcode ID: 1820b6924b1cda8e42478be900116b557a273e6a701fc6d5d1c3541a110da116
Instruction ID: 76cdcd034df3da95fbb41347c63be535bc09ddb897b6cc40f19f547912ba22df
Opcode Fuzzy Hash: 1820b6924b1cda8e42478be900116b557a273e6a701fc6d5d1c3541a110da116
Instruction Fuzzy Hash: 69913975E0020ACFCB18CF59C0906A9B7F2FF99310B25916ED945AB355E731E982CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00757B7E Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 006F0242: EnterCriticalSection.KERNEL32(007A070C,007A1884,?,?,006E198B,007A2518,?,?,?,006D12F9,00000000), ref: 006F024D
Part of subcall function 006F0242: LeaveCriticalSection.KERNEL32(007A070C,?,006E198B,007A2518,?,?,?,006D12F9,00000000), ref: 006F028A

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Part of subcall function 006F00A3: __onexit.LIBCMT ref: 006F00A9

__Init_thread_footer.LIBCMT ref: 00757BFB

Part of subcall function 006F01F8: EnterCriticalSection.KERNEL32(007A070C,?,?,006E8747,007A2514), ref: 006F0202
Part of subcall function 006F01F8: LeaveCriticalSection.KERNEL32(007A070C,?,006E8747,007A2514), ref: 006F0235

Strings

G, xrefs: 00757C7F
Variable must be of type 'Object'., xrefs: 00757C3A
5, xrefs: 00757C78
+Tr, xrefs: 00757E2E

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: +Tr$5$G$Variable must be of type 'Object'.
API String ID: 535116098-3922178991
Opcode ID: 9504fb1c1ba25a93a05a2ad53e657a1a0c1ff828d86120a6eb47c798bb0a268b
Instruction ID: 2206e359d11c50ddeb99546b003d16ca6d0b0d8ef8046fee7470b2ae0cee4b54
Opcode Fuzzy Hash: 9504fb1c1ba25a93a05a2ad53e657a1a0c1ff828d86120a6eb47c798bb0a268b
Instruction Fuzzy Hash: 33916E70A04209EFCB08EF54E8959FDB7B6BF45301F108059FC069B292DBB9AE49CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0073C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006D7620: _wcslen.LIBCMT ref: 006D7625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0073C6EE
_wcslen.LIBCMT ref: 0073C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0073C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0073C7CA

Strings

0, xrefs: 0073C6AF

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 5d70e1d65695d50c18411dbbeee3befb53ee495cff8ab877e8dc81ac0881062e
Instruction ID: e5643bfa15046385d4a978f1d28c96324a376140dacba306339e2fa206df9a4f
Opcode Fuzzy Hash: 5d70e1d65695d50c18411dbbeee3befb53ee495cff8ab877e8dc81ac0881062e
Instruction Fuzzy Hash: 4751E2726043409BF7529F28C885B6B77E8AF89310F040A2DF996F31A2DB78DD04CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0075AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 0075AEA3

Part of subcall function 006D7620: _wcslen.LIBCMT ref: 006D7625

GetProcessId.KERNEL32(00000000), ref: 0075AF38
CloseHandle.KERNEL32(00000000), ref: 0075AF67

Strings

@, xrefs: 0075AE72
<, xrefs: 0075AE6B

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 2445a8658ecbe9afcffa603a6db9e1e8e0460f1b8e9064e37721304d417b620d
Instruction ID: b2ca69c7a6418ea6f542347675365c20de0372fe578b24fc5c439158ad828611
Opcode Fuzzy Hash: 2445a8658ecbe9afcffa603a6db9e1e8e0460f1b8e9064e37721304d417b620d
Instruction Fuzzy Hash: 18715971A00219DFCB14DF54D485A9EBBF1BF08310F0485AEE816AB392DB74ED45CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0073719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00737206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0073723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0073724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 007372CF

Strings

DllGetClassObject, xrefs: 00737242

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 8fae348152053146573f0432cfc1cf529a9a94566f8e5d63617a85e3d866545e
Instruction ID: c411d1eb9db18e9f20f84f30a2d6589b7704a4370115330de7fa7a5e61e04184
Opcode Fuzzy Hash: 8fae348152053146573f0432cfc1cf529a9a94566f8e5d63617a85e3d866545e
Instruction Fuzzy Hash: E5411DF2604205DFEB29CF54C884A9B7BB9FF49310F1580A9BD059F20AD7B9D944DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00763D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00763E35
IsMenu.USER32(?), ref: 00763E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00763E92
DrawMenuBar.USER32 ref: 00763EA5

Strings

0, xrefs: 00763D89

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: c26ca9e4dd11e2fddd3b6d695ea88e53da2c680bf7815008ee79ea95f14475bb
Instruction ID: 1444509be4a0fe0ca9abc126282856dbd0383d0e7686fb6e3f6dbb8da29a59d9
Opcode Fuzzy Hash: c26ca9e4dd11e2fddd3b6d695ea88e53da2c680bf7815008ee79ea95f14475bb
Instruction Fuzzy Hash: F0414775A01209AFDB10DF60D884AAABBF9FF49350F04812AFD16A7250D739AE54CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00731DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Part of subcall function 00733CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00733CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00731E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00731E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00731EA9

Part of subcall function 006D6B57: _wcslen.LIBCMT ref: 006D6B6A

Strings

ListBox, xrefs: 00731E25
ComboBox, xrefs: 00731DF0

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 73c96d24ecd8a96e80fdaa666f7fde8fab3e8775b9ee59b43129ff166938986b
Instruction ID: 144f17d4fb896703ed7f25c9df1c823161e03310a372a7ded0a9646644ca9ddc
Opcode Fuzzy Hash: 73c96d24ecd8a96e80fdaa666f7fde8fab3e8775b9ee59b43129ff166938986b
Instruction Fuzzy Hash: AB2123B2A40204BEEB14AB60DC45CFFB7B9DF41350F54451EF822A32E2DB7D4D098624

Uniqueness

Uniqueness Score: -1.00%

Function 00762F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00762F8D
LoadLibraryW.KERNEL32(?), ref: 00762F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00762FA9
DestroyWindow.USER32(?), ref: 00762FB1

Strings

SysAnimate32, xrefs: 00762F68

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 0eebaf71a50527c5f26ccc9d03f3d60966a4ab20ceea4e55203df512bd9c4897
Instruction ID: adec3db30a13d66e342eb2a37a270546e534539d3a460560a75e3227ef2b74ea
Opcode Fuzzy Hash: 0eebaf71a50527c5f26ccc9d03f3d60966a4ab20ceea4e55203df512bd9c4897
Instruction Fuzzy Hash: 7621DE71204605ABEB514FA4DC80EFB37B9EF59364F108618FE52D61A1C7B9DC429B60

Uniqueness

Uniqueness Score: -1.00%

Function 006F4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,006F4D1E,007028E9,?,006F4CBE,007028E9,007988B8,0000000C,006F4E15,007028E9,00000002), ref: 006F4D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 006F4DA0
FreeLibrary.KERNEL32(00000000,?,?,?,006F4D1E,007028E9,?,006F4CBE,007028E9,007988B8,0000000C,006F4E15,007028E9,00000002,00000000), ref: 006F4DC3

Strings

mscoree.dll, xrefs: 006F4D86
CorExitProcess, xrefs: 006F4D98

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a049f690f4cbf51a17be44465992fd00fb22dc04e0f73f63edc27ef81d521838
Instruction ID: 258562cd605416a438d072dd977abc58dd594bffcc21d92d8f0b54901819460e
Opcode Fuzzy Hash: a049f690f4cbf51a17be44465992fd00fb22dc04e0f73f63edc27ef81d521838
Instruction Fuzzy Hash: 71F0813050020CABDB159B94DC09BFEBBA5EF44751F004095E90AA2650DB745D40CAD4

Uniqueness

Uniqueness Score: -1.00%

Function 0072D3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0072D3AD
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0072D3BF
FreeLibrary.KERNEL32(00000000), ref: 0072D3E5

Strings

GetSystemWow64DirectoryW, xrefs: 0072D3B9
X64, xrefs: 0072D2A8

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 145871493-2590602151
Opcode ID: 82e93b54213b02991a579f62d4f93873eb9722f67e68129a711be70db5532b82
Instruction ID: f08101681890dacfcaccd71e2aff04959e5da7f0330e2420a7c3307487db59af
Opcode Fuzzy Hash: 82e93b54213b02991a579f62d4f93873eb9722f67e68129a711be70db5532b82
Instruction Fuzzy Hash: A1F055B0802730CBE736AB11EC189BD7351BF02701F68C196F843E1002DB6CCE408687

Uniqueness

Uniqueness Score: -1.00%

Function 006D4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,006D4EDD,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 006D4EAE
FreeLibrary.KERNEL32(00000000,?,?,006D4EDD,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 006D4EA8
kernel32.dll, xrefs: 006D4E94

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 9d5ce33633201b8f879a8db36e3ca157817e20daa987039bf88cb54275b40043
Instruction ID: 0f5f9f2ec540540f642a2e679f1964a5c1bae3f48832e1a6788cdcc52f817ce8
Opcode Fuzzy Hash: 9d5ce33633201b8f879a8db36e3ca157817e20daa987039bf88cb54275b40043
Instruction Fuzzy Hash: 18E0CD75E017226BD23317257C18BBF7755AF82F627094116FC46D2300DFB8CD0140A4

Uniqueness

Uniqueness Score: -1.00%

Function 006D4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00713CDE,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 006D4E74
FreeLibrary.KERNEL32(00000000,?,?,00713CDE,?,007A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 006D4E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 006D4E6E
kernel32.dll, xrefs: 006D4E5B

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 659d644e2e34fd384737fe50803d7a64dc8530789483f8d4ce3e1997e85353df
Instruction ID: 1e287c962f316968d2365e3f51110a7c30c07a87d38941802b722ec1666283b7
Opcode Fuzzy Hash: 659d644e2e34fd384737fe50803d7a64dc8530789483f8d4ce3e1997e85353df
Instruction Fuzzy Hash: 92D0C271902761674A231B24BC08DEB3B1AAFC6B513054212F846A2310CFB8CD0181D4

Uniqueness

Uniqueness Score: -1.00%

Function 0075A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0075A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0075A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0075A468
CloseHandle.KERNEL32(?), ref: 0075A63D

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 49fb00e88d3e66cb24ea3d85d9bedd10df30d1bc6a6037cd988eb96f26e84563
Instruction ID: 5b76c2fdd5220a04bbe4d7147e2f0f6785f7009a9cc21663cc82b71276b17e58
Opcode Fuzzy Hash: 49fb00e88d3e66cb24ea3d85d9bedd10df30d1bc6a6037cd988eb96f26e84563
Instruction Fuzzy Hash: C8A1B071604301AFD760DF24C882F6AB7E6AF84714F14891DF99A9B392D7B4EC44CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0070BB27 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00773700), ref: 0070BB91
WideCharToMultiByte.KERNEL32(00000000,00000000,007A121C,000000FF,00000000,0000003F,00000000,?,?), ref: 0070BC09
WideCharToMultiByte.KERNEL32(00000000,00000000,007A1270,000000FF,?,0000003F,00000000,?), ref: 0070BC36
_free.LIBCMT ref: 0070BB7F

Part of subcall function 007029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000), ref: 007029DE
Part of subcall function 007029C8: GetLastError.KERNEL32(00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000,00000000), ref: 007029F0

_free.LIBCMT ref: 0070BD4B

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: 7c7d7ddf5236eaf70b0799f9a9f70dbe2c4ac6f29027a869e3926a9fad197ab8
Instruction ID: 872fe7b4f56e26affa0f48dd98180a6c4461752e70c652df0ef9cc4b7f8ad31a
Opcode Fuzzy Hash: 7c7d7ddf5236eaf70b0799f9a9f70dbe2c4ac6f29027a869e3926a9fad197ab8
Instruction Fuzzy Hash: 79510571900209EFEB10EF659C85AAAB7F8FF81350F50436AE450D72E1EB789F418B64

Uniqueness

Uniqueness Score: -1.00%

Function 0073E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0073DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0073CF22,?), ref: 0073DDFD

Part of subcall function 0073DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0073CF22,?), ref: 0073DE16

Part of subcall function 0073E199: GetFileAttributesW.KERNEL32(?,0073CF95), ref: 0073E19A

lstrcmpiW.KERNEL32(?,?), ref: 0073E473
MoveFileW.KERNEL32(?,?), ref: 0073E4AC
_wcslen.LIBCMT ref: 0073E5EB
_wcslen.LIBCMT ref: 0073E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 0073E650

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 2d7df6fed0f53378a84d9ff7156ea17c4e90b5152516c5bc573669ba4461a812
Instruction ID: 02cbf1f3057567ad04ac310bbafe162ade73db8a0de28b8cde86948f88b225c5
Opcode Fuzzy Hash: 2d7df6fed0f53378a84d9ff7156ea17c4e90b5152516c5bc573669ba4461a812
Instruction Fuzzy Hash: 655185B25083859BD764DB90DC819DF77ED9F84340F00491EF6C9D3192EF78A588876A

Uniqueness

Uniqueness Score: -1.00%

Function 0075B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Part of subcall function 0075C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0075B6AE,?,?), ref: 0075C9B5
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075C9F1
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075CA68
Part of subcall function 0075C998: _wcslen.LIBCMT ref: 0075CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0075BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0075BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0075BB63
RegCloseKey.ADVAPI32(?,?), ref: 0075BBA6
RegCloseKey.ADVAPI32(00000000), ref: 0075BBB3

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 6d018a37206ca4c63a0d61ce5841cd133cadbff730644fd2756a29846960f23b
Instruction ID: 600d2c260b09e32b27a6b7555b8650f2cceb2eacb3074690977f666e6f2dee4a
Opcode Fuzzy Hash: 6d018a37206ca4c63a0d61ce5841cd133cadbff730644fd2756a29846960f23b
Instruction Fuzzy Hash: E861C271208241AFD314DF14C890E7ABBE5FF84308F14855DF8994B2A2DB75ED49CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00738BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00738BCD
VariantClear.OLEAUT32 ref: 00738C3E
VariantClear.OLEAUT32 ref: 00738C9D
VariantClear.OLEAUT32(?), ref: 00738D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00738D3B

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 25e429a72c5b7b9c90e7bd36870cba5aaca216c79db604f05e0c12ef6b1927c7
Instruction ID: be83457bb7a87ba22a21e248b5ec7bf40c83c5ef64bd65d69e4e20c4e7dab463
Opcode Fuzzy Hash: 25e429a72c5b7b9c90e7bd36870cba5aaca216c79db604f05e0c12ef6b1927c7
Instruction Fuzzy Hash: 4A5148B5A00219AFDB10CF68C884AAABBF4FF8D310F158559F915DB350EB34E911CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00748AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00748BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00748BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00748C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00748C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00748C5F

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 6876967741b0308d5d7cac0305199b160719023714f504489d8c9a71429e40da
Instruction ID: 9635f52530465e3d0e3cafd6b59a35548ab925787677d3e6ba7d22bbe5ff217a
Opcode Fuzzy Hash: 6876967741b0308d5d7cac0305199b160719023714f504489d8c9a71429e40da
Instruction Fuzzy Hash: 67515D35A002199FCB45DF65C880E6DBBF6FF48314F088499E849AB362DB35ED41CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00758EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00758F40
GetProcAddress.KERNEL32(00000000,?), ref: 00758FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00758FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00759032
FreeLibrary.KERNEL32(00000000), ref: 00759052

Part of subcall function 006EF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00741043,?,7644E610), ref: 006EF6E6
Part of subcall function 006EF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,0072FA64,00000000,00000000,?,?,00741043,?,7644E610,?,0072FA64), ref: 006EF70D

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 57a9ecce90e01b5e1216616bdd9693d8e421d65a591892b48d37a04d96ba8fe1
Instruction ID: a8a04b439705a8663272b93bcaafbaf0d1b033a4d8add5ab4e450daeb78476a7
Opcode Fuzzy Hash: 57a9ecce90e01b5e1216616bdd9693d8e421d65a591892b48d37a04d96ba8fe1
Instruction Fuzzy Hash: CA514A35A00205DFC745DF54C4948ADBBB1FF49315F088099ED0AAB3A2DB75ED89CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00766B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00766C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00766C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00766C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,0074AB79,00000000,00000000), ref: 00766C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00766CC7

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 2ae6c83b692c4fab29c30d2e5702685eb0ebae28efb1b318aec5671e1f4f9a1c
Instruction ID: 8e2a43304c3b4aca464fda7e4930e3718abd7d3debbe045aa26bf52c66b0b581
Opcode Fuzzy Hash: 2ae6c83b692c4fab29c30d2e5702685eb0ebae28efb1b318aec5671e1f4f9a1c
Instruction Fuzzy Hash: E141E235600504AFD725CF28CC48FA57BA5EB09350F954268EC9AA72A0C379BD40CA64

Uniqueness

Uniqueness Score: -1.00%

Function 00702051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 007020C3
_free.LIBCMT ref: 007020E3

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 6c0e1822d327b044fbdbf4d48a394b482efa80c14e2a0fb46491e7511a580de6
Instruction ID: 717a3d38f3b0a76fd539a1934feb05e6fd1f8bc575b02f3d5dfe20c238920c3e
Opcode Fuzzy Hash: 6c0e1822d327b044fbdbf4d48a394b482efa80c14e2a0fb46491e7511a580de6
Instruction Fuzzy Hash: F5419333A00304DFCB24DF78C885A59B7E5EF89314F1546A9E615EB392DA35AD02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 006E912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 006E9141
ScreenToClient.USER32(00000000,?), ref: 006E915E
GetAsyncKeyState.USER32(00000001), ref: 006E9183
GetAsyncKeyState.USER32(00000002), ref: 006E919D

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 0eda5e36a253d7be3392cee5c6fe967064d7198722622a1ddbd248f0828bfc85
Instruction ID: 97797849ca386c7e494e2613036b4a0810a48c0de4450d8f71e1b2f226d17847
Opcode Fuzzy Hash: 0eda5e36a253d7be3392cee5c6fe967064d7198722622a1ddbd248f0828bfc85
Instruction Fuzzy Hash: A7416E3190861AFBDF199F65D848BEEB775FF45320F208219E429A6290C7345D50CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00743874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 007438CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00743922
TranslateMessage.USER32(?), ref: 0074394B
DispatchMessageW.USER32(?), ref: 00743955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00743966

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 0005dff570550ebaee44bd682dfb8308285f8a00ad567535cd06bb89597ac496
Instruction ID: b0e53533a439444c0e536f4926ee93769234d1a33d9765992d95d730e36d990f
Opcode Fuzzy Hash: 0005dff570550ebaee44bd682dfb8308285f8a00ad567535cd06bb89597ac496
Instruction Fuzzy Hash: AF31D9709043419EFB35CB349C48BB777A8AB46308F54856DD4AAC20A0E3FCB685CB25

Uniqueness

Uniqueness Score: -1.00%

Function 0074CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 0074CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 0074CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,0074C21E,00000000), ref: 0074CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,0074C21E,00000000), ref: 0074CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,0074C21E,00000000), ref: 0074CFF2

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 86a74b9f96181028d45a6baad673d40cd274101def15536539f68ee46d64c1cc
Instruction ID: 27fa84bd04711c806bc02e1d4ad49df109c0b73f08f2853845a498e5b947c5cb
Opcode Fuzzy Hash: 86a74b9f96181028d45a6baad673d40cd274101def15536539f68ee46d64c1cc
Instruction Fuzzy Hash: 51317C72601305EFDB61DFA5C884AABBBF9EF14310B10842EF546D2101EB78AE459B60

Uniqueness

Uniqueness Score: -1.00%

Function 00731901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00731915
PostMessageW.USER32(00000001,00000201,00000001), ref: 007319C1
Sleep.KERNEL32(00000000,?,?,?), ref: 007319C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 007319DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 007319E2

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: cceb56a4551262e3719a040504c5f4dc050b1b1d3e4e0923e453078d42f7cb51
Instruction ID: a5c205be8fb9ab9880f33f60ce73bd598c9f5e64d999ffce5ecbab432bc6bfd2
Opcode Fuzzy Hash: cceb56a4551262e3719a040504c5f4dc050b1b1d3e4e0923e453078d42f7cb51
Instruction Fuzzy Hash: 9631F471900259EFDB04CFA8CD99BEE3BB5EB04315F008225F962A72D1C7B4AD54CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00765706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00765745
SendMessageW.USER32(?,00001074,?,00000001), ref: 0076579D
_wcslen.LIBCMT ref: 007657AF
_wcslen.LIBCMT ref: 007657BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00765816

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: c56fccd2390b1608f7fd3c59cf3d08263af5de9dd5debd94e180cbc6ee1856e3
Instruction ID: e8bb39a81be21ff17bb14079e961dfb9db618231dd52df418a628665d0e57ac0
Opcode Fuzzy Hash: c56fccd2390b1608f7fd3c59cf3d08263af5de9dd5debd94e180cbc6ee1856e3
Instruction Fuzzy Hash: CF21B671904618DADB218F60CC84EEE7BB8FF04724F108256FD2AEB180DB789985DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00750930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00750951
GetForegroundWindow.USER32 ref: 00750968
GetDC.USER32(00000000), ref: 007509A4
GetPixel.GDI32(00000000,?,00000003), ref: 007509B0
ReleaseDC.USER32(00000000,00000003), ref: 007509E8

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 70265cd338f37e37eddcc7679fc4e11f12472575aa2801272c9e6592f91a0fa0
Instruction ID: 2fb4971eca20e1512e629438959a9b3dce577d6958720b4a98b43d46169058c9
Opcode Fuzzy Hash: 70265cd338f37e37eddcc7679fc4e11f12472575aa2801272c9e6592f91a0fa0
Instruction Fuzzy Hash: D1216F39A00214AFD704EF69D888AAEBBE5EF44701F04806DE84A97352DBB4AC44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0070CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0070CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0070CDE9

Part of subcall function 00703820: RtlAllocateHeap.NTDLL(00000000,?,007A1444,?,006EFDF5,?,?,006DA976,00000010,007A1440,006D13FC,?,006D13C6,?,006D1129), ref: 00703852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0070CE0F
_free.LIBCMT ref: 0070CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0070CE31

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: bc334f34cb0823fc2148986ec011a0f0ab30fc053e480e935293b7c0b2a16d41
Instruction ID: 1d8b40084f448f41674e7b876d3f22ed77bb306853f5ff899252e2e348ffdd65
Opcode Fuzzy Hash: bc334f34cb0823fc2148986ec011a0f0ab30fc053e480e935293b7c0b2a16d41
Instruction Fuzzy Hash: 8701B1B2601215FFA32327B6EC8CC7B79ADDAC6BA1315432DFD05C6281EA688D0191B4

Uniqueness

Uniqueness Score: -1.00%

Function 006E9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 006E9693
SelectObject.GDI32(?,00000000), ref: 006E96A2
BeginPath.GDI32(?), ref: 006E96B9
SelectObject.GDI32(?,00000000), ref: 006E96E2

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 46c29ee6f40aae3392edb36b7141924725b29e81600343922eb0383382c791a5
Instruction ID: 6c299a65f9e98662d87077cd5ab1a609d993ca6e2346c04ad1c3d9eb647e117b
Opcode Fuzzy Hash: 46c29ee6f40aae3392edb36b7141924725b29e81600343922eb0383382c791a5
Instruction Fuzzy Hash: AD2183708023C5EBFB119F25EC147EA3B66BF82355F508216F411961B1D3786991CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00735711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00735726
_memcmp.LIBVCRUNTIME ref: 00735744
_memcmp.LIBVCRUNTIME ref: 00735757
_memcmp.LIBVCRUNTIME ref: 0073576F
_memcmp.LIBVCRUNTIME ref: 00735787

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 3f2e4c3d88e27bb5e2191a8f1a103aad459d26c6ac221e37f1ba69efa9c3e274
Instruction ID: 84c72cc5346b14f715b544cfe7a9be39fc60dda1a4d372a90a0027f9fc4f0163
Opcode Fuzzy Hash: 3f2e4c3d88e27bb5e2191a8f1a103aad459d26c6ac221e37f1ba69efa9c3e274
Instruction Fuzzy Hash: 5401B5A2645A09FBF2085520AD92FBB735E9B32394F414024FE099E242FB69ED10C2F4

Uniqueness

Uniqueness Score: -1.00%

Function 00702DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,006FF2DE,00703863,007A1444,?,006EFDF5,?,?,006DA976,00000010,007A1440,006D13FC,?,006D13C6), ref: 00702DFD
_free.LIBCMT ref: 00702E32
_free.LIBCMT ref: 00702E59
SetLastError.KERNEL32(00000000,006D1129), ref: 00702E66
SetLastError.KERNEL32(00000000,006D1129), ref: 00702E6F

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: e4f7ef0963664a22b3dc2eb0b91ef8cd22e1c1fe56b1f2ea9e8c1035e29cb44f
Instruction ID: 23a8940158230e5a544c661bef658b9bda3e0af1a0b4cbfbac2a79d429bece7a
Opcode Fuzzy Hash: e4f7ef0963664a22b3dc2eb0b91ef8cd22e1c1fe56b1f2ea9e8c1035e29cb44f
Instruction Fuzzy Hash: 9B01F977285600E7C6137735AC4ED2B26DDABD17A57214725F455A22E3EA6C8C034128

Uniqueness

Uniqueness Score: -1.00%

Function 0073000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0072FF41,80070057,?,?,?,0073035E), ref: 0073002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0072FF41,80070057,?,?), ref: 00730046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0072FF41,80070057,?,?), ref: 00730054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0072FF41,80070057,?), ref: 00730064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0072FF41,80070057,?,?), ref: 00730070

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: ad108b04b3712494612fabfd14a396811699769d10f30725add0bfaeb86995a9
Instruction ID: b84704426ecc6dbb9d9d7129f51ee4371e21350b2523666cc00bd2b7fd2cb62b
Opcode Fuzzy Hash: ad108b04b3712494612fabfd14a396811699769d10f30725add0bfaeb86995a9
Instruction Fuzzy Hash: FA01DF76600309BFEB214F68DC48BBA7AADEB44751F108024F846D7211D7B8CD009BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0073E97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 0073E997
QueryPerformanceFrequency.KERNEL32(?), ref: 0073E9A5
Sleep.KERNEL32(00000000), ref: 0073E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 0073E9B7
Sleep.KERNEL32 ref: 0073E9F3

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: a062e0d54be5c442c9925c6900f1223f570fe923241d70a759d714fcdf92453e
Instruction ID: bc16ca5fbcbd681ea97c12ba5cb0701679c4cc1ded00a66a9ac2e129a9a9d960
Opcode Fuzzy Hash: a062e0d54be5c442c9925c6900f1223f570fe923241d70a759d714fcdf92453e
Instruction Fuzzy Hash: ED015B71C0162DDBDF04ABE4DC596EDBB78BB09301F004546E542B2282DB78A5518766

Uniqueness

Uniqueness Score: -1.00%

Function 007310F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00731114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00730B9B,?,?,?), ref: 00731120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00730B9B,?,?,?), ref: 0073112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00730B9B,?,?,?), ref: 00731136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0073114D

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: c52cb0ed7f343c6512b2faf2172b676ec72e470ff92063741e0a04a29604aee3
Instruction ID: 751f16a0af8128da62e7db3c9bcc28e4ff0baaa9f0ede3369ee2036e6d6e3743
Opcode Fuzzy Hash: c52cb0ed7f343c6512b2faf2172b676ec72e470ff92063741e0a04a29604aee3
Instruction Fuzzy Hash: F20181B5200309BFEB124F69DC49EAA3F6EEF85360F104414FA86C3350DB75DC008A60

Uniqueness

Uniqueness Score: -1.00%

Function 00730FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00730FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00730FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00730FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00730FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00731002

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: c0d5c37e8ee2e9bfba0e9ba87dbd487c5b454c2fe7ad603b557ca32c83a549b6
Instruction ID: 08779c8ab0c7360a32ca40ba0f0f60029bda0de70560245c4b9f817a8ac8b736
Opcode Fuzzy Hash: c0d5c37e8ee2e9bfba0e9ba87dbd487c5b454c2fe7ad603b557ca32c83a549b6
Instruction Fuzzy Hash: 66F06275200305FBD7264FA5DC4DF663B6DEF8A761F508414F986D7251CAB9DC408A60

Uniqueness

Uniqueness Score: -1.00%

Function 00731014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0073102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00731036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00731045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0073104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00731062

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 0f81a31bd8689fa68dc575c3425c8eeb05d34f62aca6fce8d24d84c54243a275
Instruction ID: c09f3ef9309ede120a19be1d42a9c14f587dbe8ba1e0c1e8c06833329bc06974
Opcode Fuzzy Hash: 0f81a31bd8689fa68dc575c3425c8eeb05d34f62aca6fce8d24d84c54243a275
Instruction Fuzzy Hash: 2DF0CD75300305FBEB221FA5EC49F663BADEF8A761F104414FA86D7251CAB9DC408A60

Uniqueness

Uniqueness Score: -1.00%

Function 0074030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,0074017D,?,007432FC,?,00000001,00712592,?), ref: 00740324
CloseHandle.KERNEL32(?,?,?,?,0074017D,?,007432FC,?,00000001,00712592,?), ref: 00740331
CloseHandle.KERNEL32(?,?,?,?,0074017D,?,007432FC,?,00000001,00712592,?), ref: 0074033E
CloseHandle.KERNEL32(?,?,?,?,0074017D,?,007432FC,?,00000001,00712592,?), ref: 0074034B
CloseHandle.KERNEL32(?,?,?,?,0074017D,?,007432FC,?,00000001,00712592,?), ref: 00740358
CloseHandle.KERNEL32(?,?,?,?,0074017D,?,007432FC,?,00000001,00712592,?), ref: 00740365

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: dabc9760f0d1e328b93be0c955742ab23f928549967abec637c6dfb23f06a861
Instruction ID: 3f6611560d59635a3a03326f2c90280cac5449067e5e6fd0d641e1f9ee46be24
Opcode Fuzzy Hash: dabc9760f0d1e328b93be0c955742ab23f928549967abec637c6dfb23f06a861
Instruction Fuzzy Hash: 6001AA72800B159FCB30AF66D890812FBF9BF603153168A3FD29652931C3B5A998CF80

Uniqueness

Uniqueness Score: -1.00%

Function 0070D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0070D752

Part of subcall function 007029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000), ref: 007029DE
Part of subcall function 007029C8: GetLastError.KERNEL32(00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000,00000000), ref: 007029F0

_free.LIBCMT ref: 0070D764
_free.LIBCMT ref: 0070D776
_free.LIBCMT ref: 0070D788
_free.LIBCMT ref: 0070D79A

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 05bd93dfe6b6ff00b926000bcb69be2d69dab3930f38094c9fab66d70934ceeb
Instruction ID: 9dee420b74a19c28a0cf68e3014b8fe77ed44d2d56ce4267b9c84261ee963315
Opcode Fuzzy Hash: 05bd93dfe6b6ff00b926000bcb69be2d69dab3930f38094c9fab66d70934ceeb
Instruction Fuzzy Hash: 85F0FF33554304EBCA22EBA8F9CAC1677DDBB447107A55A06F048E7592C72CFC818AA4

Uniqueness

Uniqueness Score: -1.00%

Function 00735C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00735C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00735C6F
MessageBeep.USER32(00000000), ref: 00735C87
KillTimer.USER32(?,0000040A), ref: 00735CA3
EndDialog.USER32(?,00000001), ref: 00735CBD

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 3bca7a120f5d52a3ae6df656f798748299138bd386e0c405c9b45de5af4e31ca
Instruction ID: 08f66dd3112819e6fa22d479486e00b82cf4d3435c09aad6af2cb92688bce8b1
Opcode Fuzzy Hash: 3bca7a120f5d52a3ae6df656f798748299138bd386e0c405c9b45de5af4e31ca
Instruction Fuzzy Hash: CB018630500B05ABFB225B10DD4EFB677B8BB00B05F04655AF5C3A14E1DBF8A984CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 007022A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 007022BE

Part of subcall function 007029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000), ref: 007029DE
Part of subcall function 007029C8: GetLastError.KERNEL32(00000000,?,0070D7D1,00000000,00000000,00000000,00000000,?,0070D7F8,00000000,00000007,00000000,?,0070DBF5,00000000,00000000), ref: 007029F0

_free.LIBCMT ref: 007022D0
_free.LIBCMT ref: 007022E3
_free.LIBCMT ref: 007022F4
_free.LIBCMT ref: 00702305

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: fcda286688f572c2476941eec2ee46e91bee4a3a2c3b8cdbb08364ee3692b88e
Instruction ID: 538939280bcdae49d0ffc4aac9c2f3564cc9ef2b9bbf295d0578a20915657fd0
Opcode Fuzzy Hash: fcda286688f572c2476941eec2ee46e91bee4a3a2c3b8cdbb08364ee3692b88e
Instruction Fuzzy Hash: A0F01D76520110CFCA12AF54BC099483AA4B75A750B918607F410E22F2C73C58129EEC

Uniqueness

Uniqueness Score: -1.00%

Function 006E95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 006E95D4
StrokeAndFillPath.GDI32(?,?,007271F7,00000000,?,?,?), ref: 006E95F0
SelectObject.GDI32(?,00000000), ref: 006E9603
DeleteObject.GDI32 ref: 006E9616
StrokePath.GDI32(?), ref: 006E9631

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 854d9afc285e5aeb5706be3b855f6f29f0a8b6c6dc84535a4e252d34981f427e
Instruction ID: b5ce68a412ee71cd8e1b9f91f7f512db826cc82eeeb8c7a37272f2fdb649e6c5
Opcode Fuzzy Hash: 854d9afc285e5aeb5706be3b855f6f29f0a8b6c6dc84535a4e252d34981f427e
Instruction Fuzzy Hash: 07F08C30006388EBEB165F26EC1C7B63B62AB82322F40C215F466561F0C7789995CF29

Uniqueness

Uniqueness Score: -1.00%

Function 00700F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 007010F9
__freea.LIBCMT ref: 00701117

Part of subcall function 00701537: _free.LIBCMT ref: 0070154F

Strings

am/pm, xrefs: 0070117A
a/p, xrefs: 007011DE

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 8f9228bec59e0be2e21d2c6cf12a834855b76cb223000d622c16db28d5693851
Instruction ID: f59501ca3bff1eb1902d25173fea9d3145c05ce0c0111ec3d89762ef91c33f08
Opcode Fuzzy Hash: 8f9228bec59e0be2e21d2c6cf12a834855b76cb223000d622c16db28d5693851
Instruction Fuzzy Hash: 28D1E231A00206DADB289F68C895BFAB7F5FF06300FA44359E9419BAD1D77D9D80CB91

Uniqueness

Uniqueness Score: -1.00%

Function 007561D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 006F0242: EnterCriticalSection.KERNEL32(007A070C,007A1884,?,?,006E198B,007A2518,?,?,?,006D12F9,00000000), ref: 006F024D
Part of subcall function 006F0242: LeaveCriticalSection.KERNEL32(007A070C,?,006E198B,007A2518,?,?,?,006D12F9,00000000), ref: 006F028A

Part of subcall function 006F00A3: __onexit.LIBCMT ref: 006F00A9

__Init_thread_footer.LIBCMT ref: 00756238

Part of subcall function 006F01F8: EnterCriticalSection.KERNEL32(007A070C,?,?,006E8747,007A2514), ref: 006F0202
Part of subcall function 006F01F8: LeaveCriticalSection.KERNEL32(007A070C,?,006E8747,007A2514), ref: 006F0235

Part of subcall function 0074359C: LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 007435E4
Part of subcall function 0074359C: LoadStringW.USER32(007A2390,?,00000FFF,?), ref: 0074360A

Strings

x#z, xrefs: 0075633A
x#z, xrefs: 00756353
x#z, xrefs: 0075636F

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CriticalSection$EnterLeaveLoadString$Init_thread_footer__onexit
String ID: x#z$x#z$x#z
API String ID: 1072379062-95117334
Opcode ID: e599d20d3db0da438bbca0e31b3eed9d6651b00e4b9490ef5cf7aaf867ea96f0
Instruction ID: 8b1edf8fdd13303a947bf98e78c5fdfb1ed04b986ba59170ab6b6999fc18f95c
Opcode Fuzzy Hash: e599d20d3db0da438bbca0e31b3eed9d6651b00e4b9490ef5cf7aaf867ea96f0
Instruction Fuzzy Hash: 03C17C71A00209ABDB14DF58C890EFEB7BAFF49310F508069F9059B251DBB9ED59CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00708A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000002,00000000,?,?,?,00000000,?,?,?,?), ref: 00708B6E
GetLastError.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00001000,?), ref: 00708B7A
__dosmaperr.LIBCMT ref: 00708B81

Strings

.o, xrefs: 00708A63

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr
String ID: .o
API String ID: 2434981716-1957372423
Opcode ID: 27bc20ebc43ff8967df9d345e5f475be9bad67234389b4f5184bf7201c28b367
Instruction ID: 4b8cc92f4234fc1a2cf0ba61a188741f996c605d07aa566b67c6004a077d3e88
Opcode Fuzzy Hash: 27bc20ebc43ff8967df9d345e5f475be9bad67234389b4f5184bf7201c28b367
Instruction Fuzzy Hash: AF418CF0604155EFCB659F64C880A7D7FE6DF86304B2887A9F4C587682DE398C028795

Uniqueness

Uniqueness Score: -1.00%

Function 00732716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0073B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,007321D0,?,?,00000034,00000800,?,00000034), ref: 0073B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00732760

Part of subcall function 0073B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,007321FF,?,?,00000800,?,00001073,00000000,?,?), ref: 0073B3F8

Part of subcall function 0073B32A: GetWindowThreadProcessId.USER32(?,?), ref: 0073B355
Part of subcall function 0073B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00732194,00000034,?,?,00001004,00000000,00000000), ref: 0073B365
Part of subcall function 0073B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00732194,00000034,?,?,00001004,00000000,00000000), ref: 0073B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 007327CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0073281A

Strings

@, xrefs: 00732832

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: eac3997c4ef64c4269b5cdeff22c686b0cda9324d02086de95a1065d277f8673
Instruction ID: 0a9c8692b59d17b0ea48739fd9bb4e5d2040e7ad31b27f652f0bceb64923a82b
Opcode Fuzzy Hash: eac3997c4ef64c4269b5cdeff22c686b0cda9324d02086de95a1065d277f8673
Instruction Fuzzy Hash: 19412E76901218BFEB10DFA4CD45AEEBBB8EF09700F104099FA55B7182DB746E45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0070172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe,00000104), ref: 00701769
_free.LIBCMT ref: 00701834
_free.LIBCMT ref: 0070183E

Strings

C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe, xrefs: 00701760, 00701767, 00701796, 007017CE

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe
API String ID: 2506810119-1276354553
Opcode ID: 8f219d75a4ff58c022a9be24b0c004762cd65d40b0b89a7f3044198a0faba532
Instruction ID: 6a91dd4f0997c32a4051d17be47ffe5fb5802b1ed42516ec18b0040fd737edcd
Opcode Fuzzy Hash: 8f219d75a4ff58c022a9be24b0c004762cd65d40b0b89a7f3044198a0faba532
Instruction Fuzzy Hash: 93318F75A00218EFDB21DF999885D9EBBFCEB85320F948266F50497291D6B88E40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0073C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 0073C306
DeleteMenu.USER32(?,00000007,00000000), ref: 0073C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,007A1990,015C6BC0), ref: 0073C395

Strings

0, xrefs: 0073C2DF

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 0aed95ff483f9672e61020b49c67e7d57b4b147433279959c10424b1bdf85d69
Instruction ID: 52404b56cc1800c8b4f3a20fb988fd5bce5d133b8ad8112c27d4d6a937269518
Opcode Fuzzy Hash: 0aed95ff483f9672e61020b49c67e7d57b4b147433279959c10424b1bdf85d69
Instruction Fuzzy Hash: 6A41B1312043019FE721DF24D885B2ABBE4AF85310F10861DF9A6A72D2D778E904CB63

Uniqueness

Uniqueness Score: -1.00%

Function 00764416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0076CC08,00000000,?,?,?,?), ref: 007644AA
GetWindowLongW.USER32 ref: 007644C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 007644D7

Strings

SysTreeView32, xrefs: 0076447C

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 7708319bc41d90098ebf21d0d9d63f8a695fc6c4473551456fb7d89b8a62e06e
Instruction ID: bbcbfaec3b4b626f7807ba028c04e00a1d52810532d0e072372c81a13214ff0f
Opcode Fuzzy Hash: 7708319bc41d90098ebf21d0d9d63f8a695fc6c4473551456fb7d89b8a62e06e
Instruction Fuzzy Hash: 5231B031210245AFDF218E38DC46BEA7BA9EB09334F204319FD76A21D1DB78EC609B54

Uniqueness

Uniqueness Score: -1.00%

Function 00736E71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

SysReAllocString.OLEAUT32(?,?), ref: 00736EED
VariantCopyInd.OLEAUT32(?,?), ref: 00736F08
VariantClear.OLEAUT32(?), ref: 00736F12

Strings

*js, xrefs: 00736E8B, 00736E90, 00736EF8

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Variant$AllocClearCopyString
String ID: *js
API String ID: 2173805711-2626009487
Opcode ID: 0d75b4065e026734700bb5360326a6fc620bdca79412f94b3b0d024d0dbca17e
Instruction ID: 48b268d46495c9335c4d7145dbfba7f0ec4550f085271a6b035fd0b0a9ba48e8
Opcode Fuzzy Hash: 0d75b4065e026734700bb5360326a6fc620bdca79412f94b3b0d024d0dbca17e
Instruction Fuzzy Hash: AE31D371A04246EFDB05AF64E8509BD3776FF40700F108499F8065B3A2CB389911DBD8

Uniqueness

Uniqueness Score: -1.00%

Function 0075304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0075335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00753077,?,?), ref: 00753378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0075307A
_wcslen.LIBCMT ref: 0075309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00753106

Strings

255.255.255.255, xrefs: 00753095, 0075309A

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: cfd413a5f80bfbf8e6e48fe0957819c9fc4c5206f30d1741d1fc8c6a4cbcaa3b
Instruction ID: 8bae0f3703246e86e44192611dcd425c063d6304dd19da8dd8a0a0903365b90a
Opcode Fuzzy Hash: cfd413a5f80bfbf8e6e48fe0957819c9fc4c5206f30d1741d1fc8c6a4cbcaa3b
Instruction Fuzzy Hash: 5231D2356007099FCB20CF28C485EAA77E1EF14395F248059EC198B3A2DBBADE49C760

Uniqueness

Uniqueness Score: -1.00%

Function 00764653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00764705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00764713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0076471A

Strings

msctls_updown32, xrefs: 00764684

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: d10cfbd617b68d94fc6a4d53ba685a82c9c26ccafe010753bbbc337ba23c418a
Instruction ID: 40424fa5bee75a807e35ada9b944006c78102cbdb22b627ac0217f90d27794e9
Opcode Fuzzy Hash: d10cfbd617b68d94fc6a4d53ba685a82c9c26ccafe010753bbbc337ba23c418a
Instruction Fuzzy Hash: 35216DB5600209AFEB11DF68DCD1DB737ADEF9A3A4B044059FA019B3A1CB74EC51CA64

Uniqueness

Uniqueness Score: -1.00%

Function 007395AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0073961D

Strings

#OnAutoItStartRegister, xrefs: 007395F3
#requireadmin, xrefs: 007395D9
#notrayicon, xrefs: 007395B7

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: 458baf49792f4e40c3bb1b0b3af463a518df9fbc4286d66df2102fe7904b3fdb
Instruction ID: bacd86d3e858ff6217c0d82db2bb9a88c992e1bca43e5efbfd00c3a4e5fc0e14
Opcode Fuzzy Hash: 458baf49792f4e40c3bb1b0b3af463a518df9fbc4286d66df2102fe7904b3fdb
Instruction Fuzzy Hash: 1A215BB2205610A6E331AB249C03FB773D99F51300F50402AFB4A97183FBD9AD95C2E9

Uniqueness

Uniqueness Score: -1.00%

Function 007637B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00763840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00763850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00763876

Strings

Listbox, xrefs: 0076380F

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: b004571a43074dd32b4e269973127eea57797e16da87a1466730505667b9d28c
Instruction ID: fe75e9871b3483d1eb68118384b131939731943502bf08d5ebff0116ac817b3f
Opcode Fuzzy Hash: b004571a43074dd32b4e269973127eea57797e16da87a1466730505667b9d28c
Instruction Fuzzy Hash: 2421BE72610219BBEF218F54DC85EBB376AEF89760F108124F9069B190C6B9DC52CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 007449F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00744A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00744A5C
SetErrorMode.KERNEL32(00000000,?,?,0076CC08), ref: 00744AD0

Strings

%lu, xrefs: 00744A6F

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 88736f01990f067338aa17dcad6507fa95d52dec8dbb1bdd453ad98407896521
Instruction ID: 1d7f42c9a69ce4f66b0bef81adf5ff38ef5defd6926affee26270bb8a5724b4b
Opcode Fuzzy Hash: 88736f01990f067338aa17dcad6507fa95d52dec8dbb1bdd453ad98407896521
Instruction Fuzzy Hash: 80318571A00208AFDB51DF54C885EAA77F9EF05304F148099F905DB352DB75ED45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 007641EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0076424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00764264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00764271

Strings

msctls_trackbar32, xrefs: 00764226

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 9fe7f0ae9ccfb68a6981fc619dc13063b80447185b742a9ec04703c2eb000e94
Instruction ID: 7bbe609f8ab5cf53e598c2bb5e16c284671f850ee0946b5a394f54dbaeea9766
Opcode Fuzzy Hash: 9fe7f0ae9ccfb68a6981fc619dc13063b80447185b742a9ec04703c2eb000e94
Instruction Fuzzy Hash: 1F110631240208BEEF205F29CC46FAB3BACFF85B64F110114FE56E2090D2B5DC519B14

Uniqueness

Uniqueness Score: -1.00%

Function 00732F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006D6B57: _wcslen.LIBCMT ref: 006D6B6A

Part of subcall function 00732DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00732DC5
Part of subcall function 00732DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00732DD6
Part of subcall function 00732DA7: GetCurrentThreadId.KERNEL32 ref: 00732DDD
Part of subcall function 00732DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00732DE4

GetFocus.USER32 ref: 00732F78

Part of subcall function 00732DEE: GetParent.USER32(00000000), ref: 00732DF9

GetClassNameW.USER32(?,?,00000100), ref: 00732FC3
EnumChildWindows.USER32(?,0073303B), ref: 00732FEB

Strings

%s%d, xrefs: 00732FFF

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: e0d4445714e65765eae1686e579efbb935125b4d1a08040e2304c7c25f187dfe
Instruction ID: 887d09f186c8bce824e969f4d3c776e8500d7e885fe8050e7939366c038ca45e
Opcode Fuzzy Hash: e0d4445714e65765eae1686e579efbb935125b4d1a08040e2304c7c25f187dfe
Instruction Fuzzy Hash: AD11A271700205ABEF557F60CC89EFD376AAF84304F04807AF9099B253DE7999468B74

Uniqueness

Uniqueness Score: -1.00%

Function 00765882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 007658C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 007658EE
DrawMenuBar.USER32(?), ref: 007658FD

Strings

0, xrefs: 0076588F

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 9628610c3a24bb72dc700e5a10fe55dccdf5a66ae2ea6d5947f543f48661a880
Instruction ID: bb8d798c7b42eb1189047f17ec5f305e0f0b15b759f413a5ea120edbeda8dd64
Opcode Fuzzy Hash: 9628610c3a24bb72dc700e5a10fe55dccdf5a66ae2ea6d5947f543f48661a880
Instruction Fuzzy Hash: 02018B31500348EFDB219F11DC44BAEBBB5FB45360F108099E88AD6151DB74AA94EF24

Uniqueness

Uniqueness Score: -1.00%

Function 0073007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8253753b864a3daf44eb555188ef87f633ac7682bed257e6c910e5f3f7479465
Instruction ID: cdca53d831ec80b7a9a20f072e284b40d4f6bed1f333797430e0f4dfafa3a108
Opcode Fuzzy Hash: 8253753b864a3daf44eb555188ef87f633ac7682bed257e6c910e5f3f7479465
Instruction Fuzzy Hash: 93C17C75A0020AEFEB14CFA4C8A8EAEB7B5FF48714F108598E505EB252D735ED41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0075342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00753459
CoUninitialize.OLE32 ref: 00753463
VariantInit.OLEAUT32(?), ref: 0075346E
VariantClear.OLEAUT32(?), ref: 0075371B

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: 3c797e3134306c09a8fe332146ff964e4a4719a0df5244d677baa0b12027594a
Instruction ID: ab110ab4ba726a20137004dbefb56dde8aaae6da419b3913df00796c443cd1d3
Opcode Fuzzy Hash: 3c797e3134306c09a8fe332146ff964e4a4719a0df5244d677baa0b12027594a
Instruction Fuzzy Hash: 32A156756042009FC700DF28C485A6AB7E6EF88351F04895DFD8A9B362EB74EE05CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00730436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,0076FC08,?), ref: 007305F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,0076FC08,?), ref: 00730608
CLSIDFromProgID.OLE32(?,?,00000000,0076CC40,000000FF,?,00000000,00000800,00000000,?,0076FC08,?), ref: 0073062D
_memcmp.LIBVCRUNTIME ref: 0073064E

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 51b789e23a84144422b5f9bab7c606f772b1a5cbeae1182c56737177ce12baba
Instruction ID: 14643ad8cec9f014846410a42d0494bb1c4970297969af7c41aacff3403e02b6
Opcode Fuzzy Hash: 51b789e23a84144422b5f9bab7c606f772b1a5cbeae1182c56737177ce12baba
Instruction Fuzzy Hash: 7B815C71A00109EFDB04DF94C994EEEB7B9FF89315F204198F506AB251DB75AE06CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00711391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 007114C0

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ac7449862de37793cccf28df96c29ee6b0aad95c3aecc1afc115ba5fd4e0f20b
Instruction ID: 9ded31d98f96b9f742e07b3129599e4eab34caeb44a677261bc3a00c9c359610
Opcode Fuzzy Hash: ac7449862de37793cccf28df96c29ee6b0aad95c3aecc1afc115ba5fd4e0f20b
Instruction Fuzzy Hash: 56415C31600144EBDB216BFC8C4AAFE3AE6EF41770F544225FF19DA1D2E63C89819762

Uniqueness

Uniqueness Score: -1.00%

Function 00766278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(015D07A8,?), ref: 007662E2
ScreenToClient.USER32(?,?), ref: 00766315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00766382

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: f6bf5943e4a54002916e905dc0ee04c00ab54ede5f30f7929b8415f10dcb7526
Instruction ID: 64facde40cee0d18254da372a64f90f244da86788e41b0d8d4ce4715fa12eab9
Opcode Fuzzy Hash: f6bf5943e4a54002916e905dc0ee04c00ab54ede5f30f7929b8415f10dcb7526
Instruction Fuzzy Hash: 6D513A74A00249EFDF10DF69D8809AE7BB6FF85360F50815AF9169B290D734ED81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00751AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00751AFD
WSAGetLastError.WSOCK32 ref: 00751B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00751B8A
WSAGetLastError.WSOCK32 ref: 00751B94

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 06044fb20646011e0848ede7b7c3d8aa8eec689f2672c9a4f63f733b90acee7c
Instruction ID: 974422cc96980774a948dfe48d44aac70c5fddf3f9d891e5f38b70e175fb0813
Opcode Fuzzy Hash: 06044fb20646011e0848ede7b7c3d8aa8eec689f2672c9a4f63f733b90acee7c
Instruction Fuzzy Hash: 8A41B074600300AFE720AF24C886F6977E6AB44719F94844CF95A9F3D2D7B6DD41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0070B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a75bd3f182b5957677229351e99e0d151c9eae01ddabc56e3d296ac9727fda2b
Instruction ID: 17a4a0bf45e9cb12e9dbdb3e74fc3dfbb8614981e19d07e14129025cefb7a297
Opcode Fuzzy Hash: a75bd3f182b5957677229351e99e0d151c9eae01ddabc56e3d296ac9727fda2b
Instruction Fuzzy Hash: 3241E672A00344EFD7249F78CC45BAABBE9EF88710F10466AF145DB2C2D779AB418780

Uniqueness

Uniqueness Score: -1.00%

Function 007456D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00745783
GetLastError.KERNEL32(?,00000000), ref: 007457A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 007457CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 007457FA

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: e4db08bf0b2bc42a7938af6c4ff62fc4d237c67751838d6469f675acbbfd2f1d
Instruction ID: 19d179772c79151587568ab2db40ac119efc8d2c874f9c7610a2558297df6b0c
Opcode Fuzzy Hash: e4db08bf0b2bc42a7938af6c4ff62fc4d237c67751838d6469f675acbbfd2f1d
Instruction Fuzzy Hash: 1F413B39600611DFCB11EF15C444A5EBBE2EF89720B19C489EC4AAB362DB34FD00CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0070D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,006F6D71,00000000,00000000,006F82D9,?,006F82D9,?,00000001,006F6D71,?,00000001,006F82D9,006F82D9), ref: 0070D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0070D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0070D9AB
__freea.LIBCMT ref: 0070D9B4

Part of subcall function 00703820: RtlAllocateHeap.NTDLL(00000000,?,007A1444,?,006EFDF5,?,?,006DA976,00000010,007A1440,006D13FC,?,006D13C6,?,006D1129), ref: 00703852

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: b476851f3a4df5968cb5d86068522fa21d12f590d995bad01b374c44a84a9b51
Instruction ID: c1b40e17bcf029e3c4a033e22c42b00e08f0d2232240b6c3c6f0f950d9e275fc
Opcode Fuzzy Hash: b476851f3a4df5968cb5d86068522fa21d12f590d995bad01b374c44a84a9b51
Instruction Fuzzy Hash: 9931AB72A1020AEBDF25DFA5DC45EAE7BE5EB41310B054268FC05D6291EB39ED50CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 007652C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00765352
GetWindowLongW.USER32(?,000000F0), ref: 00765375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00765382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 007653A8

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: c830634590ab639b2e6a12a51eafe71ae96d4850040d1802024a1102fca038ce
Instruction ID: 74a88d587b45ce700f330a99fcbc8322841d25d23700ca04147ccd12ebafb0dd
Opcode Fuzzy Hash: c830634590ab639b2e6a12a51eafe71ae96d4850040d1802024a1102fca038ce
Instruction Fuzzy Hash: ED31D234A55A08EFEB309E16CC05BE93761AB05B98F584102FE13963E1C7BC9D40FB45

Uniqueness

Uniqueness Score: -1.00%

Function 0073AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,7694C0D0,?,00008000), ref: 0073ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 0073AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 0073AC74
SendInput.USER32(00000001,?,0000001C,7694C0D0,?,00008000), ref: 0073ACC6

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: b12347610f4bfd827f86380e5de31e703913f6a021e043e15321e306ae1e54c6
Instruction ID: 4b7b3b1ac9315c5ddcbe1a6d3e6fb4fa1a44309f0cfef13c5712f65b20f4a8fd
Opcode Fuzzy Hash: b12347610f4bfd827f86380e5de31e703913f6a021e043e15321e306ae1e54c6
Instruction Fuzzy Hash: EF311631A44318BFFB258B65CC0A7FABBA5AB45310F08621AE4C1521D2C37D8D818776

Uniqueness

Uniqueness Score: -1.00%

Function 00767674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0076769A
GetWindowRect.USER32(?,?), ref: 00767710
PtInRect.USER32(?,?,00768B89), ref: 00767720
MessageBeep.USER32(00000000), ref: 0076778C

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: a71a00106a43d1d5bf74f2ca9466bbef521f587560e85d651f8a231fb5b32f29
Instruction ID: a162db6af1d08b6b5ce15c8300c3bf2b3e68ffba855fc64720179607831c32cf
Opcode Fuzzy Hash: a71a00106a43d1d5bf74f2ca9466bbef521f587560e85d651f8a231fb5b32f29
Instruction Fuzzy Hash: A441BF34605254DFDB09CF58C894EA977F4FF49398F5580A8E8169B261D738E941CF90

Uniqueness

Uniqueness Score: -1.00%

Function 007616DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 007616EB

Part of subcall function 00733A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00733A57
Part of subcall function 00733A3D: GetCurrentThreadId.KERNEL32 ref: 00733A5E
Part of subcall function 00733A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,007325B3), ref: 00733A65

GetCaretPos.USER32(?), ref: 007616FF
ClientToScreen.USER32(00000000,?), ref: 0076174C
GetForegroundWindow.USER32 ref: 00761752

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 3708eba034757c44ff94988e3667f076601aa2e5a7953d5bec0c509cc885c0c4
Instruction ID: daa5d4ddb4cd0e98bb9d438c3849bb0efcdea4d948975f3828bb52b710f76e9b
Opcode Fuzzy Hash: 3708eba034757c44ff94988e3667f076601aa2e5a7953d5bec0c509cc885c0c4
Instruction Fuzzy Hash: 50314371D00249AFD700DFA9C885CAEBBF9EF48314B5480AAE456E7312D7359E45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0073D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0073D501
Process32FirstW.KERNEL32(00000000,?), ref: 0073D50F
Process32NextW.KERNEL32(00000000,?), ref: 0073D52F
CloseHandle.KERNEL32(00000000), ref: 0073D5DC

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 43102ead6edb843ac6589a8d48497081928a2c77253a653b4f6baefeb229450a
Instruction ID: a6705e946702535b3b589dc34347f29cdf0d0865955024380f33c3964bd5147c
Opcode Fuzzy Hash: 43102ead6edb843ac6589a8d48497081928a2c77253a653b4f6baefeb229450a
Instruction Fuzzy Hash: BF31E4721083009FD315EF50D881ABFBBF8EF99344F04082DF582872A2EB719944CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00768FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006E9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 006E9BB2

GetCursorPos.USER32(?), ref: 00769001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00727711,?,?,?,?,?), ref: 00769016
GetCursorPos.USER32(?), ref: 0076905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00727711,?,?,?), ref: 00769094

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 89452f109dace545edf0aaaf14b86acc4c653e3f025a7b6f1fbeb5b78be43775
Instruction ID: 42322d9f4060f75f7cb753a9703aad57fee122301175975b43085c22a8a33ad6
Opcode Fuzzy Hash: 89452f109dace545edf0aaaf14b86acc4c653e3f025a7b6f1fbeb5b78be43775
Instruction Fuzzy Hash: 0221A135601118EFDF268F94CC58EFA7BB9EF8A360F148069FA0647261C379AD50DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0073D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0076CB68), ref: 0073D2FB
GetLastError.KERNEL32 ref: 0073D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 0073D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0076CB68), ref: 0073D376

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 225abcbbdc2030aa6ddf257f7428573f7ff43848e0b58b3e25f34a44932552f1
Instruction ID: 878eefa10e6a3ecdeadd05a7361d48b38d0ccacd56b901c7cf7f31ca1995fcde
Opcode Fuzzy Hash: 225abcbbdc2030aa6ddf257f7428573f7ff43848e0b58b3e25f34a44932552f1
Instruction Fuzzy Hash: 7D21A370509301DF9320DF24E88186A77E4FE56724F104A1EF499C32A2D735DD49CB97

Uniqueness

Uniqueness Score: -1.00%

Function 00731571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00731014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0073102A
Part of subcall function 00731014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00731036
Part of subcall function 00731014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00731045
Part of subcall function 00731014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0073104C
Part of subcall function 00731014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00731062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 007315BE
_memcmp.LIBVCRUNTIME ref: 007315E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00731617
HeapFree.KERNEL32(00000000), ref: 0073161E

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: e39eb74af27895508a79b03d8b62a272bf241ba2e86824a1694ca0fc9aca2741
Instruction ID: b04a88705c8f971b707be0a36532bd669d936042aafd38777e25c0660ca693b4
Opcode Fuzzy Hash: e39eb74af27895508a79b03d8b62a272bf241ba2e86824a1694ca0fc9aca2741
Instruction Fuzzy Hash: A421A171E00209EFEF04DFA5C945BEEB7B8EF44344F498459E441AB242EB78AE05CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00762782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 0076280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00762824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00762832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00762840

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 56c906802462b6fc6c0a39bab4936461358fe5584d4644612c3152981bad7d65
Instruction ID: 512d26a49b99b3d5c2c09ffc3dcf6a11aaee83edc54614cd0a3f339f6907a3eb
Opcode Fuzzy Hash: 56c906802462b6fc6c0a39bab4936461358fe5584d4644612c3152981bad7d65
Instruction Fuzzy Hash: 8D21F131204A12AFD7549B24CC44FAA7B95AF85324F248159F8278B6E3CBB9FC42C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 007378F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00738D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,0073790A,?,000000FF,?,00738754,00000000,?,0000001C,?,?), ref: 00738D8C
Part of subcall function 00738D7D: lstrcpyW.KERNEL32(00000000,?), ref: 00738DB2
Part of subcall function 00738D7D: lstrcmpiW.KERNEL32(00000000,?,0073790A,?,000000FF,?,00738754,00000000,?,0000001C,?,?), ref: 00738DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00738754,00000000,?,0000001C,?,?,00000000), ref: 00737923
lstrcpyW.KERNEL32(00000000,?), ref: 00737949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00738754,00000000,?,0000001C,?,?,00000000), ref: 00737984

Strings

cdecl, xrefs: 0073797B

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 70ce809d8ea501be28673684260441b6c67b2b1414118449a347409a9ab1f7d3
Instruction ID: 14a86e7195db0197063286ea3d7b59390e413b2559c596c719f51e4e03714405
Opcode Fuzzy Hash: 70ce809d8ea501be28673684260441b6c67b2b1414118449a347409a9ab1f7d3
Instruction Fuzzy Hash: 8011297A200341ABDB295F35D844E7A77A9FF45350F00812AF842C7265EF79E801C755

Uniqueness

Uniqueness Score: -1.00%

Function 00767CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00767D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00767D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00767D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0074B7AD,00000000), ref: 00767D6B

Part of subcall function 006E9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 006E9BB2

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: ac9b4bd899e38768e1691f57cd78cf1cbb4e28e4d743d6ba9ec7fe543e57dd47
Instruction ID: 261c1e267edd317134de87e0b99674c1aa77635d2860fc5a22cfe87e1a4bc467
Opcode Fuzzy Hash: ac9b4bd899e38768e1691f57cd78cf1cbb4e28e4d743d6ba9ec7fe543e57dd47
Instruction Fuzzy Hash: B811D231204654AFDB149F28CC04A7A3BA5AF863A4F218B24FC37CB2F0E7389950DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00765660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 007656BB
_wcslen.LIBCMT ref: 007656CD
_wcslen.LIBCMT ref: 007656D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00765816

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: 5e22cd5e624771397ea6e71fd5f6cc09b6199d8e32833313fc1122a338951d44
Instruction ID: 153c91954f252fac200f35e40e8631235ed6b0233978e00d847452b50e385052
Opcode Fuzzy Hash: 5e22cd5e624771397ea6e71fd5f6cc09b6199d8e32833313fc1122a338951d44
Instruction Fuzzy Hash: 5211E17160060996DB209F61CC85AFE3BACAF01764F10806AFD17D6081EBB89A84DB64

Uniqueness

Uniqueness Score: -1.00%

Function 00701D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cc2edf4f7271ff5e7bb50742b493c83394c855627dc66169b62980443ade911
Instruction ID: d88cb72d209d3ef0a21ec0470585e83705fb429ebd4da045ff2e255131fe7694
Opcode Fuzzy Hash: 0cc2edf4f7271ff5e7bb50742b493c83394c855627dc66169b62980443ade911
Instruction Fuzzy Hash: 8E01D1F230961AFEF62166B86CC4F27669CEF823B8F750325F521A11D2EB689C005270

Uniqueness

Uniqueness Score: -1.00%

Function 00731A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00731A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00731A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00731A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00731A8A

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 0db5bc7ef365c4fad75e4cb9fd8c47b971479fc893a3b5432b5674b07656fa5d
Instruction ID: d050dc0bcc666ff71ba6bbf5a2e7fcef58be7df571c5bca149093995f2db31e4
Opcode Fuzzy Hash: 0db5bc7ef365c4fad75e4cb9fd8c47b971479fc893a3b5432b5674b07656fa5d
Instruction Fuzzy Hash: 4E11393AD01219FFEB11DBA4CD85FADBB78EB08750F204091EA00B7290D6716E50DB94

Uniqueness

Uniqueness Score: -1.00%

Function 0073E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0073E1FD
MessageBoxW.USER32(?,?,?,?), ref: 0073E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0073E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0073E24D

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 3cdd76d3918cf4967e0559cc67001307065ecfb3bfe60055ff384b841d1ed345
Instruction ID: 19fcc23b3707f97169b35283579863d0f19f3a942641416533e8f0b128019990
Opcode Fuzzy Hash: 3cdd76d3918cf4967e0559cc67001307065ecfb3bfe60055ff384b841d1ed345
Instruction Fuzzy Hash: 78112BB2904358BBEB019FA89C05AAF7FADAB86310F008215F915E32D1D2B8DD0087A4

Uniqueness

Uniqueness Score: -1.00%

Function 006FD1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,006FCFF9,00000000,00000004,00000000), ref: 006FD218
GetLastError.KERNEL32 ref: 006FD224
__dosmaperr.LIBCMT ref: 006FD22B
ResumeThread.KERNEL32(00000000), ref: 006FD249

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 18c29ec41e2b1c2b9558a353b4b7d650681d0864a2681444ed1ce36b993396d3
Instruction ID: 89abd207151a9ce25d1bdd8af35620376d0c5e7fa719c8a31b5a77eac05ba926
Opcode Fuzzy Hash: 18c29ec41e2b1c2b9558a353b4b7d650681d0864a2681444ed1ce36b993396d3
Instruction Fuzzy Hash: 4501D63640520CBBDB125BA5DC09BBE7A6BEF82331F104219FB25922D0CB719A01C6E1

Uniqueness

Uniqueness Score: -1.00%

Function 006D600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 006D604C
GetStockObject.GDI32(00000011), ref: 006D6060
SendMessageW.USER32(00000000,00000030,00000000), ref: 006D606A

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 2691cad14fcc98602785e7ca5b2b84be93d426f270ea6095a6835f482d173d9e
Instruction ID: 311bf313fd1fbb70a29bc3158dc5b6c022eb23ce523022bc88addb69fbcd9bf0
Opcode Fuzzy Hash: 2691cad14fcc98602785e7ca5b2b84be93d426f270ea6095a6835f482d173d9e
Instruction Fuzzy Hash: CE11C472901608BFEF125F94CD44EFA7B6AFF09354F004102FA1552210C776DC60DB90

Uniqueness

Uniqueness Score: -1.00%

Function 006F3B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 006F3B56

Part of subcall function 006F3AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 006F3AD2
Part of subcall function 006F3AA3: ___AdjustPointer.LIBCMT ref: 006F3AED

_UnwindNestedFrames.LIBCMT ref: 006F3B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 006F3B7C
CallCatchBlock.LIBVCRUNTIME ref: 006F3BA4

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 1f596bf0503ba011754e39673dc30443a8c496877176a61627e2c481316bb0f5
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: EF01293210014DBBDF125E95CC42EFB3B6AEF99754F044019FF5866221CB32E961DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00703073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,006D13C6,00000000,00000000,?,0070301A,006D13C6,00000000,00000000,00000000,?,0070328B,00000006,FlsSetValue), ref: 007030A5
GetLastError.KERNEL32(?,0070301A,006D13C6,00000000,00000000,00000000,?,0070328B,00000006,FlsSetValue,00772290,FlsSetValue,00000000,00000364,?,00702E46), ref: 007030B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0070301A,006D13C6,00000000,00000000,00000000,?,0070328B,00000006,FlsSetValue,00772290,FlsSetValue,00000000), ref: 007030BF

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: aad9eb118b77bf40716785dee58b8cb55596121608d2526cf6530c027459d107
Instruction ID: 2b42031dc542b7c6846ea2d4c28435796d8e55af83550e18ab474f641d35d76e
Opcode Fuzzy Hash: aad9eb118b77bf40716785dee58b8cb55596121608d2526cf6530c027459d107
Instruction Fuzzy Hash: 8B01F732312326EBCB324B799C459677BDEAF45BA1B108720F94AE31C0D729D901C6E4

Uniqueness

Uniqueness Score: -1.00%

Function 00737464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 0073747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00737497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 007374AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 007374CA

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: c1934e0217c948e4999e4b9768f26eec37a66062bb1d9a9e2959997a72cdaae6
Instruction ID: 0df0b1a4cbc62c3d0eaf68b4a8e7a94822fa9f27aa2c58e5d4e4e60e8b35620c
Opcode Fuzzy Hash: c1934e0217c948e4999e4b9768f26eec37a66062bb1d9a9e2959997a72cdaae6
Instruction Fuzzy Hash: 8D117CF12053949BF7348F54EC08BA27FF8EB00B10F108569A656D6552D7B8F904DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0073B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0073ACD3,?,00008000), ref: 0073B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0073ACD3,?,00008000), ref: 0073B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0073ACD3,?,00008000), ref: 0073B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0073ACD3,?,00008000), ref: 0073B126

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 3d15ceefd3109e122ef3687befabfb1fe61d184c39182a819dba6e2a2adf8496
Instruction ID: 2f319ecfdd969ad27f082ba8a7f9ea8a07068a593a9cf16dd9c20f6db508d642
Opcode Fuzzy Hash: 3d15ceefd3109e122ef3687befabfb1fe61d184c39182a819dba6e2a2adf8496
Instruction Fuzzy Hash: BC116171C0161CD7DF04AFE4D9596FEBB78FF0A711F108089DA81B6146CB7895508B55

Uniqueness

Uniqueness Score: -1.00%

Function 00732DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00732DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00732DD6
GetCurrentThreadId.KERNEL32 ref: 00732DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00732DE4

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: b993afd267a88bedeba8cca67a3d790eca0ed482edef7e4405f90724afe940d8
Instruction ID: b45706a92af35b061271b0568ed4a8dac37550603f0354d57cce51ab442cff39
Opcode Fuzzy Hash: b993afd267a88bedeba8cca67a3d790eca0ed482edef7e4405f90724afe940d8
Instruction Fuzzy Hash: DAE06D722013247AEB212B62DC0EEFB7E6CEF42BA1F004015F107D10829AE98841C6B5

Uniqueness

Uniqueness Score: -1.00%

Function 00768863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 006E9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 006E9693
Part of subcall function 006E9639: SelectObject.GDI32(?,00000000), ref: 006E96A2
Part of subcall function 006E9639: BeginPath.GDI32(?), ref: 006E96B9
Part of subcall function 006E9639: SelectObject.GDI32(?,00000000), ref: 006E96E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00768887
LineTo.GDI32(?,?,?), ref: 00768894
EndPath.GDI32(?), ref: 007688A4
StrokePath.GDI32(?), ref: 007688B2

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 959e9c5038c6a7227cecffa0efc5bc3393c7c477a74b4fd4e36d47a36259dd4b
Instruction ID: 2cc1c18390d1a5f86a6780f14cf707a2d8e2c9bd0bd4d9128a5efd4c13719e00
Opcode Fuzzy Hash: 959e9c5038c6a7227cecffa0efc5bc3393c7c477a74b4fd4e36d47a36259dd4b
Instruction Fuzzy Hash: D6F03A36041259BAEB136F94AC09FDA3F59AF4A310F44C100FA52651E1C7B95511CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 006E98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 006E98CC
SetTextColor.GDI32(?,?), ref: 006E98D6
SetBkMode.GDI32(?,00000001), ref: 006E98E9
GetStockObject.GDI32(00000005), ref: 006E98F1

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: ffa1bd225921eef9bd2fc7271c5113f43289d53a282c626531e10fc8aaf937f0
Instruction ID: bf5f8d2a2da00ac26fa1ac98fa342632d882705ae41aa398280c76ccfd119ccd
Opcode Fuzzy Hash: ffa1bd225921eef9bd2fc7271c5113f43289d53a282c626531e10fc8aaf937f0
Instruction Fuzzy Hash: 01E06531244384AADB225B75FC09BE93F11AB12335F14C219F6FB540E1C3B94650DB11

Uniqueness

Uniqueness Score: -1.00%

Function 0073162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00731634
OpenThreadToken.ADVAPI32(00000000,?,?,?,007311D9), ref: 0073163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,007311D9), ref: 00731648
OpenProcessToken.ADVAPI32(00000000,?,?,?,007311D9), ref: 0073164F

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: e06761637a89cdd6dae6d644487237d8eedb1ed8b055ec0b8170b1c2b4863934
Instruction ID: b47e7c0917eca463b06563f46de632ec65e75d4311e549d7f9321fe0fb387975
Opcode Fuzzy Hash: e06761637a89cdd6dae6d644487237d8eedb1ed8b055ec0b8170b1c2b4863934
Instruction Fuzzy Hash: EEE08671601311EBE7201FE19E0DB663B7CAF44791F14C808F686D9080DABC4440C758

Uniqueness

Uniqueness Score: -1.00%

Function 0072D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0072D858
GetDC.USER32(00000000), ref: 0072D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0072D882
ReleaseDC.USER32(?), ref: 0072D8A3

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 46fd10555ce78d5e5ca6f0be6f1f1b253eb038102eda950e347686c8d331e0d1
Instruction ID: a1e015248ba213f0ff686f7f09f9ad729269b6c2fb46886580e93bc2a68491f4
Opcode Fuzzy Hash: 46fd10555ce78d5e5ca6f0be6f1f1b253eb038102eda950e347686c8d331e0d1
Instruction Fuzzy Hash: F3E01AB5800305DFCB429FA0D808A7DBBB2FB08310F14D009E88BE7250C7BC9941AF48

Uniqueness

Uniqueness Score: -1.00%

Function 0072D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0072D86C
GetDC.USER32(00000000), ref: 0072D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0072D882
ReleaseDC.USER32(?), ref: 0072D8A3

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 8c30af589b94cf18ec6c2596215f439f906e7d8749e10eccf5c2566d2759a9b5
Instruction ID: b9fbc5aad1b9bdf5ef9f001c47bd890f516d206e9e9ccb70df9fd0237e653fe8
Opcode Fuzzy Hash: 8c30af589b94cf18ec6c2596215f439f906e7d8749e10eccf5c2566d2759a9b5
Instruction Fuzzy Hash: 02E01A70C00304DFCB429FA0D80866DBBB2FB08310B149009E98AE7250C7BC59019F48

Uniqueness

Uniqueness Score: -1.00%

Function 00744D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 006D7620: _wcslen.LIBCMT ref: 006D7625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00744ED4

Strings

LPT, xrefs: 00744DFB
*, xrefs: 00744E10

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: a0259067a6e9edf8d1c7586cb12e727afa582bb906799311179c97b3c833ea3e
Instruction ID: ee6ea3af779c17143d1bd9e330c6f207bb9ee584a19bd1a47bffd699da79edb8
Opcode Fuzzy Hash: a0259067a6e9edf8d1c7586cb12e727afa582bb906799311179c97b3c833ea3e
Instruction Fuzzy Hash: 94914D75A002549FDB14DF58C484FAABBF1BF44304F198099E80A9F3A2D739EE85DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00757771 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(0072569E,00000000,?,0076CC08,?,00000000,00000000), ref: 007578DD

Part of subcall function 006D6B57: _wcslen.LIBCMT ref: 006D6B6A

CharUpperBuffW.USER32(0072569E,00000000,?,0076CC08,00000000,?,00000000,00000000), ref: 0075783B

Strings

<sy, xrefs: 007577C8

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: BuffCharUpper$_wcslen
String ID: <sy
API String ID: 3544283678-4294649419
Opcode ID: b719c47ea3b9386918f3f92e2ac2931e12ac817a08806469225c697afd9b9f7b
Instruction ID: 9ffc1710135f06a075a9cf6980cd7a11bb6445158324f7e8b8c3132c5d0309ba
Opcode Fuzzy Hash: b719c47ea3b9386918f3f92e2ac2931e12ac817a08806469225c697afd9b9f7b
Instruction Fuzzy Hash: BB618371D141189BCF48EBE0DC91DFDB375BF14301B44452AF942A7291EF786A09DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 006EE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 006EE1B1

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 70851b8fa76224614c850ed6cc6ea9ad273b88fb738ee0a47d6ecad1fa6e5eeb
Instruction ID: 5e8112ec98d61a462b2bdbb46215fc54cda045109d30ecbbd29a8a1ef2388a89
Opcode Fuzzy Hash: 70851b8fa76224614c850ed6cc6ea9ad273b88fb738ee0a47d6ecad1fa6e5eeb
Instruction Fuzzy Hash: 45514335A01396DFDB15DF69D0816FA7BAAEF15310F248059E8919B3C0DB399E43CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 006EF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 006EF2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 006EF2BB

Strings

@, xrefs: 006EF2AF

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 9aa994e7cfe10a609439a920ce03e55d6472ace42a2e266f89344b50ffbaf49d
Instruction ID: 195248a5a8836f5fa29b98a90af3299b0432ef810a9389e6e1e61dd40b97c019
Opcode Fuzzy Hash: 9aa994e7cfe10a609439a920ce03e55d6472ace42a2e266f89344b50ffbaf49d
Instruction Fuzzy Hash: 0B5158718087499BD360AF10DC86BABBBF9FF84310F91884DF1D981195EB709529CB6B

Uniqueness

Uniqueness Score: -1.00%

Function 00755745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 007557E0
_wcslen.LIBCMT ref: 007557EC

Strings

CALLARGARRAY, xrefs: 007557E6, 007557EB

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 2837c5cb3da8bed441e28c5cd2debedea87dc2016890a234462c0b7e272c4e66
Instruction ID: fa7da8ce989b906a3eff5fcb515edae7df93156e5fd6fbbf7140e495702f836f
Opcode Fuzzy Hash: 2837c5cb3da8bed441e28c5cd2debedea87dc2016890a234462c0b7e272c4e66
Instruction Fuzzy Hash: D6419F31E00209DFCB14DFA9C8959FEBBB5EF59311F10402DE905A7251E7B9AD85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0074D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0074D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 0074D13A

Strings

|, xrefs: 0074D10B

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: aaba46a2a2a981acf6533f05ae04078857cdaca56686a3fa781004c55cedf351
Instruction ID: e59fd2e0ac6a2cf8cec74010fba208d9631ebaecb1b8c1c259c371b053f00249
Opcode Fuzzy Hash: aaba46a2a2a981acf6533f05ae04078857cdaca56686a3fa781004c55cedf351
Instruction Fuzzy Hash: 4A313D75D00209ABCF55EFA4CC85AEE7FBAFF04304F00001EF915A6265EB35AA06DB64

Uniqueness

Uniqueness Score: -1.00%

Function 0076356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00763621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0076365C

Strings

static, xrefs: 007635BC

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: c8e6cfa3169c1c75736e33e52170659dcf13f0283030f38f5132c7439da916ff
Instruction ID: 0b018369fd3b9a489186bb0b1438f142749cebde83e9bbb639f7de2853470b09
Opcode Fuzzy Hash: c8e6cfa3169c1c75736e33e52170659dcf13f0283030f38f5132c7439da916ff
Instruction Fuzzy Hash: D6318F71100204AAEB109F78DC40EFB73A9FF88724F00961DFDA697290DA78AD91C764

Uniqueness

Uniqueness Score: -1.00%

Function 00764537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 0076461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00764634

Strings

', xrefs: 0076458E

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: ab699a260db84c5bb369bb4190484bc0103a0ae4a289b47af5b896dcc71c7fd0
Instruction ID: 72c942bbd99c6debff109d02880331025b851ce6089effceb8528f1a1fad5da1
Opcode Fuzzy Hash: ab699a260db84c5bb369bb4190484bc0103a0ae4a289b47af5b896dcc71c7fd0
Instruction Fuzzy Hash: 38312774A0120A9FDF14CFA9C980BDA7BB5FF49300F14406AED06AB342D774A951CF90

Uniqueness

Uniqueness Score: -1.00%

Function 007631EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0076327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00763287

Strings

Combobox, xrefs: 00763249

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 7af11ecf8bb60870da8cc17cd972c3026f2ddf3e5915b2f50e469d35d4754fc3
Instruction ID: 997092defedd7166d6c326abea698cf3df1a7257746bfd621fad275c15de15f4
Opcode Fuzzy Hash: 7af11ecf8bb60870da8cc17cd972c3026f2ddf3e5915b2f50e469d35d4754fc3
Instruction Fuzzy Hash: 6D11E271300208BFFF25DE54DC90EBB37AAFB943A4F104128F91A97290D6799D51C760

Uniqueness

Uniqueness Score: -1.00%

Function 00763710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 006D600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 006D604C
Part of subcall function 006D600E: GetStockObject.GDI32(00000011), ref: 006D6060
Part of subcall function 006D600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 006D606A

GetWindowRect.USER32(00000000,?), ref: 0076377A
GetSysColor.USER32(00000012), ref: 00763794

Strings

static, xrefs: 00763757

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 03b58c3129f5cc7066945cc0bc8f5d78177e02a807bc320969db50b7de55f22b
Instruction ID: 2c7ec7d799701aa0b904c0064bc4e49e8059ed111dbd1e3e19ce8f9e2161f1b1
Opcode Fuzzy Hash: 03b58c3129f5cc7066945cc0bc8f5d78177e02a807bc320969db50b7de55f22b
Instruction Fuzzy Hash: 301129B2610209AFDB01DFA8CC45AFA7BB8EB09354F004515FD56E2250D779E851DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0074CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0074CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 0074CDA6

Strings

<local>, xrefs: 0074CD66

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 34323b5b75b6ce3f73b590345d31a23327883da23e3e426dc5bc9ab067ad6a41
Instruction ID: dbab2b53fac9e62d10b9ed610a221f4dba34d8bb70a7981863a5ebe6da7a048e
Opcode Fuzzy Hash: 34323b5b75b6ce3f73b590345d31a23327883da23e3e426dc5bc9ab067ad6a41
Instruction Fuzzy Hash: 4A11C671B066357AD77A4B668C45EF7BE6CEF127A4F004226B15983190D7789840DAF0

Uniqueness

Uniqueness Score: -1.00%

Function 00763429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 007634AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 007634BA

Strings

edit, xrefs: 0076348F

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 559d64c93edb163c6a708ed535b0a48eb677e41e237ca7eb311fac5ad25c8fe7
Instruction ID: 9fb7c6079535bb392dd25087fbc61fb171528b6c80150ee07aec7863c1f1da1e
Opcode Fuzzy Hash: 559d64c93edb163c6a708ed535b0a48eb677e41e237ca7eb311fac5ad25c8fe7
Instruction Fuzzy Hash: 67118F71500248ABEB128E64DC44ABB7B6AEF05374F504324FD62931E0CB79DC55D754

Uniqueness

Uniqueness Score: -1.00%

Function 00736C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

CharUpperBuffW.USER32(?,?,?), ref: 00736CB6
_wcslen.LIBCMT ref: 00736CC2

Strings

STOP, xrefs: 00736CBC, 00736CC1

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 3534ddd493c9639bf4845917164db8fc284de755b1b78ada218143f0c87bbd91
Instruction ID: 88536fb71b3386e1935d9d56455dea9e4b6f74483a1bd23c55d658a4f7139fb9
Opcode Fuzzy Hash: 3534ddd493c9639bf4845917164db8fc284de755b1b78ada218143f0c87bbd91
Instruction Fuzzy Hash: 85010432B10526AADB21AFBDDC808BF77B5EA61714B004529E85296292EA39E800C760

Uniqueness

Uniqueness Score: -1.00%

Function 00731CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Part of subcall function 00733CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00733CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00731D4C

Strings

ListBox, xrefs: 00731D16
ComboBox, xrefs: 00731CEB

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: e8fb8b9d35726f66f1ac7e18016c512d6491218c14b497c3ed9fbec80f42a5cf
Instruction ID: 8aa6dd330179ae27d6f8c229df31dc4b6ad9d7e2f2ed152511ab1a70497fd943
Opcode Fuzzy Hash: e8fb8b9d35726f66f1ac7e18016c512d6491218c14b497c3ed9fbec80f42a5cf
Instruction Fuzzy Hash: 5701D871B11224ABDB18EBA4DC55CFE7369EB57350F44091AF872573C2EA3859088770

Uniqueness

Uniqueness Score: -1.00%

Function 00731BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Part of subcall function 00733CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00733CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00731C46

Strings

ListBox, xrefs: 00731C10
ComboBox, xrefs: 00731BE5

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 62033c9b61dabb5e675a745da89209886e9d980bb17c98cd766979a6c4651087
Instruction ID: ce2ed5b33887f172cb3ee2702713faf09f5a97b6cbc0ff6224d0102d0443231d
Opcode Fuzzy Hash: 62033c9b61dabb5e675a745da89209886e9d980bb17c98cd766979a6c4651087
Instruction Fuzzy Hash: 0901F7B1B8010466DF18EBA0D951DFF73A89B11340F50141AB416632C2EA289E0887B5

Uniqueness

Uniqueness Score: -1.00%

Function 00731C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Part of subcall function 00733CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00733CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00731CC8

Strings

ListBox, xrefs: 00731C94
ComboBox, xrefs: 00731C69

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 685b09d952e9287b6ad801cd81d094061793d47cbf3546521dfaf670e73972f7
Instruction ID: ff7234b53e942ca047fe0b027e1d3d14ec960da2d7611d14587aa980995eb484
Opcode Fuzzy Hash: 685b09d952e9287b6ad801cd81d094061793d47cbf3546521dfaf670e73972f7
Instruction Fuzzy Hash: FA01D6B2B8011867EF15EBA0DA01EFE73A89B11340F54141AB80273282EA689F08D775

Uniqueness

Uniqueness Score: -1.00%

Function 006EA4D6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 006EA529

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Strings

3yr, xrefs: 006EA545, 006EA54D, 006EA552
,%z, xrefs: 006EA509

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Init_thread_footer_wcslen
String ID: ,%z$3yr
API String ID: 2551934079-955863410
Opcode ID: 2c4402e50c6b6e5617de2a358b820810c71575378733b799208fc222c24c016d
Instruction ID: a7edfe76951cb832cd2e0e8b42d4ed51f45b5ad6cc231fccb0dd3219fdbcb2c3
Opcode Fuzzy Hash: 2c4402e50c6b6e5617de2a358b820810c71575378733b799208fc222c24c016d
Instruction Fuzzy Hash: 0401F231B017549BD604F7A9E85BAAD3366AB46710F50046DF612572C3EE14AD028AAF

Uniqueness

Uniqueness Score: -1.00%

Function 00731D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006D9CB3: _wcslen.LIBCMT ref: 006D9CBD

Part of subcall function 00733CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00733CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00731DD3

Strings

ListBox, xrefs: 00731DA0
ComboBox, xrefs: 00731D75

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: a88e87eeae5510c05ed2f02422027e061257c22a4b4e3ca336f0dbbbc8d1e937
Instruction ID: 4dae87d5ce3c8b8d04f6f7b60cbadb25790784b6e673f96c5ede2e5b86bd6c87
Opcode Fuzzy Hash: a88e87eeae5510c05ed2f02422027e061257c22a4b4e3ca336f0dbbbc8d1e937
Instruction Fuzzy Hash: 35F0A4B1F5121466EB18E7A4DC56EFE7778AF02750F440D1AB862633C2DA6859088274

Uniqueness

Uniqueness Score: -1.00%

Function 00768172 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,007A3018,007A305C), ref: 007681BF
CloseHandle.KERNEL32 ref: 007681D1

Strings

\0z, xrefs: 0076818A

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: \0z
API String ID: 3712363035-4117864471
Opcode ID: a61c4887d1ae87d44d9d30118545c56bac6687de06d588077019c85d9200f800
Instruction ID: dcfd1650ff9f9dad5c39c1766fac693be47aafce6192e2c3c65a1f6bcf4a2800
Opcode Fuzzy Hash: a61c4887d1ae87d44d9d30118545c56bac6687de06d588077019c85d9200f800
Instruction Fuzzy Hash: 8FF05EF2640304BAF2206B61AC55FB77A5EEB46750F008425FB09D51A2D67E8A0086BD

Uniqueness

Uniqueness Score: -1.00%

Function 0075747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00757493
_wcslen.LIBCMT ref: 007574B9

Strings

3, 3, 16, 1, xrefs: 00757483

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 668f778a576d829853c95fb52ae7cc8b47ad75ac4e95dc629c2aaf48cae7b939
Instruction ID: 385c44522ca8449eb092b8a0874ad614c195783e724050bf3574240c502b062e
Opcode Fuzzy Hash: 668f778a576d829853c95fb52ae7cc8b47ad75ac4e95dc629c2aaf48cae7b939
Instruction Fuzzy Hash: CDE02B423142A01092791279BCC19BF578ACFC6751714182FFE85C2266EED88D91D3E4

Uniqueness

Uniqueness Score: -1.00%

Function 00730B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00730B23

Strings

AutoIt, xrefs: 00730B17
Error allocating memory., xrefs: 00730B1C

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 131052c1a3818fc4de7a040c59b1d7c23eacf3dbce4ed8f085bb07cc2c64a18f
Instruction ID: db5bb6c375a93d2569122dcf9fc21b6f71fd352c79be6d3f560ff1877fbf2cc8
Opcode Fuzzy Hash: 131052c1a3818fc4de7a040c59b1d7c23eacf3dbce4ed8f085bb07cc2c64a18f
Instruction Fuzzy Hash: 3FE0DF722853583BE3513795BC03F997A858F05B20F10442EFB88A95C38AEA389046ED

Uniqueness

Uniqueness Score: -1.00%

Function 006F0D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 006EF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,006F0D71,?,?,?,006D100A), ref: 006EF7CE

IsDebuggerPresent.KERNEL32(?,?,?,006D100A), ref: 006F0D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,006D100A), ref: 006F0D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 006F0D7F

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 08586736283a9378a41a567f06ac25862b2519157e89f1f7dd5278a938f7f14a
Instruction ID: c89ad6e1c1728380409cfe396672cbd7fd08949ee8f91528d2ba984c61e2b0c2
Opcode Fuzzy Hash: 08586736283a9378a41a567f06ac25862b2519157e89f1f7dd5278a938f7f14a
Instruction Fuzzy Hash: 25E06D742003518FE7619FB9E8143667BE5BF04744F00892DE982C6656DBB9E4448B91

Uniqueness

Uniqueness Score: -1.00%

Function 006EE398 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 006EE3D5

Strings

8%z, xrefs: 006EE3CA
0%z, xrefs: 006EE3B5

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: Init_thread_footer
String ID: 0%z$8%z
API String ID: 1385522511-2349322819
Opcode ID: 4190390cf1a6c48f1de5394a7e45111aae993ceb4ca50ec6c9f91f4c40954f51
Instruction ID: 3744494fa0a67f3dfa4f14a2a431c119b8d081dbc42e476797605829c0a387a6
Opcode Fuzzy Hash: 4190390cf1a6c48f1de5394a7e45111aae993ceb4ca50ec6c9f91f4c40954f51
Instruction Fuzzy Hash: 69E02639C09B54CBCA0CD71DB874A983397BB86320B1042F9E102876D3DB3A28438A5C

Uniqueness

Uniqueness Score: -1.00%

Function 0072D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0072D220

Strings

%.3d, xrefs: 0072D22B
X64, xrefs: 0072D2A8

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 1823d0bf07577613be6fc554173f19c25d3abedaa6638b6d60d2e2043f11883e
Instruction ID: ee66dbbef33b84b311bd7062fc21563a31b46b20e366d64bca3fc53b704cf9fb
Opcode Fuzzy Hash: 1823d0bf07577613be6fc554173f19c25d3abedaa6638b6d60d2e2043f11883e
Instruction Fuzzy Hash: DDD012A1809268EACBA097E0EC498B9B3FCBB08301F608452F90692040D62CC908A761

Uniqueness

Uniqueness Score: -1.00%

Function 00762356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0076236C
PostMessageW.USER32(00000000), ref: 00762373

Part of subcall function 0073E97B: Sleep.KERNEL32 ref: 0073E9F3

Strings

Shell_TrayWnd, xrefs: 00762365

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 5f749bf7df67a6de6ab2796c857d9412b6678a646be30653d4a4d9f1e0fb9096
Instruction ID: 9eaab2e10343fe383bf4a067f1f56af5326f29a07584b892d261a9c81393eb2f
Opcode Fuzzy Hash: 5f749bf7df67a6de6ab2796c857d9412b6678a646be30653d4a4d9f1e0fb9096
Instruction Fuzzy Hash: 6BD0C972381310BAEA65B770EC0FFD67A149B04B10F108A56B687AA1D1C9E8B8018A58

Uniqueness

Uniqueness Score: -1.00%

Function 00762322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0076232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0076233F

Part of subcall function 0073E97B: Sleep.KERNEL32 ref: 0073E9F3

Strings

Shell_TrayWnd, xrefs: 00762325

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: bf7602e66a36ccdc5d640188f58874fe06d0f56ff74ab4b7f44bd8ae54560674
Instruction ID: ce25b423a7a44cd15642b3326b928e59ee0dfa6404ea332435358f6cfadc79ab
Opcode Fuzzy Hash: bf7602e66a36ccdc5d640188f58874fe06d0f56ff74ab4b7f44bd8ae54560674
Instruction Fuzzy Hash: EDD01276394310B7EA64B770EC0FFD67A149B04B10F108A56B787AA1D1C9F8B801CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0070BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 0070BE93
GetLastError.KERNEL32 ref: 0070BEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0070BEFC

Memory Dump Source

Source File: 00000000.00000002.2100466612.00000000006D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.2100442681.00000000006D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.000000000076C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100526324.0000000000792000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100583266.000000000079C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2100607310.00000000007A4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_FAR.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: da159769daa23ccd33682431b2788714aa268a4827e36adbc4999d64d31d6c2d
Instruction ID: 76b2506a48a97cd92147102e5ac7220735100eef9fec7bd39bbc4dcd37e531ce
Opcode Fuzzy Hash: da159769daa23ccd33682431b2788714aa268a4827e36adbc4999d64d31d6c2d
Instruction Fuzzy Hash: B741B335604206EFCF258FA5CC84ABA7BE5AF42710F144269FA59972E1DB349F01CB51

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FAR.N#U00b02430-24000993.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\newfile.exe.log

C:\Users\user\AppData\Local\Temp\autE4C3.tmp

C:\Users\user\AppData\Local\Temp\autE522.tmp

C:\Users\user\AppData\Local\Temp\iodization

C:\Users\user\AppData\Local\Temp\jailless

C:\Users\user\AppData\Roaming\newfile\newfile.exe

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
FAR.N#U00b02430-24000993.exe

Function 006D42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Function 006D42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Function 00712BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Function 006D2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Function 00708D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300
COMMONLIBRARYCODE

Function 0071065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Function 006D344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 006D2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Function 006D3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Function 01542660 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 006D2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 01542410 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 154
fileCOMMON

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre