Edit tour

Windows Analysis Report
DPT_590327839_027838893200_____________________________.exe

Overview

General Information

Sample name:	DPT_590327839_027838893200_____________________________.exe
Analysis ID:	1430157
MD5:	a41d666268109b71eeab533caf08d5ec
SHA1:	62694b120d65962dbdefc457bfafa092a3e6a018
SHA256:	92d6b2ccfc3f6f350b4c5f989022abda28a982e9fe0bb4121ad4092802e1a758
Tags:	exe
Infos:

Detection

AgentTesla

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Sigma detected: Suspicious Double Extension File Execution

Yara detected AgentTesla

Binary is likely a compiled AutoIt script file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain (may stop execution after accessing registry keys)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

DPT_590327839_027838893200_____________________________.exe (PID: 6764 cmdline: "C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe" MD5: A41D666268109B71EEAB533CAF08D5EC)

RegSvcs.exe (PID: 1020 cmdline: "C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.worlorderbillions.top", "Username": "neds@worlorderbillions.top", "Password": "      rwe87$%21q"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1227948932.0000000002500000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000002.00000002.2447856889.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security

Unpacked PEs

Source	Rule	Description	Author
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.DPT_590327839_027838893200_____________________________.exe.2500000.1.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.DPT_590327839_027838893200_____________________________.exe.2500000.1.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Double Extension File Execution

Source: Process started

Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe", CommandLine: "C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe, NewProcessName: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe, OriginalFileName: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe", ProcessId: 6764, ProcessName: DPT_590327839_027838893200_____________________________.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: RegSvcs.exe.1020.2.memstrmin

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.worlorderbillions.top", "Username": "neds@worlorderbillions.top", "Password": " rwe87$%21q"}

Multi AV Scanner detection for submitted file

Source: DPT_590327839_027838893200_____________________________.exe	ReversingLabs: Detection: 34%
Source: DPT_590327839_027838893200_____________________________.exe	Virustotal: Detection: 23%			Perma Link

Machine Learning detection for sample

Source: DPT_590327839_027838893200_____________________________.exe

Joe Sandbox ML: detected

Source: DPT_590327839_027838893200_____________________________.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: wntdll.pdbUGP source: DPT_590327839_027838893200_____________________________.exe, 00000000.00000003.1222060623.00000000041E0000.00000004.00001000.00020000.00000000.sdmp, DPT_590327839_027838893200_____________________________.exe, 00000000.00000003.1223128482.0000000004380000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: DPT_590327839_027838893200_____________________________.exe, 00000000.00000003.1222060623.00000000041E0000.00000004.00001000.00020000.00000000.sdmp, DPT_590327839_027838893200_____________________________.exe, 00000000.00000003.1223128482.0000000004380000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_01024696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_01024696
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_0102C93C FindFirstFileW,FindClose,	0_2_0102C93C
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_0102C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0102C9C7
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_0102F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0102F35D
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_0102F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0102F200
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_0102F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0102F65E
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_01023A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_01023A2B
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_01023D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_01023D4E
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_0102BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0102BF27

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_010325E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_010325E2

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_0103425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_0103425A

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_01034458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_01034458

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

0_2_0103425A

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_01020219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_01020219

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_0104CDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0104CDAC

System Summary

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00FC3B4C
Source: DPT_590327839_027838893200_____________________________.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: DPT_590327839_027838893200_____________________________.exe, 00000000.00000000.1212135324.0000000001075000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_d6d50743-2
Source: DPT_590327839_027838893200_____________________________.exe, 00000000.00000000.1212135324.0000000001075000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_600fac8e-0
Source: DPT_590327839_027838893200_____________________________.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_9d4b6c78-8
Source: DPT_590327839_027838893200_____________________________.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_746cb9b3-5

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_01024021: CreateFileW,DeviceIoControl,CloseHandle,

0_2_01024021

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_01018858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_01018858

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_0102545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_0102545F

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FCE800	0_2_00FCE800
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FEDBB5	0_2_00FEDBB5
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FCE060	0_2_00FCE060
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_0104804A	0_2_0104804A
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FD4140	0_2_00FD4140
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FE2405	0_2_00FE2405
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FF6522	0_2_00FF6522
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FF267E	0_2_00FF267E
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_01040665	0_2_01040665
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FD6843	0_2_00FD6843
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FE283A	0_2_00FE283A
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FF89DF	0_2_00FF89DF
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_0101EB07	0_2_0101EB07
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_01028B13	0_2_01028B13
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FF6A94	0_2_00FF6A94
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FD8A0E	0_2_00FD8A0E
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_01040AE2	0_2_01040AE2
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FECD61	0_2_00FECD61
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FF7006	0_2_00FF7006
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FD3190	0_2_00FD3190
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FD710E	0_2_00FD710E
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FC1287	0_2_00FC1287
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FE33C7	0_2_00FE33C7
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FEF419	0_2_00FEF419
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FE16C4	0_2_00FE16C4
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FD5680	0_2_00FD5680
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FE78D3	0_2_00FE78D3
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FD58C0	0_2_00FD58C0
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FE1BB8	0_2_00FE1BB8
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FF9D05	0_2_00FF9D05
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FCFE40	0_2_00FCFE40
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FEBFE6	0_2_00FEBFE6
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FE1FD0	0_2_00FE1FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_01724100	2_2_01724100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0172D241	2_2_0172D241
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_01724D18	2_2_01724D18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_01729E80	2_2_01729E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_01724448	2_2_01724448
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0172C747	2_2_0172C747
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06560040	2_2_06560040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_065620F8	2_2_065620F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06563A48	2_2_06563A48

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: String function: 00FE0D27 appears 70 times
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: String function: 00FC7F41 appears 35 times
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: String function: 00FE8B40 appears 42 times

Source: DPT_590327839_027838893200_____________________________.exe, 00000000.00000003.1221153657.0000000004303000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs DPT_590327839_027838893200_____________________________.exe
Source: DPT_590327839_027838893200_____________________________.exe, 00000000.00000003.1220193431.00000000044AD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs DPT_590327839_027838893200_____________________________.exe
Source: DPT_590327839_027838893200_____________________________.exe, 00000000.00000002.1227948932.0000000002500000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamec32e98c6-4205-4798-904b-ffd769a7f33f.exe4 vs DPT_590327839_027838893200_____________________________.exe

Source: DPT_590327839_027838893200_____________________________.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.DPT_590327839_027838893200_____________________________.exe.2500000.1.raw.unpack, O.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DPT_590327839_027838893200_____________________________.exe.2500000.1.raw.unpack, O.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.DPT_590327839_027838893200_____________________________.exe.2500000.1.raw.unpack, P.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DPT_590327839_027838893200_____________________________.exe.2500000.1.raw.unpack, P.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DPT_590327839_027838893200_____________________________.exe.2500000.1.raw.unpack, N.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DPT_590327839_027838893200_____________________________.exe.2500000.1.raw.unpack, N.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DPT_590327839_027838893200_____________________________.exe.2500000.1.raw.unpack, N.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DPT_590327839_027838893200_____________________________.exe.2500000.1.raw.unpack, N.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal96.troj.spyw.evad.winEXE@3/4@0/0

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_0102A2D5 GetLastError,FormatMessageW,

0_2_0102A2D5

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_01018713 AdjustTokenPrivileges,CloseHandle,		0_2_01018713
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_01018CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_01018CC3

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_0102B59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_0102B59E

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_0103F121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0103F121

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_0102C602 CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0102C602

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_00FC4FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00FC4FE9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

File created: C:\Users\user~1\AppData\Local\Temp\aut9B87.tmp

Jump to behavior

Source: DPT_590327839_027838893200_____________________________.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegSvcs.exe, 00000002.00000002.2452344447.0000000003329000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2452344447.000000000333E000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: DPT_590327839_027838893200_____________________________.exe	ReversingLabs: Detection: 34%
Source: DPT_590327839_027838893200_____________________________.exe	Virustotal: Detection: 23%

Source: unknown	Process created: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe "C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe"
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe"
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe"	Jump to behavior

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: DPT_590327839_027838893200_____________________________.exe

Static file information: File size 1088512 > 1048576

Source: DPT_590327839_027838893200_____________________________.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: DPT_590327839_027838893200_____________________________.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: DPT_590327839_027838893200_____________________________.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: DPT_590327839_027838893200_____________________________.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: DPT_590327839_027838893200_____________________________.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: DPT_590327839_027838893200_____________________________.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: DPT_590327839_027838893200_____________________________.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: DPT_590327839_027838893200_____________________________.exe, 00000000.00000003.1222060623.00000000041E0000.00000004.00001000.00020000.00000000.sdmp, DPT_590327839_027838893200_____________________________.exe, 00000000.00000003.1223128482.0000000004380000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: DPT_590327839_027838893200_____________________________.exe, 00000000.00000003.1222060623.00000000041E0000.00000004.00001000.00020000.00000000.sdmp, DPT_590327839_027838893200_____________________________.exe, 00000000.00000003.1223128482.0000000004380000.00000004.00001000.00020000.00000000.sdmp

Source: DPT_590327839_027838893200_____________________________.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: DPT_590327839_027838893200_____________________________.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: DPT_590327839_027838893200_____________________________.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: DPT_590327839_027838893200_____________________________.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: DPT_590327839_027838893200_____________________________.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_0103C304 LoadLibraryA,GetProcAddress,

0_2_0103C304

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FE8B85 push ecx; ret	0_2_00FE8B98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0656F6E8 push ss; retf 0005h	2_2_0656F6EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0656F758 push ss; retf 0005h	2_2_0656F75A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0656F2E9 push cs; retf 0005h	2_2_0656F2EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0656F3B9 push cs; retf 0005h	2_2_0656F3BA

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FC4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00FC4A35
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_010455FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_010455FD

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_00FE33C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00FE33C7

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

graph_0-97441

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

API coverage: 4.1 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_01024696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_01024696
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_0102C93C FindFirstFileW,FindClose,	0_2_0102C93C
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_0102C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0102C9C7
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_0102F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0102F35D
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_0102F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0102F200
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_0102F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0102F65E
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_01023A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_01023A2B
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_01023D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_01023D4E
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_0102BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0102BF27

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_00FC4AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00FC4AFE

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	API call chain: ExitProcess graph end node			graph_0-97575
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	API call chain: ExitProcess graph end node			graph_0-97644

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_010341FD BlockInput,

0_2_010341FD

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_00FC3B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00FC3B4C

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_00FF5CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00FF5CCC

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_0103C304 LoadLibraryA,GetProcAddress,

0_2_0103C304

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_010181F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_010181F7

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FEA395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00FEA395
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_00FEA364 SetUnhandledExceptionFilter,		0_2_00FEA364

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_01018C93 LogonUserW,

0_2_01018C93

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_00FC3B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00FC3B4C

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_00FC4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00FC4A35

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_01024F21 mouse_event,

0_2_01024F21

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe"

Jump to behavior

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

0_2_010181F7

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_01024C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_01024C03

Source: DPT_590327839_027838893200_____________________________.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: DPT_590327839_027838893200_____________________________.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_00FE886B cpuid

0_2_00FE886B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_00FF50D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00FF50D7

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_01002230 GetUserNameW,

0_2_01002230

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_00FF418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00FF418A

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe

Code function: 0_2_00FC4AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00FC4AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DPT_590327839_027838893200_____________________________.exe.2500000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DPT_590327839_027838893200_____________________________.exe.2500000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1227948932.0000000002500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2447856889.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: DPT_590327839_027838893200_____________________________.exe	Binary or memory string: WIN_81
Source: DPT_590327839_027838893200_____________________________.exe	Binary or memory string: WIN_XP
Source: DPT_590327839_027838893200_____________________________.exe	Binary or memory string: WIN_XPe
Source: DPT_590327839_027838893200_____________________________.exe	Binary or memory string: WIN_VISTA
Source: DPT_590327839_027838893200_____________________________.exe	Binary or memory string: WIN_7
Source: DPT_590327839_027838893200_____________________________.exe	Binary or memory string: WIN_8
Source: DPT_590327839_027838893200_____________________________.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DPT_590327839_027838893200_____________________________.exe.2500000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DPT_590327839_027838893200_____________________________.exe.2500000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1227948932.0000000002500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2447856889.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_01036596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_01036596
Source: C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe	Code function: 0_2_01036A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_01036A5A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	38 System Information Discovery	Distributed Component Object Model	21 Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	112 Process Injection	2 Valid Accounts	LSA Secrets	14 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Virtualization/Sandbox Evasion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	112 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DPT_590327839_027838893200_____________________________.exe	34%	ReversingLabs	Win32.Trojan.Strab
DPT_590327839_027838893200_____________________________.exe	24%	Virustotal		Browse
DPT_590327839_027838893200_____________________________.exe	100%	Joe Sandbox ML

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430157
Start date and time:	2024-04-23 08:30:44 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DPT_590327839_027838893200_____________________________.exe
Detection:	MAL
Classification:	mal96.troj.spyw.evad.winEXE@3/4@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 53 Number of non-executed functions: 273
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.

Process:	C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe
File Type:	data
Category:	dropped
Size (bytes):	132180
Entropy (8bit):	7.9513960654096225
Encrypted:	false
SSDEEP:	3072:dE/FzLym8bR1dI0NGQ+XWJtATH0NU+luEsdINu:duyL91dIbXCqLdEu
MD5:	5C0F6568FE0CA0A6626B480124D2820F
SHA1:	6A3ABCF59D57AE790EC6E7799A5D0B2A1BC4472A
SHA-256:	06CAB7D1A4B22CD3B0CBA4F0447F16382FCF153AF7B5405C920691588950CA25
SHA-512:	ED922416534E73DC410546DB91724C68F64EB8894F2EAA726038ED8D65246908596306A7EBEF60323F3B432D99CAE74B6327205CA1B6F362E68DAE2CE4CBB128
Malicious:	false
Reputation:	low
Preview:	EA06.......t..b.S....-..m6.S..:\.H..@.JD.m6.....#....I..J.~kXh.....X.....-F.HeR.Un.+.V.y...S.M.r;...x.G,.:..YQ.N.4KH.&bw..".7..3x.....Z...oO..jt..j.S..;...Sjv..-B&.h..AQ....9..L.S..@.F.Cz..".S...2I...E...gw?zL.....(........S.tp....G..]..F.......o....x.f[8....ui3j.(....3&q...a+.. T..... L........P..H..C".L)sj....R&.@.#.Q... ..lD.......5..D.M.4.MR.6.ujsZ...5.M.@......j5:.."Vi.9%Vei.M&...>.T..2.Ye&qD......S..(T....'.n5..M....\..>.m......G..e.jM.oh.Z~..D..J...1..bms.P.@....M.Wg..(..D.....^.K.v.P.<..B.L$ ......;.@.".0.w&Sx5NkE..).)g".b.Kh.j.2.<.L.T.O"oh...Je..+.3..P.!0..U......(..m^Im.U%T..2Z.fRl.Z\.R..h.0."uE...^\.H..@....!G.V.4......[.V.l2....l.:\..L...L.L.m'.Q,.J\...Fk......I)...~..Gh...:m!.S..J..N...QJ."G<.P..:..is.^>V........0...Y..-....F.2Vl.j\.h.. ..T.m6.[).(d.E......m!.......J.M..Z%.g6.S.V../...^.....=..,..B.`..hs+U:i6.T+.Z.&m^.^.9."......ih..p.....-"i0..3R*u..7...8..[..jt..~.s.....Ri6.{)TK..H..j3....p.[%...6=S.T....j.p.U..J..g..E4.G..

C:\Users\user\AppData\Local\Temp\aut9BE5.tmp

Download File

Process:	C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe
File Type:	data
Category:	dropped
Size (bytes):	9922
Entropy (8bit):	7.59578339129546
Encrypted:	false
SSDEEP:	192:m+cK6f01Ehm0qek9Gh0qWbK307N+P7EqP008IuLrQpbrSKD0O7t:976Mkm7ek9y0pbK307Nkgq+XQpbrXDPx
MD5:	F3E5ADDD42115E929C29BB96DFAA5B65
SHA1:	7E64D5DD0227633F81A542F9ED522444BEFC2ECD
SHA-256:	5FEB526A93368DE24851F4E6C76345266ABDA89B0C60CF203E0EF2D5EE37087D
SHA-512:	CA5238FCB8DA520D7588E9AE82DD9658B684EE935A63DE023ACAA584E3B19AA50BCA04E75467D00120215E3C59473D3EB00F05FD0BD7E93E898B80691D941764
Malicious:	false
Reputation:	low
Preview:	EA06..t0.M'.)..e4.N'.).......T9..l.0L.s.5..3..s.4.8.......k8.Yls....c..&S...k6...S....1.L&.i..i5.M,S....K.@...7...p. ....P.o...m.X.V........9....3...f....s2.Xf@.]..g3@..h.m.M.......8.l..6.....a........i4........g3Y...c ._..k4...d....H, ......Ac.H..g...(.F..=d....>....C`....@02..N@...u......Y..ab.M.]>.$....M.x>;$....N.j.;%....X.j.;%......j.;,....P'.b.5... .^..f./Z..@F.6.z..G......`......i..G../Z...zqd...l.;.........\|......7...}3{(........;^..l =..p.........3p.o....,.......x.....H<.lX.:...b.....,. ...2...f.[...K.)....b..i\|v F......X......`....,.9....5...._..l......>K.....ir.e....[4..d..f.y.....,.....S >..p...........s9.... !..Y....f...ja4....ea.h,.p.....,.a8.,..3........f.....f ....,j.0..&...J......f ....6K%.ke..f....L..;2.X...4.Y.V@.Fn.....f@....l..05.....!;3.X...c )D.g6... ...'&`....,f.6..&....r...Brh.....l...i2...B....@.......d.L.`!.....P...@X5d..lSK...9...!;5.X...cVY......'.B...,vl.!..>.a..l...M..@...X...b.M&.X..B.a.Q...sp..X..9..o5..f.!...,vn......d...

C:\Users\user\AppData\Local\Temp\electicism

Download File

Process:	C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe
File Type:	ASCII text, with very long lines (29744), with no line terminators
Category:	modified
Size (bytes):	29744
Entropy (8bit):	3.546555146881828
Encrypted:	false
SSDEEP:	768:wiTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbQE+I+h6584vfF3if6gL:wiTZ+2QoioGRk6ZklputwjpjBkCiw2Ra
MD5:	52CD5248D09D5A260B82DA1CA36EBAD4
SHA1:	8F55BA826B82A19D1095E4F0853061C7D046D8AA
SHA-256:	30F7C33D238119A141FA7CD27106ECFBA124EB693AD08B7B5C8C71DDBCA0FE0B
SHA-512:	AC3D909CD3B67A030099C7E42C01E80E1956318CF078497C20578FF74907380ABDC376CEFCBC7C8C579C94AFD3A89F805DDB5FF14D822029C0FABC16D7DEA619
Malicious:	false
Reputation:	low
Preview:	048B4C24088B008B093BC8760483C8FFC31BC0F7D8C38B0x558bec81eccc0200005657b86b00000066894584b96500000066894d86ba7200000066895588b86e0000006689458ab96500000066894d8cba6c0000006689558eb83300000066894590b93200000066894d92ba2e00000066895594b86400000066894596b96c00000066894d98ba6c0000006689559a33c06689459cb96e00000066898d44ffffffba7400000066899546ffffffb86400000066898548ffffffb96c00000066898d4affffffba6c0000006689954cffffffb82e0000006689854effffffb96400000066898d50ffffffba6c00000066899552ffffffb86c00000066898554ffffff33c966898d56ffffffba75000000668955d0b873000000668945d2b96500000066894dd4ba72000000668955d6b833000000668945d8b93200000066894ddaba2e000000668955dcb864000000668945deb96c00000066894de0ba6c000000668955e233c0668945e4b96100000066898d68ffffffba640000006689956affffffb8760000006689856cffffffb96100000066898d6effffffba7000000066899570ffffffb86900000066898572ffffffb93300000066898d74ffffffba3200000066899576ffffffb82e00000066898578ffffffb96400000066898d7affffffba6c0000006689957cffffffb86c00000066

C:\Users\user\AppData\Local\Temp\intemeration

Download File

Process:	C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe
File Type:	data
Category:	dropped
Size (bytes):	167936
Entropy (8bit):	7.117364737785545
Encrypted:	false
SSDEEP:	3072:tPvRL4Y7QIgpCenQO8gPS/dDzYnLIrkJ+gfFMEZBe26gtR5bJbesEVyxk9Z8bCNt:tnRLj7KpCenB8gPS/dDzYnpESU26gtf6
MD5:	94BCF511F99D9712CE0E91A0574B18E8
SHA1:	BA5807E5EC721907AE7BEC6C492930F395E612D4
SHA-256:	370A0C789828EC3071419C734BFFCD703D19E9DDF613B02D64F878A86DD214F4
SHA-512:	DB6547FDB83C9D5E784B8CEFE8B87312A868495676F9AF57E25F8AF8B2B84A72A86170023800CECAC07FE7D4B7A334E8012A7AE06A9C644FEF8A96557D4EC923
Malicious:	false
Reputation:	low
Preview:	...K5XHS1C8B..66.NMSK6XH.5C8BH466DNMSK6XHS5C8BH466DNMSK6XHS5.8BH:).JN.Z...I..bl!G.F6!![x+2[-W6hVS.6;#s"Xx..fcU-,Q.;IDiSK6XHS5.}BHx75D.../6XHS5C8B.447OO}SK.ZHS=C8BH46x.LMSk6XHS5C8B.46.DNMQK6\HS5C8BH066DNMSK6XKS5A8BH466FN..K6HHS%C8BH$66TNMSK6XXS5C8BH466DN..I6.HS5C.@Hr36DNMSK6XHS5C8BH466D.OSG6XHS5C8BH466DNMSK6XHS5C8BH466DNMSK6XHS5C8BH466DNMSK6xHS=C8BH466DNMSC.XH.5C8BH466DNM}?S <S5Cl.J46.DNM.I6XJS5C8BH466DNMSK.XH3.1K0+466.KMSK.ZHS3C8B.666DNMSK6XHS5CxBHt.D!""0K6THS5C.@H446DN.QK6XHS5C8BH466.NM.K6XHS5C8BH466DNMc.4XHS5CpBH446AN)TI6..S5@8BH566BNMSK6XHS5C8BH466DNMSK6XHS5C8BH466DNMSK6XHS5C8BH4%.FN.SK6YHS$U2i.40..OaTc5XHU,I8DQ.7.CfLSK<BBS3T.Cd8..KNM{I6XBK?C>T.5.5DYGSM,.I.7h:i..(4lJMSA.XHS6s:B.466ENMB]<`.S5C8DV.7.I=.SK0.JS5G'KB40!.OaTc=XHU-I8DT.7.H0LSK27.S5E%HH2,.EbD-F6XL.<X2BN).7hG3]K6\d.+I8DP.7.CfMQK0ABS3\1.I.;HFNMW$mXHUI2BN-.7hIeUK6^RY5E#.I.:E.NMU.7XHW)I8D^.7.GNZYK0GB.4o:iM.x..gSK%hLS.C8BI46'RDfdK0O.R.^.X.r..$LMUc?XHU.D8BN6!.LLMUS<XNE.B.AH#<6BV.Rg4sJx.i8BS.36.NMSI6XYE8h.BA#.7hYeVK6RhC...j(6

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.919451048170663
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	DPT_590327839_027838893200_____________________________.exe
File size:	1'088'512 bytes
MD5:	a41d666268109b71eeab533caf08d5ec
SHA1:	62694b120d65962dbdefc457bfafa092a3e6a018
SHA256:	92d6b2ccfc3f6f350b4c5f989022abda28a982e9fe0bb4121ad4092802e1a758
SHA512:	1e6ddcea2dd5f3660d3ab639fe86def6cd44c4c1545de76805482b54905372b62383eb1f9fc03a2579a1dc8edf253340e28560eff8eb87724e4799d7b8192462
SSDEEP:	24576:+AHnh+eWsN3skA4RV1Hom2KXMmHaLzS77o5:ph+ZkldoPK8YaLzr
TLSH:	BE358C3263918335FFAB9E73DB5DB20D56BC6D250123852FD29C2F79A9F01B1122D262
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	1a5ada12a98c3689

Static PE Info

General

Entrypoint:	0x42800a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66269655 [Mon Apr 22 16:54:45 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007F61010E56EDh
jmp 00007F61010D84A4h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F61010D862Ah
cmp edi, eax
jc 00007F61010D898Eh
bt dword ptr [004C41FCh], 01h
jnc 00007F61010D8629h
rep movsb
jmp 00007F61010D893Ch
cmp ecx, 00000080h
jc 00007F61010D87F4h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F61010D8630h
bt dword ptr [004BF324h], 01h
jc 00007F61010D8B00h
bt dword ptr [004C41FCh], 00000000h
jnc 00007F61010D87CDh
test edi, 00000003h
jne 00007F61010D87DEh
test esi, 00000003h
jne 00007F61010D87BDh
bt edi, 02h
jnc 00007F61010D862Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F61010D8633h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F61010D8685h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbc0cc	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x3f57c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x108000	0x7134	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4b50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dfdd	0x8e000	310e36668512d53489c005622bb1b4a9	False	0.5735602580325704	data	6.675248351711057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2fd8e	0x2fe00	748cf1ab2605ce1fd72d53d912abb68f	False	0.32828818537859006	data	5.763244005758284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbf000	0x8f74	0x5200	aae9601d920f07080bdfadf43dfeff12	False	0.1017530487804878	data	1.1963819235530628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc8000	0x3f57c	0x3f600	5388ab06552e9b0b8f86525235d453ac	False	0.7207878759861933	data	7.189407458583954	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x108000	0x7134	0x7200	f04128ad0f87f42830e4a6cdbc38c719	False	0.7617530153508771	data	6.783955557128661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc8458	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc8580	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc86a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc87d0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	Great Britain	0.046891636105524666
RT_MENU	0xd8ff8	0x50	data	English	Great Britain	0.9
RT_STRING	0xd9048	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xd95dc	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xd9c68	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xda0f8	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xda6f4	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdad50	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdb1b8	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdb310	0x2bd20	data			1.0003398555892316
RT_GROUP_ICON	0x107030	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x107044	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x107058	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x10706c	0x14	data	English	Great Britain	1.25
RT_VERSION	0x107080	0x10c	data	English	Great Britain	0.5970149253731343
RT_MANIFEST	0x10718c	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Target ID:	0
Start time:	08:31:34
Start date:	23/04/2024
Path:	C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe"
Imagebase:	0xfc0000
File size:	1'088'512 bytes
MD5 hash:	A41D666268109B71EEAB533CAF08D5EC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.1227948932.0000000002500000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:31:35
Start date:	23/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DPT_590327839_027838893200_____________________________.exe"
Imagebase:	0xd50000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000002.00000002.2447856889.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	51

Executed Functions

Function 00FC3B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00FC3B7A
IsDebuggerPresent.KERNEL32 ref: 00FC3B8C
GetFullPathNameW.KERNEL32(00007FFF,?,?,010862F8,010862E0,?,?), ref: 00FC3BFD

Part of subcall function 00FC7D2C: _memmove.LIBCMT ref: 00FC7D66

Part of subcall function 00FD0A8D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00FC3C26,010862F8,?,?,?), ref: 00FD0ACE

SetCurrentDirectoryW.KERNEL32(?), ref: 00FC3C81
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,010793F0,00000010), ref: 00FFD4BC
SetCurrentDirectoryW.KERNEL32(?,010862F8,?,?,?), ref: 00FFD4F4
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,01075D40,010862F8,?,?,?), ref: 00FFD57A
ShellExecuteW.SHELL32(00000000,?,?), ref: 00FFD581

Part of subcall function 00FC3A58: GetSysColorBrush.USER32(0000000F), ref: 00FC3A62
Part of subcall function 00FC3A58: LoadCursorW.USER32(00000000,00007F00), ref: 00FC3A71
Part of subcall function 00FC3A58: LoadIconW.USER32(00000063), ref: 00FC3A88
Part of subcall function 00FC3A58: LoadIconW.USER32(000000A4), ref: 00FC3A9A
Part of subcall function 00FC3A58: LoadIconW.USER32(000000A2), ref: 00FC3AAC
Part of subcall function 00FC3A58: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00FC3AD2
Part of subcall function 00FC3A58: RegisterClassExW.USER32(?), ref: 00FC3B28

Part of subcall function 00FC39E7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00FC3A15
Part of subcall function 00FC39E7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00FC3A36
Part of subcall function 00FC39E7: ShowWindow.USER32(00000000,?,?), ref: 00FC3A4A
Part of subcall function 00FC39E7: ShowWindow.USER32(00000000,?,?), ref: 00FC3A53

Part of subcall function 00FC43DB: _memset.LIBCMT ref: 00FC4401
Part of subcall function 00FC43DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00FC44A6

Strings

runas, xrefs: 00FFD575
This is a third-party compiled AutoIt script., xrefs: 00FFD4B4

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-3287110873
Opcode ID: 0ed03059059fac33b4e593818302c1cf2af566627f5acb9653029af85070a276
Instruction ID: bc157560dc4d123a0d0a8fd6b19aeb3fc07a287762ce6852034977e1933a8623
Opcode Fuzzy Hash: 0ed03059059fac33b4e593818302c1cf2af566627f5acb9653029af85070a276
Instruction Fuzzy Hash: FF510331D0824AAACB21FBB4DE46FFD7B75AF04350F0480ADF8D1A6152CA3E5645EB20

Uniqueness

Uniqueness Score: -1.00%

Function 00FC4AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00FC4B2B

Part of subcall function 00FC7D2C: _memmove.LIBCMT ref: 00FC7D66

GetCurrentProcess.KERNEL32(?,0104FAEC,00000000,00000000,?), ref: 00FC4BF8
IsWow64Process.KERNEL32(00000000), ref: 00FC4BFF
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00FC4C45
FreeLibrary.KERNEL32(00000000), ref: 00FC4C50
GetSystemInfo.KERNEL32(00000000), ref: 00FC4C81
GetSystemInfo.KERNEL32(00000000), ref: 00FC4C8D

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: a65a3b13a3dbbaab7824930e92f236dfbb8606c474916286577876200463027e
Instruction ID: bf6889d59080bda2aa1f81334a1a8f983f71157eb3dc3eeba0aa663616d95f32
Opcode Fuzzy Hash: a65a3b13a3dbbaab7824930e92f236dfbb8606c474916286577876200463027e
Instruction Fuzzy Hash: 2591273184A7C5DEC731DB788662BAAFFE5AF66310B044D9DD0CB83A51C224F908E719

Uniqueness

Uniqueness Score: -1.00%

Function 00FC4FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00FC4EEE,?,?,00000000,00000000), ref: 00FC4FF9
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00FC4EEE,?,?,00000000,00000000), ref: 00FC5010
LoadResource.KERNEL32(?,00000000,?,?,00FC4EEE,?,?,00000000,00000000,?,?,?,?,?,?,00FC4F8F), ref: 00FFDD60
SizeofResource.KERNEL32(?,00000000,?,?,00FC4EEE,?,?,00000000,00000000,?,?,?,?,?,?,00FC4F8F), ref: 00FFDD75
LockResource.KERNEL32(00FC4EEE,?,?,00FC4EEE,?,?,00000000,00000000,?,?,?,?,?,?,00FC4F8F,00000000), ref: 00FFDD88

Strings

SCRIPT, xrefs: 00FC5006

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 6779b655990172ff1f2f1e9a98cd23781cfb98c4692745edf319806a189221e0
Instruction ID: 453c4b1d4e3757597a0bd7a9ba6dd2ce37bf8838bf497287b15bdac9ce4476a7
Opcode Fuzzy Hash: 6779b655990172ff1f2f1e9a98cd23781cfb98c4692745edf319806a189221e0
Instruction Fuzzy Hash: C6119EB5640702BFD7308B29DE89F277BB9EBC9B51F10416CF445C6250DB62E8409660

Uniqueness

Uniqueness Score: -1.00%

Function 01024696 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00FFE7C1), ref: 010246A6
FindFirstFileW.KERNELBASE(?,?), ref: 010246B7
FindClose.KERNEL32(00000000), ref: 010246C7

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 98f695f24a7162bf5592fda5b50f996975b82b070988eab912f594d882d43c4c
Instruction ID: 37b3ec92f0c7a9fb64fec5ccdcdbfaab8485a39dea77a20cd78a3c3be65af292
Opcode Fuzzy Hash: 98f695f24a7162bf5592fda5b50f996975b82b070988eab912f594d882d43c4c
Instruction Fuzzy Hash: 16E0D875910411DB4231663CED8D4EA779C9E09235F000746F9B5C10D0EBB459508696

Uniqueness

Uniqueness Score: -1.00%

Function 00FCE800 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 0100428C

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: ee970642016b393da27784e0135e06b42fc9c2ab0faca62079d49b0576fc8be4
Instruction ID: 5297ed4cb34d90b38388de7a2cd839747039477521cac9ddf7be36d49587ccc5
Opcode Fuzzy Hash: ee970642016b393da27784e0135e06b42fc9c2ab0faca62079d49b0576fc8be4
Instruction Fuzzy Hash: D4A27A75E00206CFDB24CF58C682FADB7B2BB48310F24806DE956AB355D735AC46EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FD0B30 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00FD0BBB
timeGetTime.WINMM ref: 00FD0E76
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00FD0FB3
TranslateMessage.USER32(?), ref: 00FD0FC7
DispatchMessageW.USER32(?), ref: 00FD0FD5
Sleep.KERNEL32(0000000A), ref: 00FD0FDF
LockWindowUpdate.USER32(00000000,?,?), ref: 00FD105A
DestroyWindow.USER32 ref: 00FD1066
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00FD1080
Sleep.KERNEL32(0000000A,?,?), ref: 010052AD
TranslateMessage.USER32(?), ref: 0100608A
DispatchMessageW.USER32(?), ref: 01006098
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 010060AC

Strings

@COM_EVENTOBJ, xrefs: 0100591A
@GUI_CTRLID, xrefs: 01005364
@GUI_WINHANDLE, xrefs: 010053B9
@TRAY_ID, xrefs: 01005BB9
@GUI_CTRLHANDLE, xrefs: 0100540E

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Message$DispatchPeekSleepTranslateWindow$DestroyLockTimeUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4003667617-3242690629
Opcode ID: 44bd5c1be8751ac5c75dc2eceebaf31c82cbae21e20fc6bf7a49a640ee68bc21
Instruction ID: 8b04431ff4398230f04665b2b3875a3a2e1a2cdb1515d251b7b6e5a7ada5dd0a
Opcode Fuzzy Hash: 44bd5c1be8751ac5c75dc2eceebaf31c82cbae21e20fc6bf7a49a640ee68bc21
Instruction Fuzzy Hash: 61B2B070608342DFE725DB24C885BAEBBE5BF84304F18495EE5C987291DB79E844DF82

Uniqueness

Uniqueness Score: -1.00%

Function 010293DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 010291E9: __time64.LIBCMT ref: 010291F3

Part of subcall function 00FC5045: _fseek.LIBCMT ref: 00FC505D

__wsplitpath.LIBCMT ref: 010294BE

Part of subcall function 00FE432E: __wsplitpath_helper.LIBCMT ref: 00FE436E

_wcscpy.LIBCMT ref: 010294D1
_wcscat.LIBCMT ref: 010294E4
__wsplitpath.LIBCMT ref: 01029509
_wcscat.LIBCMT ref: 0102951F
_wcscat.LIBCMT ref: 01029532

Part of subcall function 0102922F: _memmove.LIBCMT ref: 01029268
Part of subcall function 0102922F: _memmove.LIBCMT ref: 01029277

_wcscmp.LIBCMT ref: 01029479

Part of subcall function 010299BE: _wcscmp.LIBCMT ref: 01029AAE
Part of subcall function 010299BE: _wcscmp.LIBCMT ref: 01029AC1

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 010296DC
_wcsncpy.LIBCMT ref: 0102974F
DeleteFileW.KERNEL32(?,?), ref: 01029785
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 0102979B
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 010297AC
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 010297BE

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 88d7ee2cdd6d331282bad9cc486da692ce82f6564673c321b0184e691e4f043d
Instruction ID: b8e90ea47ff0496a2bf5425723b75d4fc1dc49c3c4f714dde03f48f4eca41ad6
Opcode Fuzzy Hash: 88d7ee2cdd6d331282bad9cc486da692ce82f6564673c321b0184e691e4f043d
Instruction Fuzzy Hash: 2AC15DB1E0022AABCF21DF95CD85EDEB7BCEF44304F0040AAE649E7141DB359A848F65

Uniqueness

Uniqueness Score: -1.00%

Function 00FC3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00FC3074
RegisterClassExW.USER32(00000030), ref: 00FC309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00FC30AF
InitCommonControlsEx.COMCTL32(?), ref: 00FC30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00FC30DC
LoadIconW.USER32(000000A9), ref: 00FC30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00FC3101

Strings

TaskbarCreated, xrefs: 00FC30A4
+, xrefs: 00FC305D
AutoIt v3 GUI, xrefs: 00FC3090
0, xrefs: 00FC3056

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 8a27e20540b7131c8287b2abc19cace4abe5b7bd4df7980aab1279f42a57b817
Instruction ID: 695f17142e0a1e6b64fc7be33f82380ae43c24dd97ade277a3552591a2e83e0a
Opcode Fuzzy Hash: 8a27e20540b7131c8287b2abc19cace4abe5b7bd4df7980aab1279f42a57b817
Instruction Fuzzy Hash: 4E3147B585430AEFDB20DFA8D989ACDBBF0FB09310F15426AE5D0E6284D3BA4585CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00FC3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00FC3074
RegisterClassExW.USER32(00000030), ref: 00FC309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00FC30AF
InitCommonControlsEx.COMCTL32(?), ref: 00FC30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00FC30DC
LoadIconW.USER32(000000A9), ref: 00FC30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00FC3101

Strings

TaskbarCreated, xrefs: 00FC30A4
+, xrefs: 00FC305D
AutoIt v3 GUI, xrefs: 00FC3090
0, xrefs: 00FC3056

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: b285edccb5b4f0d2f341bfa5233c8fc22144fa6698f60ced5f9272cefc06cadf
Instruction ID: 6d8b39a90248ac08144463e153dd49d5553cc1a1e3346973c19726ff9e3a23f2
Opcode Fuzzy Hash: b285edccb5b4f0d2f341bfa5233c8fc22144fa6698f60ced5f9272cefc06cadf
Instruction Fuzzy Hash: 3E2115F5914209EFDB20DFA8E988B8DBBF4FB08700F00421AF994E6284D7BB05448F91

Uniqueness

Uniqueness Score: -1.00%

Function 00FC71EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FC4864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,010862F8,?,00FC37C0,?), ref: 00FC4882

Part of subcall function 00FE074F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00FC72C5), ref: 00FE0771

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00FC7308
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00FFECF1
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00FFED32
RegCloseKey.ADVAPI32(?), ref: 00FFED70
_wcscat.LIBCMT ref: 00FFEDC9

Strings

Software\AutoIt v3\AutoIt, xrefs: 00FC72FE
\Include\, xrefs: 00FC72C5
Include, xrefs: 00FFECE8, 00FFED29
\, xrefs: 00FFEDEC

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: fb1fd5f2f89fe7030cac48a9975df9723344ae5a8130a05e43dc6bc5d5c92ddc
Instruction ID: 3ddc24607fafa7327b665c54c71b2f05123a0ad348ca36ddea72f4145ced300d
Opcode Fuzzy Hash: fb1fd5f2f89fe7030cac48a9975df9723344ae5a8130a05e43dc6bc5d5c92ddc
Instruction Fuzzy Hash: 7A718C714083069EC324EF25ED829AFBBE8FF84750F50442EF5C587168EB3A9948DB52

Uniqueness

Uniqueness Score: -1.00%

Function 00FC3A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00FC3A62
LoadCursorW.USER32(00000000,00007F00), ref: 00FC3A71
LoadIconW.USER32(00000063), ref: 00FC3A88
LoadIconW.USER32(000000A4), ref: 00FC3A9A
LoadIconW.USER32(000000A2), ref: 00FC3AAC
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00FC3AD2
RegisterClassExW.USER32(?), ref: 00FC3B28

Part of subcall function 00FC3041: GetSysColorBrush.USER32(0000000F), ref: 00FC3074
Part of subcall function 00FC3041: RegisterClassExW.USER32(00000030), ref: 00FC309E
Part of subcall function 00FC3041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00FC30AF
Part of subcall function 00FC3041: InitCommonControlsEx.COMCTL32(?), ref: 00FC30CC
Part of subcall function 00FC3041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00FC30DC
Part of subcall function 00FC3041: LoadIconW.USER32(000000A9), ref: 00FC30F2
Part of subcall function 00FC3041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00FC3101

Strings

#, xrefs: 00FC3B0D
0, xrefs: 00FC3B06
AutoIt v3, xrefs: 00FC3B17

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: ae247be6ec55a72f8f53348ebbfe315be81a057ccf0b3053a9d73e5a245f56b2
Instruction ID: 550980d93bf49826335b1a934824ba6877e06b94d8f141326e04c16ebeb47cc8
Opcode Fuzzy Hash: ae247be6ec55a72f8f53348ebbfe315be81a057ccf0b3053a9d73e5a245f56b2
Instruction Fuzzy Hash: E5216DB5D04305AFEB20DFA8E949B9D7BB4FB08710F014199F580AA294C3BF55549F80

Uniqueness

Uniqueness Score: -1.00%

Function 00FC3633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00FC36D2
KillTimer.USER32(?,00000001), ref: 00FC36FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00FC371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00FC372A
CreatePopupMenu.USER32 ref: 00FC373E
PostQuitMessage.USER32(00000000), ref: 00FC375F

Strings

TaskbarCreated, xrefs: 00FC3725

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 45b6d7d708c5d502dd9899b82c489eb0771d8099f8e59c56387f9bac9699dc03
Instruction ID: cb74036093f0342933421f5538f685afba281c9a84cf58eb8cfd9794ee107e12
Opcode Fuzzy Hash: 45b6d7d708c5d502dd9899b82c489eb0771d8099f8e59c56387f9bac9699dc03
Instruction Fuzzy Hash: 3041F8F2618107BBDB24AB68EE4BF7D3755FB00390F14411DF68686295CA6F9D00B7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00FC3778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/AutoIt3ExecuteScript, xrefs: 00FC38CE
CMDLINE, xrefs: 00FC3834
/ErrorStdOut, xrefs: 00FC388F
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 00FC37C0
CMDLINERAW, xrefs: 00FC380D
/AutoIt3OutputDebug, xrefs: 00FC38A4
/AutoIt3ExecuteLine, xrefs: 00FC38B9

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 1825951767-3513169116
Opcode ID: 2fe5ee34ba3a5e2832d734ea3d1e362594f1aa26b1036f9113114c3e8442ede0
Instruction ID: 42d73942faf3f7e099cb60b71ace65c8f5adcaddd310caa40fc04a71464456fe
Opcode Fuzzy Hash: 2fe5ee34ba3a5e2832d734ea3d1e362594f1aa26b1036f9113114c3e8442ede0
Instruction Fuzzy Hash: E6A17E72C0422E9ACB14EBA1CD96FEEB778BF14340F04442DF452A7191DF796A09EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00FC39E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00FC3A15
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00FC3A36
ShowWindow.USER32(00000000,?,?), ref: 00FC3A4A
ShowWindow.USER32(00000000,?,?), ref: 00FC3A53

Strings

AutoIt v3, xrefs: 00FC3A0D, 00FC3A12, 00FC3A13
edit, xrefs: 00FC3A30

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 646e8708ae788bc3332677d1b1e664ab5b19ca07c9a11129a261167811363c6b
Instruction ID: 7ebdb3b6ecf06439ea5d9d9ed5fc68bd8a8a48cfb515acc314752cfa6fe6d04b
Opcode Fuzzy Hash: 646e8708ae788bc3332677d1b1e664ab5b19ca07c9a11129a261167811363c6b
Instruction Fuzzy Hash: 70F03AB46442A07FEA305667AC48F2B3E7DE7C6F51B02006EB980E6154C2AF0810CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00FC410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00FFD5EC

Part of subcall function 00FC7D2C: _memmove.LIBCMT ref: 00FC7D66

_memset.LIBCMT ref: 00FC418D
_wcscpy.LIBCMT ref: 00FC41E1
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00FC41F1

Strings

Line: , xrefs: 00FFD615

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: a77c837405a3dd1097a038d360eeaf050098d827406eb49a3b78065598649046
Instruction ID: 24e9563eebccdcd3d755366eb59b60df959d11939afaa08e39a5d241782725ec
Opcode Fuzzy Hash: a77c837405a3dd1097a038d360eeaf050098d827406eb49a3b78065598649046
Instruction Fuzzy Hash: 1431DE71408306AAD331FB60DE47FDE77E8AF44310F14491EB1C492092EF79A648EB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FE564D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00FE56AB
_memcpy_s.LIBCMT ref: 00FE571D
__read_nolock.LIBCMT ref: 00FE577B
__filbuf.LIBCMT ref: 00FE579E
_memset.LIBCMT ref: 00FE57E2

Part of subcall function 00FE8D68: __getptd_noexit.LIBCMT ref: 00FE8D68

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction ID: 8fbf7aabba6e59a3e66e9ebb07997f9bb5e4f8291921101491087935e54d3118
Opcode Fuzzy Hash: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction Fuzzy Hash: A751D631E00B89DBDB249F7BCC8466E77A1AF40B38F248729F835962D1D7749D60AB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FC69CA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FC4F3D: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,010862F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00FC4F6F

_free.LIBCMT ref: 00FFE68C
_free.LIBCMT ref: 00FFE6D3

Part of subcall function 00FC6BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00FC6D0D

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00FFE462
Bad directive syntax error, xrefs: 00FFE6BB

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: 192cc4c49b38670e01f25ca37508027892f18472573d2df61665f2ad1d940de6
Instruction ID: d894aaac13a131cf341749d6745c481dc230da8b20d7a352b559d5710ea98645
Opcode Fuzzy Hash: 192cc4c49b38670e01f25ca37508027892f18472573d2df61665f2ad1d940de6
Instruction Fuzzy Hash: 9B917C7191021EAFCF04EFA4CD91AEDB7B4FF19314B04446DE955EB2A1DB34A904EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00FC35B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00FC35A1,SwapMouseButtons,00000004,?), ref: 00FC35D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,00FC35A1,SwapMouseButtons,00000004,?,?,?,?,00FC2754), ref: 00FC35F5
RegCloseKey.KERNELBASE(00000000,?,?,00FC35A1,SwapMouseButtons,00000004,?,?,?,?,00FC2754), ref: 00FC3617

Strings

Control Panel\Mouse, xrefs: 00FC35D2

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 846fc89c7d1c62e6dba3e3aaec79be5112a943407fee046c241046e3c3151073
Instruction ID: 51b0b8de385be5e9a5db51853e5b14600c4ace1cc4d39fca8759814c0e0a5163
Opcode Fuzzy Hash: 846fc89c7d1c62e6dba3e3aaec79be5112a943407fee046c241046e3c3151073
Instruction Fuzzy Hash: EE115AB5910209BFDB208F68D985EEEB7B8EF44790F018459F805D7200D2729F40B760

Uniqueness

Uniqueness Score: -1.00%

Function 010297E5 Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00FC5045: _fseek.LIBCMT ref: 00FC505D

Part of subcall function 010299BE: _wcscmp.LIBCMT ref: 01029AAE
Part of subcall function 010299BE: _wcscmp.LIBCMT ref: 01029AC1

_free.LIBCMT ref: 0102992C
_free.LIBCMT ref: 01029933
_free.LIBCMT ref: 0102999E

Part of subcall function 00FE2F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00FE9C64), ref: 00FE2FA9
Part of subcall function 00FE2F95: GetLastError.KERNEL32(00000000,?,00FE9C64), ref: 00FE2FBB

_free.LIBCMT ref: 010299A6

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
Instruction ID: 67db03b5e7cc8cf04c06ad7dab76d941683f5e4a7cf60b32a82b1c797136cfbf
Opcode Fuzzy Hash: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
Instruction Fuzzy Hash: A55183B1E04269AFDF249F64CC81B9EBBB9EF48314F00009EF649A7241DB755980CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00FE493A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00FE49D0
__flush.LIBCMT ref: 00FE49F0
__write.LIBCMT ref: 00FE4A23
__flsbuf.LIBCMT ref: 00FE4A51

Part of subcall function 00FE8D68: __getptd_noexit.LIBCMT ref: 00FE8D68

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 6b900c82ae833c016f0ad4fafe5841f230cacf6ecaddb2f96621bb99e00bcb06
Instruction ID: e1889389d640fa65a9388f781399392d8cd151b699414527d1cf581cba6bc81c
Opcode Fuzzy Hash: 6b900c82ae833c016f0ad4fafe5841f230cacf6ecaddb2f96621bb99e00bcb06
Instruction Fuzzy Hash: 66412771A007869BDF28CEABC8809AF77A6EF84770B24817DE855D7641D738FD40AB44

Uniqueness

Uniqueness Score: -1.00%

Function 00FC73E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FFEE62
GetOpenFileNameW.COMDLG32(?), ref: 00FFEEAC

Part of subcall function 00FC48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00FC48A1,?,?,00FC37C0,?), ref: 00FC48CE

Part of subcall function 00FE09D5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00FE09F4

Strings

X, xrefs: 00FFEE7A

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 07f175fb5148739110afa21914a26d7036a4ba6a7fe06e81df59553c8bd85750
Instruction ID: 487e06258b2fe61a18e142f2c93696563fbed220ded97816d43b4f0a6264da1c
Opcode Fuzzy Hash: 07f175fb5148739110afa21914a26d7036a4ba6a7fe06e81df59553c8bd85750
Instruction Fuzzy Hash: 50210531E0028C9BCB15DF94CC46BEE7BF89F49314F00405AE508E7281DBB85A899FA1

Uniqueness

Uniqueness Score: -1.00%

Function 0102901B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 01029036
__fread_nolock.LIBCMT ref: 0102904B

Strings

EA06, xrefs: 0102907D

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 954647f3c50da98899e2b8dd367b92cea36953b4fa2f2367fbf5673d4fe5298c
Instruction ID: b2ec82df62cc72ade451f37bb559ceec6c7709401c63930de1a6b10455563a60
Opcode Fuzzy Hash: 954647f3c50da98899e2b8dd367b92cea36953b4fa2f2367fbf5673d4fe5298c
Instruction Fuzzy Hash: FB01F972904268AEDB28C6A9CC56EEE7BF89B01205F00419EF592D2181E579A704DB60

Uniqueness

Uniqueness Score: -1.00%

Function 01029B6D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 01029B82
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 01029B99

Strings

aut, xrefs: 01029B93

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 34d7c2d742fe6b283b1911b823e99b38a5659b681b63d8e87d0f0679604c786d
Instruction ID: 16243388befa27dc80b4b056e124228f41ada5a43e2b30f4f664d0b07e5355b6
Opcode Fuzzy Hash: 34d7c2d742fe6b283b1911b823e99b38a5659b681b63d8e87d0f0679604c786d
Instruction Fuzzy Hash: 97D05EB994030EBBDB209A94DD4EF9A772CE704700F0042A1BE9496091DEB655988B95

Uniqueness

Uniqueness Score: -1.00%

Function 0103CDF1 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 637166013c82fd67c198acb3cc3ad71192af955735b5e0d688621c6500499624
Instruction ID: 61cd67564388175c8ad3a80955a8f79410de2af0176c1d299b5a9eb982593894
Opcode Fuzzy Hash: 637166013c82fd67c198acb3cc3ad71192af955735b5e0d688621c6500499624
Instruction Fuzzy Hash: EAF17670A083019FC710DF68C984A6ABBE9FFC8314F44896EF8999B251D775E945CF82

Uniqueness

Uniqueness Score: -1.00%

Function 00FCF8CF Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE03A2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00FE03D3
Part of subcall function 00FE03A2: MapVirtualKeyW.USER32(00000010,00000000), ref: 00FE03DB
Part of subcall function 00FE03A2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00FE03E6
Part of subcall function 00FE03A2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00FE03F1
Part of subcall function 00FE03A2: MapVirtualKeyW.USER32(00000011,00000000), ref: 00FE03F9
Part of subcall function 00FE03A2: MapVirtualKeyW.USER32(00000012,00000000), ref: 00FE0401

Part of subcall function 00FD6259: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00FCFA90), ref: 00FD62B4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00FCFB2D
OleInitialize.OLE32(00000000), ref: 00FCFBAA
CloseHandle.KERNEL32(00000000), ref: 010049F2

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: ddca10068eb5e4cbe7ad801cf2310b957ede49741d0830538077be1fc6905c87
Instruction ID: d334abb05db924e4cbbf01e6cefff0216b6e5b586f5238bff6422716886ff552
Opcode Fuzzy Hash: ddca10068eb5e4cbe7ad801cf2310b957ede49741d0830538077be1fc6905c87
Instruction Fuzzy Hash: 1081AAB09092518FC3A4EF7DE65561D7AE6FB58304B12A12EA0D9CB35AEF3F44048F61

Uniqueness

Uniqueness Score: -1.00%

Function 00FC43DB Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FC4401
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00FC44A6
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00FC44C3

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 926db12962b37474f17e24de2e767777cae642431f924951a0a28c3a15aa453e
Instruction ID: b18275480cbe878894999ce26db97c6c7f1c73922c0e10c9478cf288a4ea6092
Opcode Fuzzy Hash: 926db12962b37474f17e24de2e767777cae642431f924951a0a28c3a15aa453e
Instruction Fuzzy Hash: E73181B19087028FD724DF24D595B9BBBE8FB48314F10092EE9DAC7240D77AA948DB52

Uniqueness

Uniqueness Score: -1.00%

Function 00FE594C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00FE5963

Part of subcall function 00FEA3AB: __NMSG_WRITE.LIBCMT ref: 00FEA3D2
Part of subcall function 00FEA3AB: __NMSG_WRITE.LIBCMT ref: 00FEA3DC

__NMSG_WRITE.LIBCMT ref: 00FE596A

Part of subcall function 00FEA408: GetModuleFileNameW.KERNEL32(00000000,010843BA,00000104,?,00000001,00000000), ref: 00FEA49A
Part of subcall function 00FEA408: ___crtMessageBoxW.LIBCMT ref: 00FEA548

Part of subcall function 00FE32DF: ___crtCorExitProcess.LIBCMT ref: 00FE32E5
Part of subcall function 00FE32DF: ExitProcess.KERNEL32 ref: 00FE32EE

Part of subcall function 00FE8D68: __getptd_noexit.LIBCMT ref: 00FE8D68

RtlAllocateHeap.NTDLL(01820000,00000000,00000001,00000000,?,?,?,00FE1013,?), ref: 00FE598F

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 33dde4e94fe22dc4ed22ea4c643a701e2fde8de97ba12c6ef29eab8d76e1a746
Instruction ID: 741993b4b8af1e8693950498cebf28ca4aac03783e8a661a6ad2327e8df99c17
Opcode Fuzzy Hash: 33dde4e94fe22dc4ed22ea4c643a701e2fde8de97ba12c6ef29eab8d76e1a746
Instruction Fuzzy Hash: E701F532604B96DEE6313B67DC46BAD72988F42F78F50002AF444EB2C2DE799D01B365

Uniqueness

Uniqueness Score: -1.00%

Function 01029B2C Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,010297D2,?,?,?,?,?,00000004), ref: 01029B45
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,010297D2,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 01029B5B
CloseHandle.KERNEL32(00000000,?,010297D2,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 01029B62

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: c6a035ff35c1ce27369fbed9d2d75ff67f77e5327293b1935d2e74aaa4a0ebb9
Instruction ID: 458573ec4f9c95db11f1bb362fd686251be51e6ca3db2884bca8c4b1f083baa4
Opcode Fuzzy Hash: c6a035ff35c1ce27369fbed9d2d75ff67f77e5327293b1935d2e74aaa4a0ebb9
Instruction Fuzzy Hash: 77E08636180225B7EB311A58ED49FCA7F58AB06B65F108110FB94690E087B625119798

Uniqueness

Uniqueness Score: -1.00%

Function 01028F97 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 01028FA5

Part of subcall function 00FE2F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00FE9C64), ref: 00FE2FA9
Part of subcall function 00FE2F95: GetLastError.KERNEL32(00000000,?,00FE9C64), ref: 00FE2FBB

_free.LIBCMT ref: 01028FB6
_free.LIBCMT ref: 01028FC8

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 358057a8cee776a4634d1da6a11f7167cf7af4a4bc472a0de26b354d0d310ced
Instruction ID: 7544be8e301855afb99a78005edff81b99916fbf03bedbea9a1562e5c53cca6b
Opcode Fuzzy Hash: 358057a8cee776a4634d1da6a11f7167cf7af4a4bc472a0de26b354d0d310ced
Instruction Fuzzy Hash: 14E0C2A13087904AEAE4A5BDAD00E832BEE0F48211708084FF649DB142EE28E4419024

Uniqueness

Uniqueness Score: -1.00%

Function 00FCAB23 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 0100002B

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 3f584bd57744500cdfce3df872a79ce53d202562ff3a75c6971f6499ba73b8b8
Instruction ID: 3282dafb19a4cf38a3b30b1aa95c3b47e56eb2e16c4bedfde6ca09c8af5e95e4
Opcode Fuzzy Hash: 3f584bd57744500cdfce3df872a79ce53d202562ff3a75c6971f6499ba73b8b8
Instruction Fuzzy Hash: 39226874508346CFD724DF14C996F6ABBE1BF84304F14895DE8868B262DB35EC81EB82

Uniqueness

Uniqueness Score: -1.00%

Function 00FC4DD0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00FC4E1A

Strings

EA06, xrefs: 00FFDCF5

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: 10b2cf6ac5a4a27942d515b5c0f6774d4339fcf1b2a059129d77d32c78d8bb14
Instruction ID: 208bb2447c663bc00762e67ede4b169b6d0280927e29cbfeeb86f88bf7d4d2d0
Opcode Fuzzy Hash: 10b2cf6ac5a4a27942d515b5c0f6774d4339fcf1b2a059129d77d32c78d8bb14
Instruction Fuzzy Hash: FF415E32E041565BDF219B648E73FBE7F66AB41310F19406DEC82DB182C525BD84B3A1

Uniqueness

Uniqueness Score: -1.00%

Function 00FC492E Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00FC4992

Part of subcall function 00FE35AC: __lock.LIBCMT ref: 00FE35B2
Part of subcall function 00FE35AC: DecodePointer.KERNEL32(00000001,?,00FC49A7,010181BC), ref: 00FE35BE
Part of subcall function 00FE35AC: EncodePointer.KERNEL32(?,?,00FC49A7,010181BC), ref: 00FE35C9

Part of subcall function 00FC4A5B: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00FC4A73
Part of subcall function 00FC4A5B: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00FC4A88

Part of subcall function 00FC3B4C: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00FC3B7A
Part of subcall function 00FC3B4C: IsDebuggerPresent.KERNEL32 ref: 00FC3B8C
Part of subcall function 00FC3B4C: GetFullPathNameW.KERNEL32(00007FFF,?,?,010862F8,010862E0,?,?), ref: 00FC3BFD
Part of subcall function 00FC3B4C: SetCurrentDirectoryW.KERNEL32(?), ref: 00FC3C81

SystemParametersInfoW.USER32(00002001,00000000,?,00000002), ref: 00FC49D2

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 72f8ec42bb3368ea17f27a090b10f9c4be89d524b759ca46ef3138f84441f429
Instruction ID: 21c2af2e256dd0d1b67f72190dd14d91393fbede4af31a6c4f358df3f33cc44b
Opcode Fuzzy Hash: 72f8ec42bb3368ea17f27a090b10f9c4be89d524b759ca46ef3138f84441f429
Instruction Fuzzy Hash: 08118E719187129BC310DF29D94AE0EFBE8EB94710F00451EF4C5872A5DBBA9544DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FC5DF9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,00FC5981,?,?,?,?), ref: 00FC5E27
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,00FC5981,?,?,?,?), ref: 00FFE19C

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 33486ab3345960c05a6ec8692f72226ac9958e06dac5eb079a38bf389abc6520
Instruction ID: 84d18bd1ac8362775e5fb2b518be7597c9f8310cca86081aed6e0a5fca63085a
Opcode Fuzzy Hash: 33486ab3345960c05a6ec8692f72226ac9958e06dac5eb079a38bf389abc6520
Instruction Fuzzy Hash: 6401B571644709BFF3240E29CD8BF763B9CEB01B78F108319BAE55A1E0C6B42E859B50

Uniqueness

Uniqueness Score: -1.00%

Function 00FE0FF6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FE594C: __FF_MSGBANNER.LIBCMT ref: 00FE5963
Part of subcall function 00FE594C: __NMSG_WRITE.LIBCMT ref: 00FE596A
Part of subcall function 00FE594C: RtlAllocateHeap.NTDLL(01820000,00000000,00000001,00000000,?,?,?,00FE1013,?), ref: 00FE598F

std::exception::exception.LIBCMT ref: 00FE102C
__CxxThrowException@8.LIBCMT ref: 00FE1041

Part of subcall function 00FE87DB: RaiseException.KERNEL32(?,?,?,0107BAF8,00000000,?,?,?,?,00FE1046,?,0107BAF8,?,00000001), ref: 00FE8830

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 3e6c63bbe38746fbef20076c2a0b88c493ca8a0a1fca6c45a2f40be18104c7b4
Instruction ID: 026f9370e835f24a7cd2fbd39b19f0a4dbe5c7d40804ec36e918eb6c1aa66df7
Opcode Fuzzy Hash: 3e6c63bbe38746fbef20076c2a0b88c493ca8a0a1fca6c45a2f40be18104c7b4
Instruction Fuzzy Hash: 76F0C8359003DDA6CB24BA5BEC159DF7BACAF01361F100426FD08A6691DF758EC1A2E5

Uniqueness

Uniqueness Score: -1.00%

Function 00FE582D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE585C
__lock_file.LIBCMT ref: 00FE587D

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 400d98256557c873ff2c5191cda19c0271313d591977ff5073eb37f24ad8eb01
Instruction ID: dd8c69ca46f146b3a0a1d9a48875774332dff531823be39d04b39107afc3002b
Opcode Fuzzy Hash: 400d98256557c873ff2c5191cda19c0271313d591977ff5073eb37f24ad8eb01
Instruction Fuzzy Hash: 9501AC71C01689EBCF11BF678C0559F7B61AF807A4F144215F8245B161DB35CB12FB51

Uniqueness

Uniqueness Score: -1.00%

Function 00FE55D6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FE8D68: __getptd_noexit.LIBCMT ref: 00FE8D68

__lock_file.LIBCMT ref: 00FE561B

Part of subcall function 00FE6E4E: __lock.LIBCMT ref: 00FE6E71

__fclose_nolock.LIBCMT ref: 00FE5626

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 84f3bd9e84f476ae0f533e076ca0548fd1a36ec49c2c03e2b7e77798d58e281f
Instruction ID: b20910914a39f2b3d17e9706fc6a49a500a9ea1d7aefae49b35bfdedf43b21a3
Opcode Fuzzy Hash: 84f3bd9e84f476ae0f533e076ca0548fd1a36ec49c2c03e2b7e77798d58e281f
Instruction Fuzzy Hash: 49F09072C00A859ADB20BB778C0276E77A16F40B78F558209E428AB1C1CF7C8902BB55

Uniqueness

Uniqueness Score: -1.00%

Function 00FC81C1 Relevance: 2.6, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000001,00000000,00000000,?,?,?,00FC558F,?,?,?,?,?), ref: 00FC81DA
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000001,00000000,?,?,?,00FC558F,?,?,?,?,?), ref: 00FC820D

Part of subcall function 00FC78AD: _memmove.LIBCMT ref: 00FC78E9

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ByteCharMultiWide$_memmove
String ID:
API String ID: 3033907384-0
Opcode ID: f8242d993449c0d8b26b48198ac9df5e5358a5b185c038c831ef7134c2e4b089
Instruction ID: 79c591df5ef61c4e55a787d7c0a0b506a62be1318a3e0e1d0302fb6f61beec27
Opcode Fuzzy Hash: f8242d993449c0d8b26b48198ac9df5e5358a5b185c038c831ef7134c2e4b089
Instruction Fuzzy Hash: 7501A2752012057FEB247A26DE4BFBB3B5CEB85760F10802AFD05CD190DE71D800A671

Uniqueness

Uniqueness Score: -1.00%

Function 00FD2123 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3201ef153737e287dd3ded7083ce763f119b28e8253745f18e53788ac156482d
Instruction ID: 6a67f3f21d65afa720bae448311b13112eb1a2ab7a66186c2d50c71255843cb8
Opcode Fuzzy Hash: 3201ef153737e287dd3ded7083ce763f119b28e8253745f18e53788ac156482d
Instruction Fuzzy Hash: 9D51D531600205AFDF15EB58CD92FAE77E6AF85710F188099F9469B382CB35ED40EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00FC5C4E Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 00FC5CF6

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0edd0e5ed245885d53fc7786f09bd694f9fc12f27fed18987782f4db9a1264fc
Instruction ID: e250512d6f74980b867d2f30c543c9a02284e543238830f07a1208fba834ed3e
Opcode Fuzzy Hash: 0edd0e5ed245885d53fc7786f09bd694f9fc12f27fed18987782f4db9a1264fc
Instruction Fuzzy Hash: A3316D71A00B0AAFCB18CF6DC585B6DB7B1FF48720F148619D81A93710D771B9A0EB90

Uniqueness

Uniqueness Score: -1.00%

Function 010000D6 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 010000E1

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: ac18fb331e97c6c24cdbe88f5afb4a499e505a2e311a2023cf62337dfd33e6af
Instruction ID: 537438aa2eb644e2613f50172a86da0e3d8f775fed40455e92e95ed8daa00d4f
Opcode Fuzzy Hash: ac18fb331e97c6c24cdbe88f5afb4a499e505a2e311a2023cf62337dfd33e6af
Instruction Fuzzy Hash: F8412774908342CFDB25DF19C585F1ABBE0BF45318F09889CE98A4B762C736E845DB52

Uniqueness

Uniqueness Score: -1.00%

Function 00FC4F3D Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC4D13: FreeLibrary.KERNEL32(00000000,?), ref: 00FC4D4D

Part of subcall function 00FE548B: __wfsopen.LIBCMT ref: 00FE5496

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,010862F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00FC4F6F

Part of subcall function 00FC4CC8: FreeLibrary.KERNEL32(00000000), ref: 00FC4D02

Part of subcall function 00FC4DD0: _memmove.LIBCMT ref: 00FC4E1A

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: e2eea9debacd2badac9fc8bb716ceb97386ddce2c13ad754ab799d49c004e554
Instruction ID: 40d317d4d11bebca702011a73ed2594e9e5b6b67d5c8955858d70c54a3169704
Opcode Fuzzy Hash: e2eea9debacd2badac9fc8bb716ceb97386ddce2c13ad754ab799d49c004e554
Instruction Fuzzy Hash: EA11E73260020BABCB14FF74CE67FAE77A59F40711F10842DF941A71C1DA79AA05BBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010001AF Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 010001BB

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: b81107bbc6531b23eef794d3534cd4130c169cceef8fb527e59825649e03a03a
Instruction ID: 6839bc1544fa5c5f571c7a574a3a78f3906c3eaa3694fdcd9b6dcec8c5f32ede
Opcode Fuzzy Hash: b81107bbc6531b23eef794d3534cd4130c169cceef8fb527e59825649e03a03a
Instruction Fuzzy Hash: 0B211FB4908342DFDB25DF65C985F1ABBE0BB84318F04886CE98A47761C735F845DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FC78AD Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00FC78E9

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: e0b0f1feff7007f9a685850875a5a6e1ea6a23f504afe070e1a0459631d1335c
Instruction ID: f8467423fcf37e625351d769e00e603f72f7824498b8ffc306bfb7dcb29fc260
Opcode Fuzzy Hash: e0b0f1feff7007f9a685850875a5a6e1ea6a23f504afe070e1a0459631d1335c
Instruction Fuzzy Hash: 1911A0326093176BD714BB2C9D82F6AB399EF45360B24412EF916C7290DE35AC15AA90

Uniqueness

Uniqueness Score: -1.00%

Function 00FE0941 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00FE09F4

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: acfb2f6243b039b5672768ffc86251c791cf0114a286c1c20b526726435d8d17
Instruction ID: 11bc0a64a54025b714b72df16cf6a38998a267ac1b6246481cb3cf30f0a63168
Opcode Fuzzy Hash: acfb2f6243b039b5672768ffc86251c791cf0114a286c1c20b526726435d8d17
Instruction Fuzzy Hash: 1201807384A2818FC352C774D95A6D03BB6DE5762932801DDDC429A532E5675C13AB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FC5D20 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,00FC5807,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00FC5D76

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: d4a9a9d0ba70d058b370f06285ec8d894eb2f73a0098b7dccdf08dd7fc858e24
Instruction ID: b0c01ff4529aa5a52576b4b4d75a03c56a90b2043c77137b5df0bad612d6ff53
Opcode Fuzzy Hash: d4a9a9d0ba70d058b370f06285ec8d894eb2f73a0098b7dccdf08dd7fc858e24
Instruction Fuzzy Hash: D6115871608B029FD3308F05CA85F62B7E4EB45B20F10892EE8AB86A50D771F984DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00FE4A93 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00FE4AD6

Part of subcall function 00FE8D68: __getptd_noexit.LIBCMT ref: 00FE8D68

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: 4166419d4f7c8d24f6847da06c398fa2ca6d6aa1c68465d1d7776b04350b418c
Instruction ID: 5695d4dfa45f5eeb2f1b3a7ee6eec8b59ea2b1f304bd36bc9a68783e2bb79a04
Opcode Fuzzy Hash: 4166419d4f7c8d24f6847da06c398fa2ca6d6aa1c68465d1d7776b04350b418c
Instruction Fuzzy Hash: 0CF0AF31D40289ABDF61BF668C063AF36A1AF00775F048528F828AA1D1DB7C9A51FF55

Uniqueness

Uniqueness Score: -1.00%

Function 00FC4FAA Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,010862F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00FC4FDE

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: aa627b5eaed96fa83defd2fb009054a3c2deb9ed78f0251f2c0b276501191d28
Instruction ID: c6d90210e7c903356aaf45fa3c339eeda5847e7d4a7ccd7260384860e7cff250
Opcode Fuzzy Hash: aa627b5eaed96fa83defd2fb009054a3c2deb9ed78f0251f2c0b276501191d28
Instruction Fuzzy Hash: ACF015B2505712CFCB389F64E5A5E12BBE1AF043293248A2EE5D683A10C772A840EF40

Uniqueness

Uniqueness Score: -1.00%

Function 00FE09D5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00FE09F4

Part of subcall function 00FC7D2C: _memmove.LIBCMT ref: 00FC7D66

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: b41c44c60b8027eb031677c67fe116006482fe76821e25d5383b1878c17e2755
Instruction ID: b8ae64170d493905cb9766380aa7bb2c89b999c6ed3dad512c24c1df1ec25213
Opcode Fuzzy Hash: b41c44c60b8027eb031677c67fe116006482fe76821e25d5383b1878c17e2755
Instruction Fuzzy Hash: F5E086769052299BC720E5589C06FFA77ADDF88790F0401B5FD4CD7208D9659C818690

Uniqueness

Uniqueness Score: -1.00%

Function 01029129 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0102914B

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 85a266c19ac15f6dd4f37f244161312340f338b31e1d7e5613d3c154e10e17cf
Instruction ID: 52c2e9313693a37e291c8b4e9899284925bd6d27f3b1f403c9eaeeee53cc3c9e
Opcode Fuzzy Hash: 85a266c19ac15f6dd4f37f244161312340f338b31e1d7e5613d3c154e10e17cf
Instruction Fuzzy Hash: BEE092B0104B505FDB798A28D8107E377E0AB06319F00085DF2DA83342EB627841C759

Uniqueness

Uniqueness Score: -1.00%

Function 00FC5DAE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,00FFE16B,?,?,00000000), ref: 00FC5DBF

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: feebc1120ae8911a2392ab6ab9a9b4e264f8ae4216e3b71a4c05ee68a4de55fe
Instruction ID: a589d4ba8fbfbd6a2bbaf5377417d3eb3fda3c3b75315c4c401cd6dc18917300
Opcode Fuzzy Hash: feebc1120ae8911a2392ab6ab9a9b4e264f8ae4216e3b71a4c05ee68a4de55fe
Instruction Fuzzy Hash: 70D0C77464020CBFE710DB84DC46FA9777CD705710F100194FD0456290D6B27D508795

Uniqueness

Uniqueness Score: -1.00%

Function 00FE548B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00FE5496

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 45f44c800f194e76492d40cf083b43dc43a9e5955b87bca747f1a7c98342ac2b
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 33B0927684020C77DE022E82EC02A593B199B40A78F808020FB0C181A2A677A6A0A689

Uniqueness

Uniqueness Score: -1.00%

Function 0100220E Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetTempPathW.KERNELBASE(00000104,?), ref: 0100221A

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: PathTemp
String ID:
API String ID: 2920410445-0
Opcode ID: b92ecb0de9d8a844e977b1f0cae787e5afc9a3e32b79e30edc8e7f9f535dafa2
Instruction ID: 00a6d6629590d338d26a35537d9539abc8d760d1d9793c0dcc7dcfed69efbc2b
Opcode Fuzzy Hash: b92ecb0de9d8a844e977b1f0cae787e5afc9a3e32b79e30edc8e7f9f535dafa2
Instruction Fuzzy Hash: ECC09B7445401A9FF725A754CDD5ABC733CFF00701F0000D5718591080DAF45B80CF11

Uniqueness

Uniqueness Score: -1.00%

Function 0102D2E6 Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 0102D46A

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: da8c174955e33872f040faf99e0cbab9f71fa0aefc425181fab7658de40651b7
Instruction ID: ac1f78c35e8e417bf09744457658355e107d7f20729dbc24c88ff760e764a79f
Opcode Fuzzy Hash: da8c174955e33872f040faf99e0cbab9f71fa0aefc425181fab7658de40651b7
Instruction Fuzzy Hash: 2E7161302083128FC714EF68C991FAAB7E0AF88714F04456DF5968B291DF78ED49DB52

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0104CDAC Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC2612: GetWindowLongW.USER32(?,000000EB), ref: 00FC2623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0104CE50
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0104CE91
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0104CED6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0104CF00
SendMessageW.USER32 ref: 0104CF29
_wcsncpy.LIBCMT ref: 0104CFA1
GetKeyState.USER32(00000011), ref: 0104CFC2
GetKeyState.USER32(00000009), ref: 0104CFCF
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0104CFE5
GetKeyState.USER32(00000010), ref: 0104CFEF
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0104D018
SendMessageW.USER32 ref: 0104D03F
SendMessageW.USER32(?,00001030,?,0104B602), ref: 0104D145
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0104D15B
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0104D16E
SetCapture.USER32(?), ref: 0104D177
ClientToScreen.USER32(?,?), ref: 0104D1DC
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0104D1E9
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0104D203
ReleaseCapture.USER32 ref: 0104D20E
GetCursorPos.USER32(?), ref: 0104D248
ScreenToClient.USER32(?,?), ref: 0104D255
SendMessageW.USER32(?,00001012,00000000,?), ref: 0104D2B1
SendMessageW.USER32 ref: 0104D2DF
SendMessageW.USER32(?,00001111,00000000,?), ref: 0104D31C
SendMessageW.USER32 ref: 0104D34B
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0104D36C
SendMessageW.USER32(?,0000110B,00000009,?), ref: 0104D37B
GetCursorPos.USER32(?), ref: 0104D39B
ScreenToClient.USER32(?,?), ref: 0104D3A8
GetParent.USER32(?), ref: 0104D3C8
SendMessageW.USER32(?,00001012,00000000,?), ref: 0104D431
SendMessageW.USER32 ref: 0104D462
ClientToScreen.USER32(?,?), ref: 0104D4C0
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0104D4F0
SendMessageW.USER32(?,00001111,00000000,?), ref: 0104D51A
SendMessageW.USER32 ref: 0104D53D
ClientToScreen.USER32(?,?), ref: 0104D58F
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0104D5C3

Part of subcall function 00FC25DB: GetWindowLongW.USER32(?,000000EB), ref: 00FC25EC

GetWindowLongW.USER32(?,000000F0), ref: 0104D65F

Strings

F, xrefs: 0104D543
@GUI_DRAGID, xrefs: 0104D1AA

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: ac525ef531fe3aa90499ba84c21edd31074934b4a9b4a202b9f2072b7072d049
Instruction ID: cf7a391e6659eaa18b4db3871dbb4860fb414c74fcaf84db2daa78508a55fc03
Opcode Fuzzy Hash: ac525ef531fe3aa90499ba84c21edd31074934b4a9b4a202b9f2072b7072d049
Instruction Fuzzy Hash: 2D42BEB4205241AFE725DF68C984FAABFE5FF48354F04056DF6D5872A1C736A840CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0104804A Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 571windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 0104873F

Strings

%d/%02d/%02d, xrefs: 01048478

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: 4f19cd9d3ab2d20bb423459ed0cc58e1ae6228f795d9668c1bf3d9c073649047
Instruction ID: d76cf44dc4275493cfdcfb024a090ded35eb1490b16b901f724a6f9dfbf180d4
Opcode Fuzzy Hash: 4f19cd9d3ab2d20bb423459ed0cc58e1ae6228f795d9668c1bf3d9c073649047
Instruction Fuzzy Hash: 8E1213B0500245ABEB259FA8CD89FAE7BF8FF49750F00856AFA95EA191DB748540CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00FD710E Relevance: 48.8, APIs: 19, Strings: 6, Instructions: 5093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00FD75C2
_memset.LIBCMT ref: 00FD76B1
_memmove.LIBCMT ref: 00FD7C4B
_memmove.LIBCMT ref: 00FD7E4F

Strings

Q\E, xrefs: 00FD81C1
[:>:]], xrefs: 00FD760A
\b(?<=\w), xrefs: 01013C41
[:<:]], xrefs: 00FD75F1
DEFINE, xrefs: 010125AF
\b(?=\w), xrefs: 01013C34

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: _memmove$_memset
String ID: DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-1798697756
Opcode ID: af6937b09511c39889588a2e3751a1cd7b8400b7facfab1d037aabcae3de7fe5
Instruction ID: 94fe261d8f19de269f3eca581cbdbd4c11bd9119e01c993aa6ff0a4a9b65a679
Opcode Fuzzy Hash: af6937b09511c39889588a2e3751a1cd7b8400b7facfab1d037aabcae3de7fe5
Instruction Fuzzy Hash: A8939171E00215DBDB24DF98C8817ADB7F1FF48320F2885AAE985EB395E7749981DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00FC4A35 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 00FC4A3D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00FFDA8E
IsIconic.USER32(?), ref: 00FFDA97
ShowWindow.USER32(?,00000009), ref: 00FFDAA4
SetForegroundWindow.USER32(?), ref: 00FFDAAE
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00FFDAC4
GetCurrentThreadId.KERNEL32 ref: 00FFDACB
GetWindowThreadProcessId.USER32(?,00000000), ref: 00FFDAD7
AttachThreadInput.USER32(?,00000000,00000001), ref: 00FFDAE8
AttachThreadInput.USER32(?,00000000,00000001), ref: 00FFDAF0
AttachThreadInput.USER32(00000000,?,00000001), ref: 00FFDAF8
SetForegroundWindow.USER32(?), ref: 00FFDAFB
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FFDB10
keybd_event.USER32(00000012,00000000), ref: 00FFDB1B
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FFDB25
keybd_event.USER32(00000012,00000000), ref: 00FFDB2A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FFDB33
keybd_event.USER32(00000012,00000000), ref: 00FFDB38
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FFDB42
keybd_event.USER32(00000012,00000000), ref: 00FFDB47
SetForegroundWindow.USER32(?), ref: 00FFDB4A
AttachThreadInput.USER32(?,?,00000000), ref: 00FFDB71

Strings

Shell_TrayWnd, xrefs: 00FFDA89

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 2083cab603aae1556ece71562a545e63597b45ebb9a712245bafcf7b99d075a3
Instruction ID: 14f72b0facbe07754ba3db60e6e61433e768529b22ed09ef54b63158d704d455
Opcode Fuzzy Hash: 2083cab603aae1556ece71562a545e63597b45ebb9a712245bafcf7b99d075a3
Instruction Fuzzy Hash: D7319FB5A8031CBBEB306FA59D89F7F3E6CEF44B60F104015FB00EA190C6B55900ABA4

Uniqueness

Uniqueness Score: -1.00%

Function 01018858 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 01018CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 01018D0D
Part of subcall function 01018CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 01018D3A
Part of subcall function 01018CC3: GetLastError.KERNEL32 ref: 01018D47

_memset.LIBCMT ref: 0101889B
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 010188ED
CloseHandle.KERNEL32(?), ref: 010188FE
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 01018915
GetProcessWindowStation.USER32 ref: 0101892E
SetProcessWindowStation.USER32(00000000), ref: 01018938
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 01018952

Part of subcall function 01018713: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,01018851), ref: 01018728
Part of subcall function 01018713: CloseHandle.KERNEL32(?,?,01018851), ref: 0101873A

Strings

, xrefs: 010188AA
winsta0, xrefs: 01018910
default, xrefs: 0101894D

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 4d23d48e9862bc8c8ce690280f6e99cbe4578251b8dcc35a2ec966f13d89bdfb
Instruction ID: f2d3a18f4916b2dc3e1a93db0dfca67da4432a8bfc9c5aac7206bb24898925b7
Opcode Fuzzy Hash: 4d23d48e9862bc8c8ce690280f6e99cbe4578251b8dcc35a2ec966f13d89bdfb
Instruction Fuzzy Hash: 36814FB6D0024ABFEF11DFA8DD44AEE7BB8FF05305F08815AF990A6154D7398A14DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0103425A Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0104F910), ref: 01034284
IsClipboardFormatAvailable.USER32(0000000D), ref: 01034292
GetClipboardData.USER32(0000000D), ref: 0103429A
CloseClipboard.USER32 ref: 010342A6
GlobalLock.KERNEL32(00000000), ref: 010342C2
CloseClipboard.USER32 ref: 010342CC
GlobalUnlock.KERNEL32(00000000,00000000), ref: 010342E1
IsClipboardFormatAvailable.USER32(00000001), ref: 010342EE
GetClipboardData.USER32(00000001), ref: 010342F6
GlobalLock.KERNEL32(00000000), ref: 01034303
GlobalUnlock.KERNEL32(00000000,00000000,?), ref: 01034337
CloseClipboard.USER32 ref: 01034447

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: e28a9b5ff094c309f25d7cae2b2ac6b647dcdfb2250f66e6a6a4a28474e3dc27
Instruction ID: 2d3aa62b0cd9c0d04471d6c602c5da866f350841dd73c84835b4a5c419731c37
Opcode Fuzzy Hash: e28a9b5ff094c309f25d7cae2b2ac6b647dcdfb2250f66e6a6a4a28474e3dc27
Instruction Fuzzy Hash: 58518FB9204303ABD311AF69EE86F6E77ACAF84B00F004529F5D6D6191DF79D9048B62

Uniqueness

Uniqueness Score: -1.00%

Function 0102C9C7 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0102C9F8
FindClose.KERNEL32(00000000), ref: 0102CA4C
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0102CA71
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0102CA88
FileTimeToSystemTime.KERNEL32(?,?), ref: 0102CAAF
__swprintf.LIBCMT ref: 0102CAFB
__swprintf.LIBCMT ref: 0102CB3E

Part of subcall function 00FC7F41: _memmove.LIBCMT ref: 00FC7F82

__swprintf.LIBCMT ref: 0102CB92

Part of subcall function 00FE38D8: __woutput_l.LIBCMT ref: 00FE3931

__swprintf.LIBCMT ref: 0102CBE0

Part of subcall function 00FE38D8: __flsbuf.LIBCMT ref: 00FE3953
Part of subcall function 00FE38D8: __flsbuf.LIBCMT ref: 00FE396B

__swprintf.LIBCMT ref: 0102CC2F
__swprintf.LIBCMT ref: 0102CC7E
__swprintf.LIBCMT ref: 0102CCCD

Strings

%02d, xrefs: 0102CB86, 0102CB90, 0102CBDE, 0102CC2D, 0102CC7C, 0102CCCB
%4d, xrefs: 0102CB38
%4d%02d%02d%02d%02d%02d, xrefs: 0102CAF5

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: c1e10f2127ab2917a274ded19ce4acc0b80eec05fecd2deba20229771951605d
Instruction ID: 04800fd5ec1c840ba9d975b6d8d15e96aed7afb9b3e2009d7fd6e85c1f907847
Opcode Fuzzy Hash: c1e10f2127ab2917a274ded19ce4acc0b80eec05fecd2deba20229771951605d
Instruction Fuzzy Hash: 7CA15FB2408345ABD710EB65CE86EAFB7ECAF84700F40491DF585C3191EB78DA08DB62

Uniqueness

Uniqueness Score: -1.00%

Function 0102F200 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 0102F221
_wcscmp.LIBCMT ref: 0102F236
_wcscmp.LIBCMT ref: 0102F24D
GetFileAttributesW.KERNEL32(?), ref: 0102F25F
SetFileAttributesW.KERNEL32(?,?), ref: 0102F279
FindNextFileW.KERNEL32(00000000,?), ref: 0102F291
FindClose.KERNEL32(00000000), ref: 0102F29C
FindFirstFileW.KERNEL32(*.*,?), ref: 0102F2B8
_wcscmp.LIBCMT ref: 0102F2DF
_wcscmp.LIBCMT ref: 0102F2F6
SetCurrentDirectoryW.KERNEL32(?), ref: 0102F308
SetCurrentDirectoryW.KERNEL32(0107A5A0), ref: 0102F326
FindNextFileW.KERNEL32(00000000,00000010), ref: 0102F330
FindClose.KERNEL32(00000000), ref: 0102F33D
FindClose.KERNEL32(00000000), ref: 0102F34F

Strings

*.*, xrefs: 0102F2B3

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 60c071c229fd0a523425075cadbbba6cf034fa3a5a88ad1f9ad5fea67eea62dd
Instruction ID: 686070ed8eac03766aafa56be816abe9fc7ff8f429e043015ccfc10f2b6a7368
Opcode Fuzzy Hash: 60c071c229fd0a523425075cadbbba6cf034fa3a5a88ad1f9ad5fea67eea62dd
Instruction Fuzzy Hash: 5931F97660022B6FDB20DAB9DC9CEDE7BFC9F092A1F148195E980D3050EB35DA45CB64

Uniqueness

Uniqueness Score: -1.00%

Function 01040AE2 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 01040BDE
RegCreateKeyExW.ADVAPI32(?,?,00000000,0104F910,00000000,?,00000000,?,?), ref: 01040C4C
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 01040C94
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 01040D1D
RegCloseKey.ADVAPI32(?), ref: 0104103D
RegCloseKey.ADVAPI32(00000000), ref: 0104104A

Strings

REG_EXPAND_SZ, xrefs: 01040CBA
REG_DWORD, xrefs: 01040F0E
REG_MULTI_SZ, xrefs: 01040E05
REG_BINARY, xrefs: 01040FD8
REG_SZ, xrefs: 01040D5B
REG_QWORD, xrefs: 01040F8B

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 25362f91f9d0f4eecfd793fbe395624522fce6755e6cdbaf0cab4e741e84e3b1
Instruction ID: 5644c0fb82c1db8ac7f48d6071cf2f06e349d3268ace53f17e3408ee76d3b2dc
Opcode Fuzzy Hash: 25362f91f9d0f4eecfd793fbe395624522fce6755e6cdbaf0cab4e741e84e3b1
Instruction Fuzzy Hash: EB028D752046029FCB14EF29C985E2AB7E5FF88710F05846DF98A9B761CB79EC40DB81

Uniqueness

Uniqueness Score: -1.00%

Function 0102F35D Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 0102F37E
_wcscmp.LIBCMT ref: 0102F393
_wcscmp.LIBCMT ref: 0102F3AA

Part of subcall function 010245C1: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 010245DC

FindNextFileW.KERNEL32(00000000,?), ref: 0102F3D9
FindClose.KERNEL32(00000000), ref: 0102F3E4
FindFirstFileW.KERNEL32(*.*,?), ref: 0102F400
_wcscmp.LIBCMT ref: 0102F427
_wcscmp.LIBCMT ref: 0102F43E
SetCurrentDirectoryW.KERNEL32(?), ref: 0102F450
SetCurrentDirectoryW.KERNEL32(0107A5A0), ref: 0102F46E
FindNextFileW.KERNEL32(00000000,00000010), ref: 0102F478
FindClose.KERNEL32(00000000), ref: 0102F485
FindClose.KERNEL32(00000000), ref: 0102F497

Strings

*.*, xrefs: 0102F3FB

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: e903157c0471cabe1a25a234ac2d283f1b97de4a99cf8da0490ca80ea98ae7bd
Instruction ID: 3939c2a3638435939f8bf36f501735eaf98bf1be64ee9c045d5c057bac3ef404
Opcode Fuzzy Hash: e903157c0471cabe1a25a234ac2d283f1b97de4a99cf8da0490ca80ea98ae7bd
Instruction Fuzzy Hash: C631FA7550122B6FDB20AA79DC88ADE7BFC9F092A1F144195E9C0D3090DB75DA44CB64

Uniqueness

Uniqueness Score: -1.00%

Function 010181F7 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0101874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 01018766
Part of subcall function 0101874A: GetLastError.KERNEL32(?,0101822A,?,?,?), ref: 01018770
Part of subcall function 0101874A: GetProcessHeap.KERNEL32(00000008,?,?,0101822A,?,?,?), ref: 0101877F
Part of subcall function 0101874A: HeapAlloc.KERNEL32(00000000,?,0101822A,?,?,?), ref: 01018786
Part of subcall function 0101874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0101879D

Part of subcall function 010187E7: GetProcessHeap.KERNEL32(00000008,01018240,00000000,00000000,?,01018240,?), ref: 010187F3
Part of subcall function 010187E7: HeapAlloc.KERNEL32(00000000,?,01018240,?), ref: 010187FA
Part of subcall function 010187E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,01018240,?), ref: 0101880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 0101825B
_memset.LIBCMT ref: 01018270
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 0101828F
GetLengthSid.ADVAPI32(?), ref: 010182A0
GetAce.ADVAPI32(?,00000000,?), ref: 010182DD
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 010182F9
GetLengthSid.ADVAPI32(?), ref: 01018316
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 01018325
HeapAlloc.KERNEL32(00000000), ref: 0101832C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 0101834D
CopySid.ADVAPI32(00000000), ref: 01018354
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 01018385
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 010183AB
SetUserObjectSecurity.USER32(?,00000004,?), ref: 010183BF

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 7d7c97a0aaa8a2bdcd1d8b958af619b8327b0464e6248441c246e5fdda5ad538
Instruction ID: cbc3c99b3c2c163c81f0aa440f22402fb584fbc30612cffd72df5bc753cf1182
Opcode Fuzzy Hash: 7d7c97a0aaa8a2bdcd1d8b958af619b8327b0464e6248441c246e5fdda5ad538
Instruction Fuzzy Hash: 0F617C7590020AAFDF14DFA8DD84AEEBBB9FF04200F04C15AF955A7294DB399A01DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00FD6843 Relevance: 18.4, Strings: 14, Instructions: 883COMMON

Download Yara Rule

Strings

UTF), xrefs: 01011533
LF), xrefs: 010116DD
UTF16), xrefs: 01011508
UCP), xrefs: 01011546
BSR_UNICODE), xrefs: 01011771
NO_START_OPT), xrefs: 01011588
CR), xrefs: 010116C0
ANYCRLF), xrefs: 01011734
LIMIT_RECURSION=, xrefs: 01011635
NO_AUTO_POSSESS), xrefs: 01011567
LIMIT_MATCH=, xrefs: 010115A9
ANY), xrefs: 01011717
BSR_ANYCRLF), xrefs: 01011757
CRLF), xrefs: 010116FA

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-4052911093
Opcode ID: d73192275475527b772414cfc022a9a27a5cebfc8bd198e66f15e2178d571af4
Instruction ID: e5c79fd77671ef6b50e43699bc5fdbddfce0d7b9d3d395c88f89725d30e1da84
Opcode Fuzzy Hash: d73192275475527b772414cfc022a9a27a5cebfc8bd198e66f15e2178d571af4
Instruction Fuzzy Hash: 81727271E00219DBDB18CF68D8807ADB7F6FF48310F1881AAE999EB394D7749941DB90

Uniqueness

Uniqueness Score: -1.00%

Function 01040665 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 010410A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,01040038,?,?), ref: 010410BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 01040737

Part of subcall function 00FC9997: __itow.LIBCMT ref: 00FC99C2
Part of subcall function 00FC9997: __swprintf.LIBCMT ref: 00FC9A0C

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 010407D6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 0104086E
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 01040AAD
RegCloseKey.ADVAPI32(00000000), ref: 01040ABA

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 923e07b90a1672b3b6d2e638dfb02080ff336c966824e549391109d21781f97b
Instruction ID: f70d9755ba02cd4900e7ca3394f76d2c4441ee153bae463e918ddd4d3ef57441
Opcode Fuzzy Hash: 923e07b90a1672b3b6d2e638dfb02080ff336c966824e549391109d21781f97b
Instruction Fuzzy Hash: 9FE17D71204201AFCB14DF29C985E6ABBE8FF88714F04896DF58ADB265DB35ED01CB52

Uniqueness

Uniqueness Score: -1.00%

Function 01020219 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 01020241
GetAsyncKeyState.USER32(000000A0), ref: 010202C2
GetKeyState.USER32(000000A0), ref: 010202DD
GetAsyncKeyState.USER32(000000A1), ref: 010202F7
GetKeyState.USER32(000000A1), ref: 0102030C
GetAsyncKeyState.USER32(00000011), ref: 01020324
GetKeyState.USER32(00000011), ref: 01020336
GetAsyncKeyState.USER32(00000012), ref: 0102034E
GetKeyState.USER32(00000012), ref: 01020360
GetAsyncKeyState.USER32(0000005B), ref: 01020378
GetKeyState.USER32(0000005B), ref: 0102038A

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 4e4376f95228cecdb01f4a859161e98994454f8e2af295aceb2d645ca9fe7fc6
Instruction ID: 16d72109504159aa8d68255a0692aa95314a5acb8e9e5675f0c02747c5431e97
Opcode Fuzzy Hash: 4e4376f95228cecdb01f4a859161e98994454f8e2af295aceb2d645ca9fe7fc6
Instruction Fuzzy Hash: 9241D9746047DA6FFFB28A6C84043A6BEE46F02340F08C0DEE6C6461C7E7A555C887A2

Uniqueness

Uniqueness Score: -1.00%

Function 01034458 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0103447F
EmptyClipboard.USER32 ref: 01034485
GlobalAlloc.KERNEL32(00000002,?), ref: 0103449A
CloseClipboard.USER32 ref: 01034539

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 4edd8424470326145187b7c63c67b6918bbfcc0992eb6f8fa72c19e5646d80ce
Instruction ID: ff00440354aff274a7889ec3aa26606ad20f242f3b4e5cee167302bf36aa03d2
Opcode Fuzzy Hash: 4edd8424470326145187b7c63c67b6918bbfcc0992eb6f8fa72c19e5646d80ce
Instruction Fuzzy Hash: A221C9793006129FDB219F69ED49F6E77A8EF44711F00805AF9C6CB2A5CB7AAD00CB54

Uniqueness

Uniqueness Score: -1.00%

Function 01023A2B Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00FC48A1,?,?,00FC37C0,?), ref: 00FC48CE

Part of subcall function 01024CD3: GetFileAttributesW.KERNEL32(?,01023947), ref: 01024CD4

FindFirstFileW.KERNEL32(?,?), ref: 01023ADF
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 01023B87
MoveFileW.KERNEL32(?,?), ref: 01023B9A
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 01023BB7
FindNextFileW.KERNEL32(00000000,00000010), ref: 01023BD9
FindClose.KERNEL32(00000000,?,?,?,?), ref: 01023BF5

Strings

\*.*, xrefs: 01023A8A, 01023A93, 01023AA8

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: e809285fdd4d1f4d859d581d2092fc540d561f50c790a3872bbc04e4bee407c0
Instruction ID: 8d728da8082c0e0aacb50baf8b73efd5e22c0386ce3ecf41c9f253a5613f705c
Opcode Fuzzy Hash: e809285fdd4d1f4d859d581d2092fc540d561f50c790a3872bbc04e4bee407c0
Instruction Fuzzy Hash: F851633180125E9ACF15FBA4CE93EEDB7B9AF18300F6441A9E58177091DF296F09DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0102F65E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC7F41: _memmove.LIBCMT ref: 00FC7F82

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 0102F6AB
Sleep.KERNEL32(0000000A), ref: 0102F6DB
_wcscmp.LIBCMT ref: 0102F6EF
_wcscmp.LIBCMT ref: 0102F70A
FindNextFileW.KERNEL32(?,?), ref: 0102F7A8
FindClose.KERNEL32(00000000), ref: 0102F7BE

Strings

*.*, xrefs: 0102F690

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: b96f26b71a3398369e53755199956d194531c205281088f395129195008c141f
Instruction ID: b4511ec4f0967d16eae9e63b47c205abb70f5c38c89cfd50c0269488e35bf9cb
Opcode Fuzzy Hash: b96f26b71a3398369e53755199956d194531c205281088f395129195008c141f
Instruction Fuzzy Hash: 6F41AF7190021B9FDF61EF68CD89EEEBBB4FF05350F14459AE894A3190DB359A44CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FD4140 Relevance: 11.6, APIs: 1, Strings: 5, Instructions: 1132COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00FD44DB
ERCP, xrefs: 00FD421F
VUUU, xrefs: 00FD44ED
VUUU, xrefs: 01007B0C
VUUU, xrefs: 00FD4520

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: ce4d4ba344302b3f548ed25106c882fd932786b3949d59985f5d90bcc83d188c
Instruction ID: 6d0aed1e80f38552843c95dba0625cc776b3b4847f380836ce0cdb9abde9d2ca
Opcode Fuzzy Hash: ce4d4ba344302b3f548ed25106c882fd932786b3949d59985f5d90bcc83d188c
Instruction Fuzzy Hash: C5A27371D0021ACBEF25CF58C9907ADB7B2BF44314F1881AAD996A7380D734AD81EF51

Uniqueness

Uniqueness Score: -1.00%

Function 00FD58C0 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00FD5A05
_memmove.LIBCMT ref: 00FD5A55
_memmove.LIBCMT ref: 00FD5ABB

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: c2e79364b10affa515c9f27663765791ea0a369afa3862ce77f88e457dfef4e6
Instruction ID: d3cf0c596feb3439809623000febf15a9dc83b4fa80f432ab40f158443feb1d4
Opcode Fuzzy Hash: c2e79364b10affa515c9f27663765791ea0a369afa3862ce77f88e457dfef4e6
Instruction Fuzzy Hash: 8A12DE70A0060ADFDF14DFA5C981AEEB7F6FF48300F14412AE486A7255EB3AAD51DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0102545F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 01018CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 01018D0D
Part of subcall function 01018CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 01018D3A
Part of subcall function 01018CC3: GetLastError.KERNEL32 ref: 01018D47

ExitWindowsEx.USER32(?,00000000), ref: 0102549B

Strings

, xrefs: 01025489
@, xrefs: 0102548E
SeShutdownPrivilege, xrefs: 0102546B

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 609d7be520e32b907b5bc78627caeb05ccfc0700cdefe409fb7f77605f2dfcf1
Instruction ID: 418a9fd985b55aabd1ad42c4fb03464bd9f1e1d9ad76c31af52627156763ea5b
Opcode Fuzzy Hash: 609d7be520e32b907b5bc78627caeb05ccfc0700cdefe409fb7f77605f2dfcf1
Instruction Fuzzy Hash: 53014C71B562325BF778567CDC4ABFAF2A8EB0425BF140061FDC6D60C2DE954C004298

Uniqueness

Uniqueness Score: -1.00%

Function 01036596 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006), ref: 010365EF
WSAGetLastError.WSOCK32(00000000), ref: 010365FE
bind.WSOCK32(00000000,?,00000010), ref: 0103661A
listen.WSOCK32(00000000,00000005), ref: 01036629
WSAGetLastError.WSOCK32(00000000), ref: 01036643
closesocket.WSOCK32(00000000), ref: 01036657

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: af4e7968fa7737151c244c702d1442d8703d87b9c0b8002882b3898e6d7b186a
Instruction ID: 11e8c4d10e74779b4ffe6241e5017376a03e0c6286f5b1154717eb0dbabc26f0
Opcode Fuzzy Hash: af4e7968fa7737151c244c702d1442d8703d87b9c0b8002882b3898e6d7b186a
Instruction Fuzzy Hash: 4F21C375200211AFDB10EF68C989F6EB7E9EF89310F118159E996E72C1CB79AD00DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00FD5680 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00FE0FF6: std::exception::exception.LIBCMT ref: 00FE102C
Part of subcall function 00FE0FF6: __CxxThrowException@8.LIBCMT ref: 00FE1041

_memmove.LIBCMT ref: 0101062F
_memmove.LIBCMT ref: 01010744
_memmove.LIBCMT ref: 010107EB

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 2d0bd0cb506cae6fe4160692d8f56ad1ced91bd3a7c6ae0c69fc6366ab99ac78
Instruction ID: 818234a8f8e011390c694e351e11cbed824b95407c721fa405e3feb0e965a6b5
Opcode Fuzzy Hash: 2d0bd0cb506cae6fe4160692d8f56ad1ced91bd3a7c6ae0c69fc6366ab99ac78
Instruction Fuzzy Hash: D002AF70E00209DBDF04DF65D981AAEBBB5FF44300F1480A9F886DB259EB39DA51DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FC1287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00FC2612: GetWindowLongW.USER32(?,000000EB), ref: 00FC2623

DefDlgProcW.USER32(?,?,?,?,?), ref: 00FC19FA
GetSysColor.USER32(0000000F), ref: 00FC1A4E
SetBkColor.GDI32(?,00000000), ref: 00FC1A61

Part of subcall function 00FC1290: DefDlgProcW.USER32(?,00000020,?), ref: 00FC12D8

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: e06de5c28f90fe10f5a008b3aa09b0fb121bda40bc8f05f05b6e044d7432903d
Instruction ID: 60dcac6c8343017f4a808803fcbbcebfbd4de1c7e473f93980601c454f91dc40
Opcode Fuzzy Hash: e06de5c28f90fe10f5a008b3aa09b0fb121bda40bc8f05f05b6e044d7432903d
Instruction Fuzzy Hash: 74A13BB250644BBAE734AA298E86FBF355CFF83361B14011DF542D5197CA2DCC21B2B1

Uniqueness

Uniqueness Score: -1.00%

Function 01036A5A Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 010380A0: inet_addr.WSOCK32(00000000), ref: 010380CB

socket.WSOCK32(00000002,00000002,00000011), ref: 01036AB1
WSAGetLastError.WSOCK32(00000000), ref: 01036ADA
bind.WSOCK32(00000000,?,00000010), ref: 01036B13
WSAGetLastError.WSOCK32(00000000), ref: 01036B20
closesocket.WSOCK32(00000000), ref: 01036B34

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 5ea990b164cf006b5a803eb20f9651491d1da73bd9b919cdbfe05e383be22c97
Instruction ID: 5e3f3a81d71d31ed16d5df46e5d03533cfb8702d53b15bf5cadbdb36ed159ef6
Opcode Fuzzy Hash: 5ea990b164cf006b5a803eb20f9651491d1da73bd9b919cdbfe05e383be22c97
Instruction Fuzzy Hash: C341D475700611AFEB10AF68DD87F6E77E8DB44B10F04805CF95AAB3C2CAB99D019B91

Uniqueness

Uniqueness Score: -1.00%

Function 010455FD Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 0104564C
IsWindowEnabled.USER32 ref: 0104565A
GetForegroundWindow.USER32(?,?,00000001), ref: 01045667
IsIconic.USER32 ref: 01045675
IsZoomed.USER32 ref: 01045683

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 0c6ba2f2ff1c0ef33c991350af335a0866f2c2090dcab3a4529017aba78642f0
Instruction ID: cdecad418fbc24b8134fb1da9768c0e65accc14b1443b0cf249b530e14c1acbe
Opcode Fuzzy Hash: 0c6ba2f2ff1c0ef33c991350af335a0866f2c2090dcab3a4529017aba78642f0
Instruction Fuzzy Hash: C011C4B53005126FE7216F2AED85B2F7BD8EF48721F004079F986D7241CB799901CAA4

Uniqueness

Uniqueness Score: -1.00%

Function 0102C602 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0102C69D
CoCreateInstance.OLE32(01052D6C,00000000,00000001,01052BDC,?), ref: 0102C6B5

Part of subcall function 00FC7F41: _memmove.LIBCMT ref: 00FC7F82

CoUninitialize.OLE32 ref: 0102C922

Strings

.lnk, xrefs: 0102C631, 0102C659, 0102C663

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 5b7b8ec9b1fd3fa00e24f41ca6f459f69271d40191baae30a5cbf1adf9cf892b
Instruction ID: a37d6b5d580fcba3039c69bc45ac0d9789697d2e82e10a154eac293cd047ce23
Opcode Fuzzy Hash: 5b7b8ec9b1fd3fa00e24f41ca6f459f69271d40191baae30a5cbf1adf9cf892b
Instruction Fuzzy Hash: 07A12B71108206AFD300EF64CD86EABB7ECEF94704F00495CF1969B191DBB5EA49DB92

Uniqueness

Uniqueness Score: -1.00%

Function 0103C304 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,01001D88,?), ref: 0103C312
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0103C324

Strings

kernel32.dll, xrefs: 0103C30D
GetSystemWow64DirectoryW, xrefs: 0103C31E

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: b7bfd4939f32a719189c1fd0dfd7bdd004432492a437b920ad822114fe921d5c
Instruction ID: 40edbbd27e4d94a04ec065bce403fa941952ea2782a458e9590f97154eca3de8
Opcode Fuzzy Hash: b7bfd4939f32a719189c1fd0dfd7bdd004432492a437b920ad822114fe921d5c
Instruction Fuzzy Hash: 97E0C2F8600303CFEB314F2EC654A5676D8EF49244B80C86EE8C5E6220E774D440CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00FD3190 Relevance: 6.6, APIs: 4, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 349ff4fa9969f749814043608256d93e6a262671b2bc5796f35dd36985cfc38c
Instruction ID: a01408d7bc764e4b2ab223ee1cb3882b98f1bbee04edb1f2963b09d7db0a1c04
Opcode Fuzzy Hash: 349ff4fa9969f749814043608256d93e6a262671b2bc5796f35dd36985cfc38c
Instruction Fuzzy Hash: 9622AC715083029FD725DF28C881B6EB7E5AF84710F08491EF6CA97391DB79EA04DB92

Uniqueness

Uniqueness Score: -1.00%

Function 0103F121 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0103F151
Process32FirstW.KERNEL32(00000000,?), ref: 0103F15F

Part of subcall function 00FC7F41: _memmove.LIBCMT ref: 00FC7F82

Process32NextW.KERNEL32(00000000,?), ref: 0103F21F
CloseHandle.KERNEL32(00000000,?,?,?), ref: 0103F22E

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 16d31f0e3117a9a76ca501ab0d0f5f437b215ccfe91edfbb3dfe0851dce34373
Instruction ID: 6adf5865106df99ed537fce1726483b9c8b64f0b2a5ebf21400516673e7fb9bd
Opcode Fuzzy Hash: 16d31f0e3117a9a76ca501ab0d0f5f437b215ccfe91edfbb3dfe0851dce34373
Instruction Fuzzy Hash: 6C517C71508302AFD320EF24DD86F6BBBE8AF94B10F10481DF59597291EB74A908DB92

Uniqueness

Uniqueness Score: -1.00%

Function 0101EB07 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 0101EB19

Strings

|, xrefs: 0101EB49
(, xrefs: 0101EB5F

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 9c9fb7998dcfd7a1576682584508fae2600774cb50efd8ccf09f328040b6ec3d
Instruction ID: b26db33889195eb5d1dfa31da0068ffb512770c78ad7bd6ef41c26896c46a2bd
Opcode Fuzzy Hash: 9c9fb7998dcfd7a1576682584508fae2600774cb50efd8ccf09f328040b6ec3d
Instruction Fuzzy Hash: D8323775A007059FDB29CF19C480A6AB7F1FF48320B15C5AEE99ADB3A5D770E981CB40

Uniqueness

Uniqueness Score: -1.00%

Function 010325E2 Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000), ref: 010326D5
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 0103270C

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 3533d870c81066f7cfe1a451e9b01deffcf53a2d827fbf6a43738ab8505ae3f0
Instruction ID: c8a82743eda69aaa03e3586e052f85ac36674788dffb5c9dbd68fb0ef6c998cb
Opcode Fuzzy Hash: 3533d870c81066f7cfe1a451e9b01deffcf53a2d827fbf6a43738ab8505ae3f0
Instruction Fuzzy Hash: 0741F375900209BFEB21DA59DD84EBFB7FCFF84724F0040AAF681A6140EB759E41A650

Uniqueness

Uniqueness Score: -1.00%

Function 0102B59E Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0102B5AE
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 0102B608
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 0102B655

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 61fc4eb641d221a986bc50570dc1fdef5a9951ffc4c17543d8cf2a05472f20e6
Instruction ID: a27a5ea0a3137b503f3548f7ed8cbebe455fd9510af48fa5b3891837dc1c83b0
Opcode Fuzzy Hash: 61fc4eb641d221a986bc50570dc1fdef5a9951ffc4c17543d8cf2a05472f20e6
Instruction Fuzzy Hash: 30219D75A00519EFCB00EFA5D984EEEBBB8FF48310F0480A9E945AB351CB35A905CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01018CC3 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00FE0FF6: std::exception::exception.LIBCMT ref: 00FE102C
Part of subcall function 00FE0FF6: __CxxThrowException@8.LIBCMT ref: 00FE1041

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 01018D0D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 01018D3A
GetLastError.KERNEL32 ref: 01018D47

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: e66b01a689c91c1f91832bec79c0b190bf10a0108888b7abb50c3cef02654fc9
Instruction ID: 97f06949b3006621c2cd7708e033babfa29bb43e7a8add5e6fbff29093e3c3dc
Opcode Fuzzy Hash: e66b01a689c91c1f91832bec79c0b190bf10a0108888b7abb50c3cef02654fc9
Instruction Fuzzy Hash: 5311BFB1414309AFE328AF58DC85D6BB7F9FB44710B10C52EF89683205EB74A9408B60

Uniqueness

Uniqueness Score: -1.00%

Function 01024021 Relevance: 4.6, APIs: 3, Instructions: 61fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0102404B
DeviceIoControl.KERNEL32(00000000,002D1400,00000007,0000000C,?,0000000C,?,00000000), ref: 01024088
CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 01024091

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 63786eeb24ba6042bc4f869ee99f1e54509c31de85d9c64c0a5617903cdeb824
Instruction ID: bfd208df7a634348a006ba66b23d9460a964fadaeb38642e1589d0a2d53e02e0
Opcode Fuzzy Hash: 63786eeb24ba6042bc4f869ee99f1e54509c31de85d9c64c0a5617903cdeb824
Instruction Fuzzy Hash: B8117CB1D00239BEE7209AECDC84FAFBBBCEB08610F000656FA44E7181C2B9594487A1

Uniqueness

Uniqueness Score: -1.00%

Function 01024C03 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 01024C2C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 01024C43
FreeSid.ADVAPI32(?), ref: 01024C53

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: ffa8cfe6bbd20d0c91a92372532dcf7b5967a96dd7e05e436f935a25ce6f5ae5
Instruction ID: a1b0f4fcd513d41c1f68377624c3015b73edb64253f0d9ff37d01260e1757e2b
Opcode Fuzzy Hash: ffa8cfe6bbd20d0c91a92372532dcf7b5967a96dd7e05e436f935a25ce6f5ae5
Instruction Fuzzy Hash: 09F04F7591130DBFDF14DFF4D989AAEBBBCEF08201F5044A9A501E2180D6756A048B50

Uniqueness

Uniqueness Score: -1.00%

Function 00FCE060 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0effa848c7a6107863907d51b7cbc2a48dcc76f5865251bce444b459384c8f5c
Instruction ID: dd51dfcd61b2fca17bc32c948e80d40c6eeec90229df8f61c43261cef8826180
Opcode Fuzzy Hash: 0effa848c7a6107863907d51b7cbc2a48dcc76f5865251bce444b459384c8f5c
Instruction Fuzzy Hash: 1A22AD75E00216CFDB24DF58C682BAABBB0FF04310F14846DE9969B381D735A985EB91

Uniqueness

Uniqueness Score: -1.00%

Function 01024F21 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 01024F55

Strings

DOWN, xrefs: 01024F3A

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: mouse_event
String ID: DOWN
API String ID: 2434400541-711622031
Opcode ID: 88bbd8902e5fa89b9fda8dd0d1e4af77c0054c08023beb91385a65d191e85fca
Instruction ID: 1f014c770f08fdc9cab9f959315ed8c185247ca3a4ed43ac93b13e6c385a40f5
Opcode Fuzzy Hash: 88bbd8902e5fa89b9fda8dd0d1e4af77c0054c08023beb91385a65d191e85fca
Instruction Fuzzy Hash: 47E0CD7555C7B23CB99425197C0FEF713CC8B52131F11028AF990D50C1ED992C8215FC

Uniqueness

Uniqueness Score: -1.00%

Function 0102C93C Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0102C966
FindClose.KERNEL32(00000000), ref: 0102C996

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 67155c26f9ed0075b050eaa3cd3876e890c3927671875a965440b7338ba93f84
Instruction ID: 1f45282fd0ea2f80dc9cc3b2f6e7eab774d90da47bcc0048eace0ce2b81707d4
Opcode Fuzzy Hash: 67155c26f9ed0075b050eaa3cd3876e890c3927671875a965440b7338ba93f84
Instruction Fuzzy Hash: D9118E766046119FD710EF29D949A2AF7E9EF84324F00851EF8A9C7291DB78AC00CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0102A2D5 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,0103977D,?,0104FB84,?), ref: 0102A302
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,0103977D,?,0104FB84,?), ref: 0102A314

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: ca9420f4a99797674ea6f41933d8bc993e2c81d4fb69159c02159e0a1a8d8d9a
Instruction ID: f0804ff3c79286de3a0bdc51ba6936777327e160e4453cb8ce82ed3ffd2198db
Opcode Fuzzy Hash: ca9420f4a99797674ea6f41933d8bc993e2c81d4fb69159c02159e0a1a8d8d9a
Instruction Fuzzy Hash: 45F0893554422DE7D721AEA4CC49FEA776DBF08751F008155F948D7141DA749544CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 01018713 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,01018851), ref: 01018728
CloseHandle.KERNEL32(?,?,01018851), ref: 0101873A

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 5ea808e7feb2602fa0a7ad6ce1bf4470fc56999dfaae3d25cd21f78d65daf52b
Instruction ID: 9dfc3e782e16a8657f64e9e64431520e6eaafbd23fa0d38e975d88bc693af7a1
Opcode Fuzzy Hash: 5ea808e7feb2602fa0a7ad6ce1bf4470fc56999dfaae3d25cd21f78d65daf52b
Instruction Fuzzy Hash: 06E04676000641EFE7712B26ED08D73BBE9FB003507108829B99680834CB36AC90EB10

Uniqueness

Uniqueness Score: -1.00%

Function 00FEA395 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00FE8F97,?,?,?,00000001), ref: 00FEA39A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00FEA3A3

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b23b5e83bd0310d7bf37c586638e2c19fa78cace12fccb80073330dbeaeef515
Instruction ID: bb07037f817804cbf8aa4bb7de2f176aa55bf24a310ff98fa8e38a3ff17c59e7
Opcode Fuzzy Hash: b23b5e83bd0310d7bf37c586638e2c19fa78cace12fccb80073330dbeaeef515
Instruction Fuzzy Hash: 16B092F505420AABCA102B99E949F883F68EB44AA3F408010F64D84054CBE754508B91

Uniqueness

Uniqueness Score: -1.00%

Function 00FEF419 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41c7f0d9b6f76d7cea05d41e13b6d5fbedc3f81df51fd5c028b973f7e4c003a1
Instruction ID: c070a543e200d800b647d187868b197cd5f5db5df32a1f6975a7201d8b7f9c9b
Opcode Fuzzy Hash: 41c7f0d9b6f76d7cea05d41e13b6d5fbedc3f81df51fd5c028b973f7e4c003a1
Instruction Fuzzy Hash: BA323632D29F414DE7239535D832336B248AFB73D4F64D737E819B5A9AEB29C4836200

Uniqueness

Uniqueness Score: -1.00%

Function 00FF267E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d08bb0a4fcaf705f49e1e5cf49fc60980ce96e5a6b9f2d4c1b8fe4ad51e898dd
Instruction ID: 0d2737b424c3f3b8bf0c082180b596ff412e1c33ab66e4382d2bfe6ce1c45cbb
Opcode Fuzzy Hash: d08bb0a4fcaf705f49e1e5cf49fc60980ce96e5a6b9f2d4c1b8fe4ad51e898dd
Instruction Fuzzy Hash: E4B1E030E2AF418DD72396398831337BA4CAFBB2C9B51D71BFC5675D26EB2685834240

Uniqueness

Uniqueness Score: -1.00%

Function 01028B13 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 01028B25

Part of subcall function 00FE543A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,010291F8,00000000,?,?,?,?,010293A9,00000000,?), ref: 00FE5443
Part of subcall function 00FE543A: __aulldiv.LIBCMT ref: 00FE5463

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: c55a76a3161fe8746c6200d2aa0a72f8f566fb2d1cdf1c5484c00a0bd3c438f1
Instruction ID: e6a5a543d70d21fd211ca2fa6a2d4479b1064ad8fde73c499f1e510e5a020b80
Opcode Fuzzy Hash: c55a76a3161fe8746c6200d2aa0a72f8f566fb2d1cdf1c5484c00a0bd3c438f1
Instruction Fuzzy Hash: A121E4726355108BC72ACF29D441B52B3E1EBA5311B288E6CD0F5CB2C0CA75B905CB94

Uniqueness

Uniqueness Score: -1.00%

Function 010341FD Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 01034218

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 8dc4da7184afaffe59b3542d5898895be3ce23dc97edade2c5d45a974bba17ba
Instruction ID: 057f6bbf6f902cd9315162ad3a929c0d6feca6a0c073851e24507fb2fc40c282
Opcode Fuzzy Hash: 8dc4da7184afaffe59b3542d5898895be3ce23dc97edade2c5d45a974bba17ba
Instruction Fuzzy Hash: 5DE048752441159FC710DF59D945E5AF7DCAF94760F018019FC49DB352DAB4E8408B90

Uniqueness

Uniqueness Score: -1.00%

Function 01018C93 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,010188D1), ref: 01018CB3

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 516746485f31bde0765aec4314f03c09abeaaae3c4585bd144a212a6ce0d9265
Instruction ID: 95a0c2074e34b002979582194e31d00a2a9b2ca88fd0ea86fc0e8266788f9588
Opcode Fuzzy Hash: 516746485f31bde0765aec4314f03c09abeaaae3c4585bd144a212a6ce0d9265
Instruction Fuzzy Hash: 3BD05E3226050EBBEF018EA8DD01EAF3B69EB04B01F408111FE15C5090C776D835AF60

Uniqueness

Uniqueness Score: -1.00%

Function 01002230 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 01002242

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: ede4b890b138d629c709b3c38883c5fbfb9b19ea10fe06ac8a5f7046cb88eba4
Instruction ID: f27273387535e839688edfc06459c46e087e07f49f4bd9144a6b12bc36de1914
Opcode Fuzzy Hash: ede4b890b138d629c709b3c38883c5fbfb9b19ea10fe06ac8a5f7046cb88eba4
Instruction Fuzzy Hash: 45C04CF5800109DBDB15DB90D688DEE77BCAB04304F104055A141F2140D7749B448B71

Uniqueness

Uniqueness Score: -1.00%

Function 00FEA364 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00FEA36A

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: a1113394a7a91d3e62b39f446db0b4db96821a2d18792700748f43ce13ab6d97
Instruction ID: e2acddabd37b928522f9286b3b6c77d078014bc10b01becd397146ab4cd442f0
Opcode Fuzzy Hash: a1113394a7a91d3e62b39f446db0b4db96821a2d18792700748f43ce13ab6d97
Instruction Fuzzy Hash: D4A012B000010DA78A001A45E8048447F5CD6005917008010F40C4001187B354104680

Uniqueness

Uniqueness Score: -1.00%

Function 00FD8A0E Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6f2d2eb0a29e12bd6fb37aebf3666dce712a56d3389c50b0a18be9d13c622cc
Instruction ID: e64dadec69773dfd6c773c92505e3ba71bcf09e28e54a2cc95ef4aa78e124236
Opcode Fuzzy Hash: f6f2d2eb0a29e12bd6fb37aebf3666dce712a56d3389c50b0a18be9d13c622cc
Instruction Fuzzy Hash: BB224B31911116CBDF388F19D89467D77A2FB82394F2C846BD8829F395DB389D82DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00FE2405 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: b08c72a7b92294e1b79326385b18db26e08267b162795b2396f407a8086ce651
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 76C190326051D309DF6D863B943413EBAE56AA27B131A0B6EE4B3CB5C5FF20D564F620

Uniqueness

Uniqueness Score: -1.00%

Function 00FE283A Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 9dc724789f6c140d1813bd601d1322f2d832e42e1cc3633806d23a91e65c924a
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 50C1BF336051D30ADBAD463BD43413EBBE56AA27B131A176DE4B2CB4C5FF20D664B620

Uniqueness

Uniqueness Score: -1.00%

Function 00FE1BB8 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: ba0bcffb9c1b1587216c65a119040e6ca96b6c09160500111873c45e133ecc5a
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: E9C16D326091D309DF2D463B943417EBAE17AA27B131A0B6DE8B2CB5D4EF30D564F660

Uniqueness

Uniqueness Score: -1.00%

Function 01037B1B Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 01037B70
DeleteObject.GDI32(00000000), ref: 01037B82
DestroyWindow.USER32 ref: 01037B90
GetDesktopWindow.USER32 ref: 01037BAA
GetWindowRect.USER32(00000000), ref: 01037BB1
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 01037CF2
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 01037D02
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 01037D4A
GetClientRect.USER32(00000000,?), ref: 01037D56
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 01037D90
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 01037DB2
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 01037DC5
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 01037DD0
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 01037DD9
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 01037DE8
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 01037DF1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 01037DF8
GlobalFree.KERNEL32(00000000), ref: 01037E03
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 01037E15
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,01052CAC,00000000), ref: 01037E2B
GlobalFree.KERNEL32(00000000), ref: 01037E3B
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 01037E61
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 01037E80
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 01037EA2
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0103808F

Strings

DISPLAY, xrefs: 01037EF2
AutoIt v3, xrefs: 01037D42
, xrefs: 01038015
static, xrefs: 01037D8A, 01037EE1

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: aaf0ab19ab341205bf071bd254bf8bfac9cadae145f1310b7c477f0b00fff8c6
Instruction ID: a806223dea2b7766698c591388e88b9022bee6284c49b7afeff992ae8e258a9c
Opcode Fuzzy Hash: aaf0ab19ab341205bf071bd254bf8bfac9cadae145f1310b7c477f0b00fff8c6
Instruction Fuzzy Hash: 310291B590011AEFDB24DFA8DD89EAE7BB9FF48310F048158F945AB295CB759D00CB60

Uniqueness

Uniqueness Score: -1.00%

Function 010437F3 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,0104F910), ref: 010438AF
IsWindowVisible.USER32(?), ref: 010438D3

Strings

GETCURRENTCOL, xrefs: 01043BB0
GETSELECTED, xrefs: 01043B2B
TABRIGHT, xrefs: 01043925
FINDSTRING, xrefs: 010439FE
UNCHECK, xrefs: 01043B0B
GETCURRENTLINE, xrefs: 01043B75
SHOWDROPDOWN, xrefs: 01043968
TABLEFT, xrefs: 0104390F
SETCURRENTSELECTION, xrefs: 01043A3E
ISVISIBLE, xrefs: 010438BF
CHECK, xrefs: 01043AF5
ISENABLED, xrefs: 010438F3
ISCHECKED, xrefs: 01043AC1
CURRENTTAB, xrefs: 01043945
HIDEDROPDOWN, xrefs: 01043988
DELSTRING, xrefs: 010439D1
SENDCOMMANDID, xrefs: 01043C62
ADDSTRING, xrefs: 0104399E
GETCURRENTSELECTION, xrefs: 01043A6B
SELECTSTRING, xrefs: 01043A8E
GETLINECOUNT, xrefs: 01043B4E
EDITPASTE, xrefs: 01043BE7
GETLINE, xrefs: 01043C23

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 1a3d27777b9f109d2aa48a65ad20f8c7ad465acc97dea38d97735c127f4793ca
Instruction ID: bff33928ad77d62b5d91dff93ed824c5d3bab580008c655bf7222bb45805b8e1
Opcode Fuzzy Hash: 1a3d27777b9f109d2aa48a65ad20f8c7ad465acc97dea38d97735c127f4793ca
Instruction Fuzzy Hash: B0D1B170204316DBCB24EF15C995AAE7BE1BF94354F00446CB8C65F2A2CF79E94ACB85

Uniqueness

Uniqueness Score: -1.00%

Function 0104A849 Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0104A89F
GetSysColorBrush.USER32(0000000F), ref: 0104A8D0
GetSysColor.USER32(0000000F), ref: 0104A8DC
SetBkColor.GDI32(?,000000FF), ref: 0104A8F6
SelectObject.GDI32(?,?), ref: 0104A905
InflateRect.USER32(?,000000FF,000000FF), ref: 0104A930
GetSysColor.USER32(00000010), ref: 0104A938
CreateSolidBrush.GDI32(00000000), ref: 0104A93F
FrameRect.USER32(?,?,00000000), ref: 0104A94E
DeleteObject.GDI32(00000000), ref: 0104A955
InflateRect.USER32(?,000000FE,000000FE), ref: 0104A9A0
FillRect.USER32(?,?,?), ref: 0104A9D2
GetWindowLongW.USER32(?,000000F0), ref: 0104A9FD

Part of subcall function 0104AB60: GetSysColor.USER32(00000012), ref: 0104AB99
Part of subcall function 0104AB60: SetTextColor.GDI32(?,?), ref: 0104AB9D
Part of subcall function 0104AB60: GetSysColorBrush.USER32(0000000F), ref: 0104ABB3
Part of subcall function 0104AB60: GetSysColor.USER32(0000000F), ref: 0104ABBE
Part of subcall function 0104AB60: GetSysColor.USER32(00000011), ref: 0104ABDB
Part of subcall function 0104AB60: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0104ABE9
Part of subcall function 0104AB60: SelectObject.GDI32(?,00000000), ref: 0104ABFA
Part of subcall function 0104AB60: SetBkColor.GDI32(?,00000000), ref: 0104AC03
Part of subcall function 0104AB60: SelectObject.GDI32(?,?), ref: 0104AC10
Part of subcall function 0104AB60: InflateRect.USER32(?,000000FF,000000FF), ref: 0104AC2F
Part of subcall function 0104AB60: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0104AC46
Part of subcall function 0104AB60: GetWindowLongW.USER32(00000000,000000F0), ref: 0104AC5B

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: e8457b1201c3265679008d0e386047d16d749ac94b0dcf3820a4577db832d640
Instruction ID: c42c9059b6e0cb47b1241efff7f2a83a07509ef2c2443709bb46f9ef6a159a9d
Opcode Fuzzy Hash: e8457b1201c3265679008d0e386047d16d749ac94b0dcf3820a4577db832d640
Instruction Fuzzy Hash: 31A1A2B5108302EFD7219F68DD88A5B7BE9FF89321F000A29FAA2971D1D735D844CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00FC2C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00FC2CA2
DeleteObject.GDI32(00000000), ref: 00FC2CE8
DeleteObject.GDI32(00000000), ref: 00FC2CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00FC2CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00FC2D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 00FFC68B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00FFC6C4
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00FFCAED

Part of subcall function 00FC1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00FC2036,?,00000000,?,?,?,?,00FC16CB,00000000,?), ref: 00FC1B9A

SendMessageW.USER32(?,00001053), ref: 00FFCB2A
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00FFCB41
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00FFCB57
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00FFCB62

Strings

0, xrefs: 00FFC981

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: b40a9af67b01e42d17074cc23e799de85a7a121e38015b9eae71dfaf0dac1079
Instruction ID: b8cae5465f6a3d910a9bceb3e2a529d98a33003a45fe3a0582e25c298c87d196
Opcode Fuzzy Hash: b40a9af67b01e42d17074cc23e799de85a7a121e38015b9eae71dfaf0dac1079
Instruction Fuzzy Hash: 3012A03590021AEFDB24DF24CA85BB9BBE1FF44320F14456DEA85DB262C735E841EB90

Uniqueness

Uniqueness Score: -1.00%

Function 010377BE Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 010377F1
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 010378B0
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 010378EE
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 01037900
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 01037946
GetClientRect.USER32(00000000,?), ref: 01037952
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 01037996
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 010379A5
GetStockObject.GDI32(00000011), ref: 010379B5
SelectObject.GDI32(00000000,00000000), ref: 010379B9
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 010379C9
GetDeviceCaps.GDI32(00000000,0000005A), ref: 010379D2
DeleteDC.GDI32(00000000), ref: 010379DB
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 01037A07
SendMessageW.USER32(00000030,00000000,00000001), ref: 01037A1E
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 01037A59
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 01037A6D
SendMessageW.USER32(00000404,00000001,00000000), ref: 01037A7E
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 01037AAE
GetStockObject.GDI32(00000011), ref: 01037AB9
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 01037AC4
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 01037ACE

Strings

DISPLAY, xrefs: 0103799B
AutoIt v3, xrefs: 0103793E
msctls_progress32, xrefs: 01037A4F
static, xrefs: 01037990, 01037AA8

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 403b5516b61653b0a588cac2d789b68cbe17b1a7beecf85b93f8ed068dcba8de
Instruction ID: a504dc59e669b91f2887219447487e92a680361c7a1de9778b946d7592efaee4
Opcode Fuzzy Hash: 403b5516b61653b0a588cac2d789b68cbe17b1a7beecf85b93f8ed068dcba8de
Instruction Fuzzy Hash: 95A196B5A40606BFEB24DF68DD4AFAE7BB9EB44710F014154FA54A71D0C779AD00CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0102AF7B Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0102AF89
GetDriveTypeW.KERNEL32(?,0104FAC0,?,\\.\,0104F910), ref: 0102B066
SetErrorMode.KERNEL32(00000000,0104FAC0,?,\\.\,0104F910), ref: 0102B1C4

Strings

Fixed, xrefs: 0102B0AE
FileBackedVirtual, xrefs: 0102B193
iSCSI, xrefs: 0102B169
CDROM, xrefs: 0102B09A
RAMDisk, xrefs: 0102B090
Fibre, xrefs: 0102B154
SSD, xrefs: 0102B0F1
RAID, xrefs: 0102B162
Virtual, xrefs: 0102B18C
SSA, xrefs: 0102B14D
SAS, xrefs: 0102B170
\\.\, xrefs: 0102AFDB
ATA, xrefs: 0102B13F
Unknown, xrefs: 0102B086, 0102B12A
1394, xrefs: 0102B146
SCSI, xrefs: 0102B131
SATA, xrefs: 0102B177
USB, xrefs: 0102B15B
MMC, xrefs: 0102B185
Removable, xrefs: 0102B0B8
ATAPI, xrefs: 0102B138
Network, xrefs: 0102B0A4
PhysicalDrive, xrefs: 0102B012

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 007681081fcdf35d0882d36edb6258f1ef7f175fc2ab3016000ed6c37aeebe99
Instruction ID: 0218adf4346e0520db469ca07c4e59ace30f7f94e9241b97c4a168295f6f3456
Opcode Fuzzy Hash: 007681081fcdf35d0882d36edb6258f1ef7f175fc2ab3016000ed6c37aeebe99
Instruction Fuzzy Hash: 3651D130B84716EBCB10EB15CE92DBCB7B0FB54641764805EF4CBAB250CA79AD41CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00FC6A3C Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00FC6A91
__wcsnicmp.LIBCMT ref: 00FC6AA9
__wcsnicmp.LIBCMT ref: 00FC6AC1
__wcsnicmp.LIBCMT ref: 00FC6AD9
__wcsnicmp.LIBCMT ref: 00FC6AF1
__wcsnicmp.LIBCMT ref: 00FC6B09
__wcsnicmp.LIBCMT ref: 00FC6B21
__wcsnicmp.LIBCMT ref: 00FC6B35
__wcsnicmp.LIBCMT ref: 00FC6B76
__wcsnicmp.LIBCMT ref: 00FC6B8A
__wcsnicmp.LIBCMT ref: 00FC6B9E
__wcsnicmp.LIBCMT ref: 00FC6BB2

Strings

#pragma compile, xrefs: 00FC6A8B
#comments-end, xrefs: 00FC6B98
#comments-start, xrefs: 00FC6B1B, 00FC6B70
#OnAutoItStartRegister, xrefs: 00FC6AD3
#notrayicon, xrefs: 00FC6AA3
Bad directive syntax error, xrefs: 00FFE743
#include-once, xrefs: 00FC6AEB
#cs, xrefs: 00FC6B2F, 00FC6B84
Unterminated group of comments, xrefs: 00FFE82C
#ce, xrefs: 00FC6BAC
Cannot parse #include, xrefs: 00FFE819
#include, xrefs: 00FC6B03
#requireadmin, xrefs: 00FC6ABB

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: c16f25fdcffcfa01f319745d04d030c48b76854c16c56777bd581815e2ffea3c
Instruction ID: 59d236a816cd00372725bd10534d8511f77ecc2d121c9c008cfe9c33b7e17e9e
Opcode Fuzzy Hash: c16f25fdcffcfa01f319745d04d030c48b76854c16c56777bd581815e2ffea3c
Instruction Fuzzy Hash: 79814A71A04247ABCB24BE21CE97FBF3759AF14710F044029FD41EA0A1EB69DE41F690

Uniqueness

Uniqueness Score: -1.00%

Function 0104AB60 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 0104AB99
SetTextColor.GDI32(?,?), ref: 0104AB9D
GetSysColorBrush.USER32(0000000F), ref: 0104ABB3
GetSysColor.USER32(0000000F), ref: 0104ABBE
CreateSolidBrush.GDI32(?), ref: 0104ABC3
GetSysColor.USER32(00000011), ref: 0104ABDB
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0104ABE9
SelectObject.GDI32(?,00000000), ref: 0104ABFA
SetBkColor.GDI32(?,00000000), ref: 0104AC03
SelectObject.GDI32(?,?), ref: 0104AC10
InflateRect.USER32(?,000000FF,000000FF), ref: 0104AC2F
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0104AC46
GetWindowLongW.USER32(00000000,000000F0), ref: 0104AC5B
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0104ACA7
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0104ACCE
InflateRect.USER32(?,000000FD,000000FD), ref: 0104ACEC
DrawFocusRect.USER32(?,?), ref: 0104ACF7
GetSysColor.USER32(00000011), ref: 0104AD05
SetTextColor.GDI32(?,00000000), ref: 0104AD0D
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0104AD21
SelectObject.GDI32(?,0104A869), ref: 0104AD38
DeleteObject.GDI32(?), ref: 0104AD43
SelectObject.GDI32(?,?), ref: 0104AD49
DeleteObject.GDI32(?), ref: 0104AD4E
SetTextColor.GDI32(?,?), ref: 0104AD54
SetBkColor.GDI32(?,?), ref: 0104AD5E

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: c118dc23787f2d647eaff8b8c6afc68e32f25def1801c40590efaff3045bd8cd
Instruction ID: 6676ae296849584af1c6c83f06e8f41e410f46f792a9a5e8c8fc8bfee03ee246
Opcode Fuzzy Hash: c118dc23787f2d647eaff8b8c6afc68e32f25def1801c40590efaff3045bd8cd
Instruction Fuzzy Hash: EF6191B5900209EFDF219FA8DD88EAE7BB9FB08320F104565FA51AB291D7759940CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01048C44 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 01048D34
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 01048D45
CharNextW.USER32(0000014E), ref: 01048D74
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 01048DB5
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 01048DCB
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 01048DDC
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 01048DF9
SetWindowTextW.USER32(?,0000014E), ref: 01048E45
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 01048E5B
SendMessageW.USER32(?,00001002,00000000,?), ref: 01048E8C
_memset.LIBCMT ref: 01048EB1
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 01048EFA
_memset.LIBCMT ref: 01048F59
SendMessageW.USER32(?,00001053,000000FF,?), ref: 01048F83
SendMessageW.USER32(?,00001074,?,00000001), ref: 01048FDB
SendMessageW.USER32(?,0000133D,?,?), ref: 01049088
InvalidateRect.USER32(?,00000000,00000001), ref: 010490AA
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 010490F4
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 01049121
DrawMenuBar.USER32(?), ref: 01049130
SetWindowTextW.USER32(?,0000014E), ref: 01049158

Strings

0, xrefs: 010490C2

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: ea424ab166b88120a4e1f41098a12fc80f184c22a68c37111ffa0fe8167eda0a
Instruction ID: de15dfd70bf457fe1718f6b0d63df0b4ad0dc38b63ffbd1ea237b82dbd74e30c
Opcode Fuzzy Hash: ea424ab166b88120a4e1f41098a12fc80f184c22a68c37111ffa0fe8167eda0a
Instruction Fuzzy Hash: B1E1B4B4901209ABDF209FA5CCC8EEF7BB8FF09754F0085AAFA959A190D7758641CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01044B16 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 01044C51
GetDesktopWindow.USER32 ref: 01044C66
GetWindowRect.USER32(00000000), ref: 01044C6D
GetWindowLongW.USER32(?,000000F0), ref: 01044CCF
DestroyWindow.USER32(?), ref: 01044CFB
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 01044D24
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 01044D42
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 01044D68
SendMessageW.USER32(?,00000421,?,?), ref: 01044D7D
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 01044D90
IsWindowVisible.USER32(?), ref: 01044DB0
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 01044DCB
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 01044DDF
GetWindowRect.USER32(?,?), ref: 01044DF7
MonitorFromPoint.USER32(?,?,00000002), ref: 01044E1D
GetMonitorInfoW.USER32(00000000,?), ref: 01044E37
CopyRect.USER32(?,?), ref: 01044E4E
SendMessageW.USER32(?,00000412,00000000), ref: 01044EB9

Strings

0, xrefs: 01044BFC
(, xrefs: 01044E2A
tooltips_class32, xrefs: 01044D1D

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: dc4745004e8933d05c654bea73b4708350c5a05d6df386f21259467189a0cf67
Instruction ID: 48e894bc250555cd757f3059c0f09554ca2ae632cf322b66d37acf1c0f890e91
Opcode Fuzzy Hash: dc4745004e8933d05c654bea73b4708350c5a05d6df386f21259467189a0cf67
Instruction Fuzzy Hash: 14B17DB1608341AFD754DF29C989B5ABBE4BF88310F00892CF5D9DB291DB75D804CB95

Uniqueness

Uniqueness Score: -1.00%

Function 010246D6 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 010246E8
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 0102470E
_wcscpy.LIBCMT ref: 0102473C
_wcscmp.LIBCMT ref: 01024747
_wcscat.LIBCMT ref: 0102475D
_wcsstr.LIBCMT ref: 01024768
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 01024784
_wcscat.LIBCMT ref: 010247CD
_wcscat.LIBCMT ref: 010247D4
_wcsncpy.LIBCMT ref: 010247FF

Strings

\VarFileInfo\Translation, xrefs: 0102477C
DefaultLangCodepage, xrefs: 010247E7
StringFileInfo\, xrefs: 01024757
%u.%u.%u.%u, xrefs: 01024862
04090000, xrefs: 010247BA

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: 8da8e2c0fe2f23b0b206f55c54edee6635e93bc8febc7ce63e923ca8a97c4cdb
Instruction ID: 20769d3fed07107bafff9641fce845a0715074dc252447592b4869b3ac95152c
Opcode Fuzzy Hash: 8da8e2c0fe2f23b0b206f55c54edee6635e93bc8febc7ce63e923ca8a97c4cdb
Instruction Fuzzy Hash: 64416B71A00291BBE710B77A9C47EBF77BCEF01710F04016AF941E7142EB79A601A7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00FC27D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00FC28BC
GetSystemMetrics.USER32(00000007), ref: 00FC28C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00FC28EF
GetSystemMetrics.USER32(00000008), ref: 00FC28F7
GetSystemMetrics.USER32(00000004), ref: 00FC291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00FC2939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00FC2949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00FC297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00FC2990
GetClientRect.USER32(00000000,000000FF), ref: 00FC29AE
GetStockObject.GDI32(00000011), ref: 00FC29CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 00FC29D5

Part of subcall function 00FC2344: GetCursorPos.USER32(?), ref: 00FC2357
Part of subcall function 00FC2344: ScreenToClient.USER32(010867B0,?), ref: 00FC2374
Part of subcall function 00FC2344: GetAsyncKeyState.USER32(00000001), ref: 00FC2399
Part of subcall function 00FC2344: GetAsyncKeyState.USER32(00000002), ref: 00FC23A7

SetTimer.USER32(00000000,00000000,00000028,00FC1256), ref: 00FC29FC

Strings

AutoIt v3 GUI, xrefs: 00FC2974

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: c569f43289ceb359ea18e9c9a433696aa9f9ac6f02f60d364b3e662a1e07474e
Instruction ID: 0d69264aa33b7c29492c8b44fcc978ae17a4398bc8131ba5f6b649f1fae04ff5
Opcode Fuzzy Hash: c569f43289ceb359ea18e9c9a433696aa9f9ac6f02f60d364b3e662a1e07474e
Instruction Fuzzy Hash: F8B18075A0020BEFDB24DF68DA85FAD7BB4FF08310F114219FA55E6294DB799800DB90

Uniqueness

Uniqueness Score: -1.00%

Function 01044069 Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 010440F6
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 010441B6

Strings

SELECTCLEAR, xrefs: 01044235
GETSELECTED, xrefs: 010442E4
GETSELECTEDCOUNT, xrefs: 01044199
SELECTALL, xrefs: 0104421D
GETSUBITEMCOUNT, xrefs: 01044141
FINDITEM, xrefs: 01044329
GETTEXT, xrefs: 0104415F
ISSELECTED, xrefs: 010441C1
VIEWCHANGE, xrefs: 01044375
SELECT, xrefs: 01044250
SELECTINVERT, xrefs: 01044286
GETITEMCOUNT, xrefs: 01044128
DESELECT, xrefs: 010442A4

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: fa7cce0dfed28b756ac9d0e972ced77ab06ad44c0824ebceaee5280b9cb8dd4f
Instruction ID: a50686ae4ef0dbd1f30517b3439c90ce8ee5614afab6c3b64e69a0e286e1b561
Opcode Fuzzy Hash: fa7cce0dfed28b756ac9d0e972ced77ab06ad44c0824ebceaee5280b9cb8dd4f
Instruction Fuzzy Hash: C5A18E702143029BCB14EF24CE92F6AB7E5BF84314F04896CA8D69B692DF78EC05CB51

Uniqueness

Uniqueness Score: -1.00%

Function 010352F0 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 01035309
LoadCursorW.USER32(00000000,00007F8A), ref: 01035314
LoadCursorW.USER32(00000000,00007F00), ref: 0103531F
LoadCursorW.USER32(00000000,00007F03), ref: 0103532A
LoadCursorW.USER32(00000000,00007F8B), ref: 01035335
LoadCursorW.USER32(00000000,00007F01), ref: 01035340
LoadCursorW.USER32(00000000,00007F81), ref: 0103534B
LoadCursorW.USER32(00000000,00007F88), ref: 01035356
LoadCursorW.USER32(00000000,00007F80), ref: 01035361
LoadCursorW.USER32(00000000,00007F86), ref: 0103536C
LoadCursorW.USER32(00000000,00007F83), ref: 01035377
LoadCursorW.USER32(00000000,00007F85), ref: 01035382
LoadCursorW.USER32(00000000,00007F82), ref: 0103538D
LoadCursorW.USER32(00000000,00007F84), ref: 01035398
LoadCursorW.USER32(00000000,00007F04), ref: 010353A3
LoadCursorW.USER32(00000000,00007F02), ref: 010353AE
GetCursorInfo.USER32(?), ref: 010353BE
GetLastError.KERNEL32(00000001,00000000), ref: 010353E9

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: dfe7195430f015a13c50b1e10f55b0612a5bfc8861ebe5aa45ec5b904f47ebc3
Instruction ID: 89d4e85903ac44d87f5df2d23e7f531e632e38c10c91681963b4aaabecd764af
Opcode Fuzzy Hash: dfe7195430f015a13c50b1e10f55b0612a5bfc8861ebe5aa45ec5b904f47ebc3
Instruction Fuzzy Hash: 07414370E083196ADB109FBA8C49D6EFFFCEF91B50F10452FA549E7290DAB89501CE51

Uniqueness

Uniqueness Score: -1.00%

Function 0101AA64 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0101AAA5
__swprintf.LIBCMT ref: 0101AB46
_wcscmp.LIBCMT ref: 0101AB59
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 0101ABAE
_wcscmp.LIBCMT ref: 0101ABEA
GetClassNameW.USER32(?,?,00000400), ref: 0101AC21
GetDlgCtrlID.USER32(?), ref: 0101AC73
GetWindowRect.USER32(?,?), ref: 0101ACA9
GetParent.USER32(?), ref: 0101ACC7
ScreenToClient.USER32(00000000), ref: 0101ACCE
GetClassNameW.USER32(?,?,00000100), ref: 0101AD48
_wcscmp.LIBCMT ref: 0101AD5C
GetWindowTextW.USER32(?,?,00000400), ref: 0101AD82
_wcscmp.LIBCMT ref: 0101AD96

Part of subcall function 00FE386C: _iswctype.LIBCMT ref: 00FE3874

Strings

%s%u, xrefs: 0101AB40

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: b40fe44c3c9401b351865be3e338d3c823f10f3f72cd9851e25eec1560ac9ec9
Instruction ID: 4c25d6ce40bf311e5cedfdae06e5b88ee5491c36bb69bc2df0374a00cc74b773
Opcode Fuzzy Hash: b40fe44c3c9401b351865be3e338d3c823f10f3f72cd9851e25eec1560ac9ec9
Instruction Fuzzy Hash: 3EA1FD71305686EFD715EE68C884BAABBE8FF04315F404629FADAC3185DB38E545CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0101B397 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 0101B3DB
_wcscmp.LIBCMT ref: 0101B3EC
GetWindowTextW.USER32(00000001,?,00000400), ref: 0101B414
CharUpperBuffW.USER32(?,00000000), ref: 0101B431
_wcscmp.LIBCMT ref: 0101B44F
_wcsstr.LIBCMT ref: 0101B460
GetClassNameW.USER32(00000018,?,00000400), ref: 0101B498
_wcscmp.LIBCMT ref: 0101B4A8
GetWindowTextW.USER32(00000002,?,00000400), ref: 0101B4CF
GetClassNameW.USER32(00000018,?,00000400), ref: 0101B518
_wcscmp.LIBCMT ref: 0101B528
GetClassNameW.USER32(00000010,?,00000400), ref: 0101B550
GetWindowRect.USER32(00000004,?), ref: 0101B5B9

Strings

@, xrefs: 0101B3BC
ThumbnailClass, xrefs: 0101B4A3, 0101B523

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: a5c5cc9d25db6483d906456cfbb9c3972d2f3f97fb97a03f30798b1c00aae8d7
Instruction ID: 3b2d5cbdfcc2f533e27be158888341f6280ff5605d4e7b6f688c59c39263b865
Opcode Fuzzy Hash: a5c5cc9d25db6483d906456cfbb9c3972d2f3f97fb97a03f30798b1c00aae8d7
Instruction Fuzzy Hash: 4081CF710083069BEB11DF19C985FAA7BE8FF44314F0885A9FDC58A09ADB3CD945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0101B1E0 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0101B23F

Strings

[REGEXPTITLE:, xrefs: 0101B267
[CLASS:, xrefs: 0101B28F
[LAST, xrefs: 0101B2EC
HANDLE=, xrefs: 0101B238
LAST, xrefs: 0101B204
ACTIVE, xrefs: 0101B21A
[ACTIVE, xrefs: 0101B22C
ALL, xrefs: 0101B2D3
[ALL, xrefs: 0101B2E5
CLASSNAME=, xrefs: 0101B27C
REGEXP=, xrefs: 0101B254
[HANDLE:, xrefs: 0101B24B

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 03ffda5206e49e52c39fe8bd22c036e83557175aee52a5b539162df8f8493fa6
Instruction ID: bf906cc2b85eecad6fcafa485073fe077dfd7d20649641ce320a98287874de22
Opcode Fuzzy Hash: 03ffda5206e49e52c39fe8bd22c036e83557175aee52a5b539162df8f8493fa6
Instruction Fuzzy Hash: C131A031A44306A6DB10FA62CE47FEEB7B4AF14B60F60012DF481760D6EF6D6E08D955

Uniqueness

Uniqueness Score: -1.00%

Function 0101C4C1 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 0101C4D4
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0101C4E6
SetWindowTextW.USER32(?,?), ref: 0101C4FD
GetDlgItem.USER32(?,000003EA), ref: 0101C512
SetWindowTextW.USER32(00000000,?), ref: 0101C518
GetDlgItem.USER32(?,000003E9), ref: 0101C528
SetWindowTextW.USER32(00000000,?), ref: 0101C52E
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 0101C54F
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 0101C569
GetWindowRect.USER32(?,?), ref: 0101C572
SetWindowTextW.USER32(?,?), ref: 0101C5DD
GetDesktopWindow.USER32 ref: 0101C5E3
GetWindowRect.USER32(00000000), ref: 0101C5EA
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 0101C636
GetClientRect.USER32(?,?), ref: 0101C643
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 0101C668
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 0101C693

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 692f594a158804cb9672937444fb4852770d93d56d4f3b643630bed89ec1fb3b
Instruction ID: 33180d19443c83411e0a6bccd0a359586ad4b3cd8428632e810c370006c227aa
Opcode Fuzzy Hash: 692f594a158804cb9672937444fb4852770d93d56d4f3b643630bed89ec1fb3b
Instruction Fuzzy Hash: CA51617094070AAFEB20DFA8DE85B6EBBF5FF04705F004958E686A25A4C779E944CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0104A428 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0104A4C8
DestroyWindow.USER32(00000000,?), ref: 0104A542

Part of subcall function 00FC7D2C: _memmove.LIBCMT ref: 00FC7D66

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0104A5BC
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0104A5DE
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0104A5F1
DestroyWindow.USER32(00000000), ref: 0104A613
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00FC0000,00000000), ref: 0104A64A
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0104A663
GetDesktopWindow.USER32 ref: 0104A67C
GetWindowRect.USER32(00000000), ref: 0104A683
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0104A69B
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0104A6B3

Part of subcall function 00FC25DB: GetWindowLongW.USER32(?,000000EB), ref: 00FC25EC

Strings

0, xrefs: 0104A4DE
tooltips_class32, xrefs: 0104A5B5, 0104A643

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: 4af28a1ce099683c55e639ac04736e7f4fe32ccf03a8e4ab79ca9443ca73c36d
Instruction ID: 379f638d7d0791fe695189d67530a9cbefdf5f0ca7d2b084e298ca55d927f94e
Opcode Fuzzy Hash: 4af28a1ce099683c55e639ac04736e7f4fe32ccf03a8e4ab79ca9443ca73c36d
Instruction Fuzzy Hash: 0C717CB5244205EFE720DF28C885F6A7BE5FB88300F44456DFAC687251D776E905CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0104C8EE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC2612: GetWindowLongW.USER32(?,000000EB), ref: 00FC2623

DragQueryPoint.SHELL32(?,?), ref: 0104C917

Part of subcall function 0104ADF1: ClientToScreen.USER32(?,?), ref: 0104AE1A
Part of subcall function 0104ADF1: GetWindowRect.USER32(?,?), ref: 0104AE90
Part of subcall function 0104ADF1: PtInRect.USER32(?,?,0104C304), ref: 0104AEA0

SendMessageW.USER32(?,000000B0,?,?), ref: 0104C980
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0104C98B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0104C9AE
_wcscat.LIBCMT ref: 0104C9DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0104C9F5
SendMessageW.USER32(?,000000B0,?,?), ref: 0104CA0E
SendMessageW.USER32(?,000000B1,?,?), ref: 0104CA25
SendMessageW.USER32(?,000000B1,?,?), ref: 0104CA47
DragFinish.SHELL32(?), ref: 0104CA4E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0104CB41

Strings

@GUI_DRAGFILE, xrefs: 0104CAF0
@GUI_DROPID, xrefs: 0104CA6E
@GUI_DRAGID, xrefs: 0104CAB9

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 7686ffa40c8619a5f466819e55ce0e2d384d3397c85455c2ecab49ffd4a4cf34
Instruction ID: 79c2c68db08e8154ebe8f7ea3773b94a54181c4a0e08bfb491f225bf4299e55d
Opcode Fuzzy Hash: 7686ffa40c8619a5f466819e55ce0e2d384d3397c85455c2ecab49ffd4a4cf34
Instruction Fuzzy Hash: 8A619CB1108302AFC710EF64CD85E9FBBE8EF88750F000A1DF5D5961A1DB759A09DB92

Uniqueness

Uniqueness Score: -1.00%

Function 01044619 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 010446AB
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 010446F6

Strings

CHECK, xrefs: 01044716
GETTEXT, xrefs: 01044849
EXPAND, xrefs: 010447A8
GETTOTALCOUNT, xrefs: 010446DD
COLLAPSE, xrefs: 0104473C
ISCHECKED, xrefs: 01044879
GETSELECTED, xrefs: 01044806
SELECT, xrefs: 010448A7
UNCHECK, xrefs: 010448D2
GETITEMCOUNT, xrefs: 010447D8
EXISTS, xrefs: 0104475F

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: a616b81e21b381446c0072b1f3d165300f043a4ca174a81118ce3a28eec86230
Instruction ID: 98a90872809e7599f46cb850fa78923eef203ceceb95bc0116ab3f20e3c96c05
Opcode Fuzzy Hash: a616b81e21b381446c0072b1f3d165300f043a4ca174a81118ce3a28eec86230
Instruction Fuzzy Hash: 67919F746043029BCB14EF14C891B6DB7E1BF94314F0044ACA8D69B7A2CF79ED4ADB41

Uniqueness

Uniqueness Score: -1.00%

Function 0104BAB8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0104BB6E
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,01049431), ref: 0104BBCA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0104BC03
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 0104BC46
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0104BC7D
FreeLibrary.KERNEL32(?), ref: 0104BC89
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0104BC99
DestroyIcon.USER32(?,?,?,?,?,01049431), ref: 0104BCA8
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0104BCC5
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0104BCD1

Part of subcall function 00FE313D: __wcsicmp_l.LIBCMT ref: 00FE31C6

Strings

.icl, xrefs: 0104BAE4
.exe, xrefs: 0104BB04
.dll, xrefs: 0104BB27

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: 84551d69e4933e7700e96d5feeec3e08edff3e04bfbeee7eaf340b7d0f8b92fc
Instruction ID: 3a1a67d6465fdedce858ae7bb38be77c182c56a83387434bce358e3e42e18f33
Opcode Fuzzy Hash: 84551d69e4933e7700e96d5feeec3e08edff3e04bfbeee7eaf340b7d0f8b92fc
Instruction Fuzzy Hash: EE61D1B1900219BBEB24DF68CDC5FBE7BA8BB08710F104169F955D61C0DBB9E950DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0102A5BD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00FC9997: __itow.LIBCMT ref: 00FC99C2
Part of subcall function 00FC9997: __swprintf.LIBCMT ref: 00FC9A0C

CharLowerBuffW.USER32(?,?), ref: 0102A636
GetDriveTypeW.KERNEL32 ref: 0102A683
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0102A6CB
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0102A702
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0102A730

Part of subcall function 00FC7D2C: _memmove.LIBCMT ref: 00FC7D66

Strings

set cd door , xrefs: 0102A6D1
open, xrefs: 0102A65D
open , xrefs: 0102A692
close cd wait, xrefs: 0102A71B
type cdaudio alias cd wait, xrefs: 0102A6AE
close, xrefs: 0102A63C
closed, xrefs: 0102A64A, 0102A653
wait, xrefs: 0102A6ED

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 896c4c2724268be7f426ef14c606eb71465ef82120f3ae939f85c170c377532f
Instruction ID: 791e93c8ea47caa3f78d35661c0aa968f3c2393ef3697ee42d99e153ad594963
Opcode Fuzzy Hash: 896c4c2724268be7f426ef14c606eb71465ef82120f3ae939f85c170c377532f
Instruction Fuzzy Hash: DE5129716043069FC710EF25CD82D6AB7E4FF88718F04495CF89A97251DB39AE09DB51

Uniqueness

Uniqueness Score: -1.00%

Function 0102A45A Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0102A47A
__swprintf.LIBCMT ref: 0102A49C
CreateDirectoryW.KERNEL32(?,00000000), ref: 0102A4D9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0102A4FE
_memset.LIBCMT ref: 0102A51D
_wcsncpy.LIBCMT ref: 0102A559
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 0102A58E
CloseHandle.KERNEL32(00000000), ref: 0102A599
RemoveDirectoryW.KERNEL32(?), ref: 0102A5A2
CloseHandle.KERNEL32(00000000), ref: 0102A5AC

Strings

\??\%s, xrefs: 0102A496
\, xrefs: 0102A4B2
:, xrefs: 0102A4BD

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 9401c972ef9423836056ddecb8503b2332a9877aaf62978ecc3890b5e1754d6d
Instruction ID: ef987a842248cc86656e45d6cde76b37c474024b90152a616632af4b8cb2472c
Opcode Fuzzy Hash: 9401c972ef9423836056ddecb8503b2332a9877aaf62978ecc3890b5e1754d6d
Instruction Fuzzy Hash: F631D2B560012AABDB219FA4DC88FEB77BCEF88701F1041B6FA48D3055EB7493448B24

Uniqueness

Uniqueness Score: -1.00%

Function 0102DB04 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 0102DC7B
_wcscat.LIBCMT ref: 0102DC93
_wcscat.LIBCMT ref: 0102DCA5
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0102DCBA
SetCurrentDirectoryW.KERNEL32(?), ref: 0102DCCE
GetFileAttributesW.KERNEL32(?), ref: 0102DCE6
SetFileAttributesW.KERNEL32(?,00000000), ref: 0102DD00
SetCurrentDirectoryW.KERNEL32(?), ref: 0102DD12

Strings

*.*, xrefs: 0102DD51

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: f698f4c8425d69a178e1001cf494dd09d1adeb2479c2e03a885bf7eb5f4b0311
Instruction ID: aea918371ce5fd2f03f6f7b17f131b9b11ee4c6a71cb96f24016393e9790a27f
Opcode Fuzzy Hash: f698f4c8425d69a178e1001cf494dd09d1adeb2479c2e03a885bf7eb5f4b0311
Instruction Fuzzy Hash: 4681D171504255DFDB60EFA8C8959AEB7E8BB88310F18886EF9C9C7211E634ED44CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0104C49C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC2612: GetWindowLongW.USER32(?,000000EB), ref: 00FC2623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0104C4EC
GetFocus.USER32 ref: 0104C4FC
GetDlgCtrlID.USER32(00000000), ref: 0104C507
_memset.LIBCMT ref: 0104C632
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0104C65D
GetMenuItemCount.USER32(?), ref: 0104C67D
GetMenuItemID.USER32(?,00000000), ref: 0104C690
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0104C6C4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0104C70C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0104C744
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0104C779

Strings

0, xrefs: 0104C62A

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 320d77c98e4c97957724644dae0af1ab3470aaed106fb38f95fdc8542b9ef7d2
Instruction ID: 935b489cf732cc905725ce976b578e20fe037bf8e10c7056debe5cdca7ecdde2
Opcode Fuzzy Hash: 320d77c98e4c97957724644dae0af1ab3470aaed106fb38f95fdc8542b9ef7d2
Instruction Fuzzy Hash: 68818FB01093019FE761DF18CAC4A6BBBE8FB88314F00456DF9D593251D731E905CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 010183F4 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0101874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 01018766
Part of subcall function 0101874A: GetLastError.KERNEL32(?,0101822A,?,?,?), ref: 01018770
Part of subcall function 0101874A: GetProcessHeap.KERNEL32(00000008,?,?,0101822A,?,?,?), ref: 0101877F
Part of subcall function 0101874A: HeapAlloc.KERNEL32(00000000,?,0101822A,?,?,?), ref: 01018786
Part of subcall function 0101874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0101879D

Part of subcall function 010187E7: GetProcessHeap.KERNEL32(00000008,01018240,00000000,00000000,?,01018240,?), ref: 010187F3
Part of subcall function 010187E7: HeapAlloc.KERNEL32(00000000,?,01018240,?), ref: 010187FA
Part of subcall function 010187E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,01018240,?), ref: 0101880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 01018458
_memset.LIBCMT ref: 0101846D
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 0101848C
GetLengthSid.ADVAPI32(?), ref: 0101849D
GetAce.ADVAPI32(?,00000000,?), ref: 010184DA
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 010184F6
GetLengthSid.ADVAPI32(?), ref: 01018513
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 01018522
HeapAlloc.KERNEL32(00000000), ref: 01018529
GetLengthSid.ADVAPI32(?,00000008,?), ref: 0101854A
CopySid.ADVAPI32(00000000), ref: 01018551
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 01018582
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 010185A8
SetUserObjectSecurity.USER32(?,00000004,?), ref: 010185BC

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: b2f6e3508c03a77d3cca0204a58a4c30524f51b02ac28ff11c54aab36fa9c959
Instruction ID: 2c7064d297ee35d75116c86521a13552edc59dcdacbab66726ab3174468bd597
Opcode Fuzzy Hash: b2f6e3508c03a77d3cca0204a58a4c30524f51b02ac28ff11c54aab36fa9c959
Instruction Fuzzy Hash: D3615E7590020AAFDF10DF98DD84AEEBBB9FF44310F04815AF955A7284DB399A15CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0103762D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 010376A2
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 010376AE
CreateCompatibleDC.GDI32(?), ref: 010376BA
SelectObject.GDI32(00000000,?), ref: 010376C7
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 0103771B
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 01037757
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 0103777B
SelectObject.GDI32(00000006,?), ref: 01037783
DeleteObject.GDI32(?), ref: 0103778C
DeleteDC.GDI32(00000006), ref: 01037793
ReleaseDC.USER32(00000000,?), ref: 0103779E

Strings

(, xrefs: 01037723

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 7f8fe5f1913e8d4322d73c7dafcf45ac99d89639cb790f7f77bf8c688a579587
Instruction ID: d60a38849504d3118e6f4c6a3b5574a47726b163e3673341c937bc56070afd35
Opcode Fuzzy Hash: 7f8fe5f1913e8d4322d73c7dafcf45ac99d89639cb790f7f77bf8c688a579587
Instruction Fuzzy Hash: 7A514CB5900209EFDB25CFA8C984EAEBBF9FF88710F14851DF99997210D735A840CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0102A0B5 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,0104FB78), ref: 0102A0FC

Part of subcall function 00FC7F41: _memmove.LIBCMT ref: 00FC7F82

LoadStringW.USER32(?,?,00000FFF,?), ref: 0102A11E
__swprintf.LIBCMT ref: 0102A177
__swprintf.LIBCMT ref: 0102A190
_wprintf.LIBCMT ref: 0102A246
_wprintf.LIBCMT ref: 0102A264

Strings

"%s" (%d) : ==> %s:, xrefs: 0102A25F
^ ERROR, xrefs: 0102A1E8
Line %d (File "%s"):, xrefs: 0102A171, 0102A18A
Error: , xrefs: 0102A20E
"%s" (%d) : ==> %s:%s%s, xrefs: 0102A241

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: d73e770a65933691dd0ac08a64f051d1a8de13e031fd83195e160b9b41c3db8e
Instruction ID: afde35f4e4c6d853ac188b1ba9d3d66ffe1917dc06c6359124960b5d41f25884
Opcode Fuzzy Hash: d73e770a65933691dd0ac08a64f051d1a8de13e031fd83195e160b9b41c3db8e
Instruction Fuzzy Hash: E6516F7290421AAADF15FBE4CE86EEEB779AF04300F1001A9F54567051DB3A6F48EF60

Uniqueness

Uniqueness Score: -1.00%

Function 00FC6BEC Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00FE0B9B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00FC6C6C,?,00008000), ref: 00FE0BB7

Part of subcall function 00FC48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00FC48A1,?,?,00FC37C0,?), ref: 00FC48CE

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00FC6D0D
SetCurrentDirectoryW.KERNEL32(?), ref: 00FC6E5A

Part of subcall function 00FC59CD: _wcscpy.LIBCMT ref: 00FC5A05

Part of subcall function 00FE387D: _iswctype.LIBCMT ref: 00FE3885

Strings

Error opening the file, xrefs: 00FFE866, 00FFE8E1
>>>AUTOIT SCRIPT<<<, xrefs: 00FFE8BF
EA06, xrefs: 00FFE87B
AU3!, xrefs: 00FC6CC1
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00FFE84A
Unterminated string, xrefs: 00FFEC0D
Bad directive syntax error, xrefs: 00FFEBC6

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: 4fa6437c639d90977c371848d13f3527d0c91ef3a3fc52663795ab80e1e454fc
Instruction ID: 6e1ece3c943f28b6cf53d242f5158281c296860b38ecdc45df93c82c972a3755
Opcode Fuzzy Hash: 4fa6437c639d90977c371848d13f3527d0c91ef3a3fc52663795ab80e1e454fc
Instruction Fuzzy Hash: 7F0289315083429FC724EF24C982EAFBBE5AF98754F04091DF5C6972A1DB34E949EB42

Uniqueness

Uniqueness Score: -1.00%

Function 00FC45DF Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FC45F9
GetMenuItemCount.USER32(01086890), ref: 00FFD7CD
GetMenuItemCount.USER32(01086890), ref: 00FFD87D
GetCursorPos.USER32(?), ref: 00FFD8C1
SetForegroundWindow.USER32(00000000), ref: 00FFD8CA
TrackPopupMenuEx.USER32(01086890,00000000,?,00000000,00000000,00000000), ref: 00FFD8DD
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00FFD8E9

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: a1f7073be8a628b4d687ae60fb8e6a181542e6c64f368f73de1e8ba4f4e03150
Instruction ID: 4b7b10187384f3e656c11ef5053f6c669536fa1c44fc0a11f66a106dabd541d9
Opcode Fuzzy Hash: a1f7073be8a628b4d687ae60fb8e6a181542e6c64f368f73de1e8ba4f4e03150
Instruction Fuzzy Hash: 1F710972A4121ABBEB309F54DD89FBABF65FF05374F200216F6156A1E0C7B56810EB90

Uniqueness

Uniqueness Score: -1.00%

Function 01017D24 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC7D2C: _memmove.LIBCMT ref: 00FC7D66

_memset.LIBCMT ref: 01017DB3
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 01017DE8
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 01017E04
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 01017E20
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 01017E4A
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 01017E72
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 01017E7D
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 01017E82

Strings

SOFTWARE\Classes\, xrefs: 01017D54
\CLSID, xrefs: 01017D6A
\IPC$, xrefs: 01017DCA

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: ac087c3cf8437cf8fcb0691b1a1ba7db1ce032b6664dc22e340b6a88d5e728dc
Instruction ID: c268b31ca73ec3eb9cf1d7b1ecc03e6989c67e0ef35875cefa74edc4946743a7
Opcode Fuzzy Hash: ac087c3cf8437cf8fcb0691b1a1ba7db1ce032b6664dc22e340b6a88d5e728dc
Instruction Fuzzy Hash: D7413672C0022EABDB21EBA4DD86DEEB7B8FF08710F044069F941A3151EB395E05DB90

Uniqueness

Uniqueness Score: -1.00%

Function 010410A5 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,01040038,?,?), ref: 010410BC

Strings

HKCR, xrefs: 01041164
HKEY_CURRENT_CONFIG, xrefs: 01041179
HKEY_CLASSES_ROOT, xrefs: 0104114F
HKEY_CURRENT_USER, xrefs: 0104119B
HKU, xrefs: 010411CE
HKLM, xrefs: 0104113A
HKCU, xrefs: 010411AC
HKEY_LOCAL_MACHINE, xrefs: 01041125
HKEY_USERS, xrefs: 010411BD
HKCC, xrefs: 0104118A

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 1ffae9be09d4efba0875aef29fe363c1f2783ee63a458c176b9ec032f13ee201
Instruction ID: 72bf68602e79e9a6c75d958706e7d7191a2cdcde38d3c532f58aa9a268f4531c
Opcode Fuzzy Hash: 1ffae9be09d4efba0875aef29fe363c1f2783ee63a458c176b9ec032f13ee201
Instruction Fuzzy Hash: 93414BB055028B9BCF21EF94DE81AEE3764BF45310F404464FCD19B292DF75A99ACBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01025569 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00FC7D2C: _memmove.LIBCMT ref: 00FC7D66

Part of subcall function 00FC7A84: _memmove.LIBCMT ref: 00FC7B0D

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 010255D2
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 010255E8
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 010255F9
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0102560B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0102561C

Strings

open , xrefs: 01025581
alias PlayMe, xrefs: 010255AB
close PlayMe, xrefs: 010255E3, 01025610
play PlayMe wait, xrefs: 01025606
play PlayMe, xrefs: 01025617
status PlayMe mode, xrefs: 010255CD

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 076626d24b51d7ae3fc6099ad9c9712c75af5cde4a78c9333833585a3e572e6c
Instruction ID: 55b072a02d98347341838f9420fa97aa93b28ba64655021a5e456c685e889e1f
Opcode Fuzzy Hash: 076626d24b51d7ae3fc6099ad9c9712c75af5cde4a78c9333833585a3e572e6c
Instruction Fuzzy Hash: A311E620A5026AB9E720BA66DC8ADFFBF7CEF85B00F04445DB485A7091DEA41D04C9A4

Uniqueness

Uniqueness Score: -1.00%

Function 010248F3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 0102490E
gethostname.WSOCK32(?,00000100), ref: 01024928
gethostbyname.WSOCK32(?), ref: 01024935
_wcscpy.LIBCMT ref: 0102495D
_memmove.LIBCMT ref: 01024970
inet_ntoa.WSOCK32(?), ref: 0102497B
_strcat.LIBCMT ref: 01024989
_wcscpy.LIBCMT ref: 010249A0
WSACleanup.WSOCK32 ref: 010249AE
_wcscpy.LIBCMT ref: 010249BC

Strings

0.0.0.0, xrefs: 01024957

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: bae6f6877b4c9949cbb9857b371e5d3e1528026606c6b242c281fe39a1e087ed
Instruction ID: 6847a996192befbdb983c3f212e0ff5e8481720a203ba18888abe58bd2b4efd2
Opcode Fuzzy Hash: bae6f6877b4c9949cbb9857b371e5d3e1528026606c6b242c281fe39a1e087ed
Instruction Fuzzy Hash: D8112775A04125ABEB20EB29ED49EDE77FCEF00710F0401BAF584D6041EFB99A819751

Uniqueness

Uniqueness Score: -1.00%

Function 01025217 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0102521C

Part of subcall function 00FE0719: timeGetTime.WINMM(?,75A4B400,00FD0FF9), ref: 00FE071D

Sleep.KERNEL32(0000000A), ref: 01025248
EnumThreadWindows.USER32(?,Function_000651CA,00000000), ref: 0102526C
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0102528E
SetActiveWindow.USER32 ref: 010252AD
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 010252BB
SendMessageW.USER32(00000010,00000000,00000000), ref: 010252DA
Sleep.KERNEL32(000000FA), ref: 010252E5
IsWindow.USER32 ref: 010252F1
EndDialog.USER32(00000000), ref: 01025302

Strings

BUTTON, xrefs: 01025280

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: c3ace3f4bae6ea409589f3ae5b8a200f922b674804c422eaf7f5db77af8732e3
Instruction ID: 0fafb17964c58a76fadb44a109ed7244ff2bdab15a6413b897ce9df2e65a7ca2
Opcode Fuzzy Hash: c3ace3f4bae6ea409589f3ae5b8a200f922b674804c422eaf7f5db77af8732e3
Instruction Fuzzy Hash: EC21F6B4204346EFE7205B38EEC8B6E3BA9EB0A356F501058F1C1851D8DBAF9C048775

Uniqueness

Uniqueness Score: -1.00%

Function 0102D7F8 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC9997: __itow.LIBCMT ref: 00FC99C2
Part of subcall function 00FC9997: __swprintf.LIBCMT ref: 00FC9A0C

CoInitialize.OLE32(00000000), ref: 0102D855
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 0102D8E8
SHGetDesktopFolder.SHELL32(?), ref: 0102D8FC
CoCreateInstance.OLE32(01052D7C,00000000,00000001,0107A89C,?), ref: 0102D948
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 0102D9B7
CoTaskMemFree.OLE32(?,?), ref: 0102DA0F
_memset.LIBCMT ref: 0102DA4C
SHBrowseForFolderW.SHELL32(?), ref: 0102DA88
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0102DAAB
CoTaskMemFree.OLE32(00000000), ref: 0102DAB2
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 0102DAE9
CoUninitialize.OLE32(00000001,00000000), ref: 0102DAEB

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: aced75c071c5f7f08e9d42bcf1401efdd8b6d7264dda3ea1352c2dbbd6cb31fa
Instruction ID: 08b293327973a913f87daf22a6534c3f09da8d61233384baf4bafd90870b2b03
Opcode Fuzzy Hash: aced75c071c5f7f08e9d42bcf1401efdd8b6d7264dda3ea1352c2dbbd6cb31fa
Instruction Fuzzy Hash: ACB14E75A00119AFDB04DFA8C989EAEBBF9FF88300B048499F949DB251DB75ED41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0102052C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 010205A7
SetKeyboardState.USER32(?), ref: 01020612
GetAsyncKeyState.USER32(000000A0), ref: 01020632
GetKeyState.USER32(000000A0), ref: 01020649
GetAsyncKeyState.USER32(000000A1), ref: 01020678
GetKeyState.USER32(000000A1), ref: 01020689
GetAsyncKeyState.USER32(00000011), ref: 010206B5
GetKeyState.USER32(00000011), ref: 010206C3
GetAsyncKeyState.USER32(00000012), ref: 010206EC
GetKeyState.USER32(00000012), ref: 010206FA
GetAsyncKeyState.USER32(0000005B), ref: 01020723
GetKeyState.USER32(0000005B), ref: 01020731

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: df8bc09ef03b926bc6bebdb71d288c965bc24dab9f6e7acb408edab1e2252b91
Instruction ID: 66a21cb796df45eb8ef590b6ec8212aef2453db4e1fbf7c00121cc14761ad38f
Opcode Fuzzy Hash: df8bc09ef03b926bc6bebdb71d288c965bc24dab9f6e7acb408edab1e2252b91
Instruction Fuzzy Hash: 5A512C70A047B819FB75DBB488547EBBFF49F01280F0845C9DAC2561C6DA74978CCB61

Uniqueness

Uniqueness Score: -1.00%

Function 0101C72A Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 0101C746
GetWindowRect.USER32(00000000,?), ref: 0101C758
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 0101C7B6
GetDlgItem.USER32(?,00000002), ref: 0101C7C1
GetWindowRect.USER32(00000000,?), ref: 0101C7D3
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 0101C827
GetDlgItem.USER32(?,000003E9), ref: 0101C835
GetWindowRect.USER32(00000000,?), ref: 0101C846
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 0101C889
GetDlgItem.USER32(?,000003EA), ref: 0101C897
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 0101C8B4
InvalidateRect.USER32(?,00000000,00000001), ref: 0101C8C1

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 0bd9cdf719ab75e41f7120c33cf44fc356ec72beb7f85186aa5df910b0b88485
Instruction ID: 2de1ac9efd6ceed0b39bc83aaefdd35b4c3faddc74fe05914ec970cef2eb9394
Opcode Fuzzy Hash: 0bd9cdf719ab75e41f7120c33cf44fc356ec72beb7f85186aa5df910b0b88485
Instruction Fuzzy Hash: A85153B5B00205AFEB18CF7CDE89AAEBBB5FB88310F14816DF555D6294D775D9008B10

Uniqueness

Uniqueness Score: -1.00%

Function 00FC201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00FC2036,?,00000000,?,?,?,?,00FC16CB,00000000,?), ref: 00FC1B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00FC20D3
KillTimer.USER32(-00000001,?,?,?,?,00FC16CB,00000000,?,?,00FC1AE2,?,?), ref: 00FC216E
DestroyAcceleratorTable.USER32(00000000), ref: 00FFBEF6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00FC16CB,00000000,?,?,00FC1AE2,?,?), ref: 00FFBF27
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00FC16CB,00000000,?,?,00FC1AE2,?,?), ref: 00FFBF3E
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00FC16CB,00000000,?,?,00FC1AE2,?,?), ref: 00FFBF5A
DeleteObject.GDI32(00000000), ref: 00FFBF6C

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 92e4d7d97726e3a9be57c7786365f8788bbe16765134fb43bdc1cebb82b5dfc5
Instruction ID: 19a7b43bc52c8e53eac19e692d75b794347a186d84ddf40db5afcd7a469abd83
Opcode Fuzzy Hash: 92e4d7d97726e3a9be57c7786365f8788bbe16765134fb43bdc1cebb82b5dfc5
Instruction Fuzzy Hash: D861A075904606DFCB35AF18CA89B3977F1FF40322F14451DE5C2865A8C77AA891EF80

Uniqueness

Uniqueness Score: -1.00%

Function 00FC21A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00FC25DB: GetWindowLongW.USER32(?,000000EB), ref: 00FC25EC

GetSysColor.USER32(0000000F), ref: 00FC21D3

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 7439157c6fbf389b4d71c134bc677e39051ac3385bebad3b3781dd1461f21c74
Instruction ID: d5ac86ca2419e936a82a37b2bb9cf8addb196fe772f61dcd173454c3dfb59a30
Opcode Fuzzy Hash: 7439157c6fbf389b4d71c134bc677e39051ac3385bebad3b3781dd1461f21c74
Instruction Fuzzy Hash: 1D4125354001459FEB219F28DA89FF93B65EB06330F184359FEA58A1E6C7328C42FB60

Uniqueness

Uniqueness Score: -1.00%

Function 0102AB12 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,0104F910), ref: 0102AB76
GetDriveTypeW.KERNEL32(00000061,0107A620,00000061), ref: 0102AC40
_wcscpy.LIBCMT ref: 0102AC6A

Strings

ramdisk, xrefs: 0102ABEA
unknown, xrefs: 0102AC01
removable, xrefs: 0102ABA8
fixed, xrefs: 0102ABBE
all, xrefs: 0102AB7C
cdrom, xrefs: 0102AB92
network, xrefs: 0102ABD4

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 64a2b27c052fb48ac07573cba4b0ec2e4e1a5d29163275c732eda40279f70e37
Instruction ID: 0cb85804919a9f58134a4dba3fd39422f0f173379a0cf1a79cac068c401ebd03
Opcode Fuzzy Hash: 64a2b27c052fb48ac07573cba4b0ec2e4e1a5d29163275c732eda40279f70e37
Instruction Fuzzy Hash: 0951AA30208312DBC720EF18CD82EAEB7A5EF84310F14481DF5C69B6A2DF75A949DB52

Uniqueness

Uniqueness Score: -1.00%

Function 00FC9997 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00FC99C2
__swprintf.LIBCMT ref: 00FC9A0C
__i64tow.LIBCMT ref: 00FFFA0F

Strings

False, xrefs: 00FFF9D7
0x%p, xrefs: 00FFF9F1
True, xrefs: 00FFF9D0
%.15g, xrefs: 00FC9A06

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 5dc0b71d5f8b7f6d81cc6601fd747e505a67ee57f5d37b615f63ef568e097b7c
Instruction ID: e3fb74a36be0082ae174813839661ceeb4ef0febfc0702000e23c11254407534
Opcode Fuzzy Hash: 5dc0b71d5f8b7f6d81cc6601fd747e505a67ee57f5d37b615f63ef568e097b7c
Instruction Fuzzy Hash: 47411672A0420AABDB349B35DD46F7A73E8EF44310F20446EE649D7251EEB59941EB10

Uniqueness

Uniqueness Score: -1.00%

Function 010473C1 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 010473D9
CreateMenu.USER32 ref: 010473F4
SetMenu.USER32(?,00000000), ref: 01047403
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 01047490
IsMenu.USER32(?), ref: 010474A6
CreatePopupMenu.USER32 ref: 010474B0
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 010474DD
DrawMenuBar.USER32 ref: 010474E5

Strings

F, xrefs: 010474D1
0, xrefs: 010473CF

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 40b3932b48d91e6b9ca2044cb8709a3f9dbdf0bb003c9c90486c886878e53631
Instruction ID: 0c9d3352f5fea480b7dd8b4b5ebbe318ee9fc32139ddb8aa15b900043f9cefd7
Opcode Fuzzy Hash: 40b3932b48d91e6b9ca2044cb8709a3f9dbdf0bb003c9c90486c886878e53631
Instruction Fuzzy Hash: 27414CB9A00205EFDB20DF68D984EAABBF5FF49310F144069FA95A7351DB35A910CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0104772A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 010477CD
CreateCompatibleDC.GDI32(00000000), ref: 010477D4
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 010477E7
SelectObject.GDI32(00000000,00000000), ref: 010477EF
GetPixel.GDI32(00000000,00000000,00000000), ref: 010477FA
DeleteDC.GDI32(00000000), ref: 01047803
GetWindowLongW.USER32(?,000000EC), ref: 0104780D
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 01047821
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 0104782D

Strings

static, xrefs: 01047765

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 069596b31f1038f881b748c40d2d0acecb8652dc0499e252f84d3c4334264054
Instruction ID: b241ca93bd7b179c67c567f2a504be2a2a55b9224ae0354e91646062e5d848c0
Opcode Fuzzy Hash: 069596b31f1038f881b748c40d2d0acecb8652dc0499e252f84d3c4334264054
Instruction Fuzzy Hash: 2A3180B5101116BBEF229F78DC88FDA3BA9FF0D320F110224FA95A6090C736D811DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00FE7040 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE707B

Part of subcall function 00FE8D68: __getptd_noexit.LIBCMT ref: 00FE8D68

__gmtime64_s.LIBCMT ref: 00FE7114
__gmtime64_s.LIBCMT ref: 00FE714A
__gmtime64_s.LIBCMT ref: 00FE7167
__allrem.LIBCMT ref: 00FE71BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FE71D9
__allrem.LIBCMT ref: 00FE71F0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FE720E
__allrem.LIBCMT ref: 00FE7225
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FE7243
__invoke_watson.LIBCMT ref: 00FE72B4

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction ID: c09d1dfd7bc8e9f8ed3262cbe60fd7c7b6ef81639e0397a47531a7f481ac2b2f
Opcode Fuzzy Hash: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction Fuzzy Hash: 7471E872E04757ABD714BE7ACC41B6BB3A8AF10730F14422AF614E7691E774E940AB90

Uniqueness

Uniqueness Score: -1.00%

Function 01022A16 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 01022A31
GetMenuItemInfoW.USER32(01086890,000000FF,00000000,00000030), ref: 01022A92
SetMenuItemInfoW.USER32(01086890,00000004,00000000,00000030), ref: 01022AC8
Sleep.KERNEL32(000001F4), ref: 01022ADA
GetMenuItemCount.USER32(?), ref: 01022B1E
GetMenuItemID.USER32(?,00000000), ref: 01022B3A
GetMenuItemID.USER32(?,-00000001), ref: 01022B64
GetMenuItemID.USER32(?,?), ref: 01022BA9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 01022BEF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 01022C03
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 01022C24

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 102532fc3a3855cc6400153a21ae5ea4b4d62a69f6d3dd52420dbc06633557a7
Instruction ID: 106370fc8b0acfc3f248f13167a0f5ffb990436b86674c5f8b5b44a2159d1d99
Opcode Fuzzy Hash: 102532fc3a3855cc6400153a21ae5ea4b4d62a69f6d3dd52420dbc06633557a7
Instruction Fuzzy Hash: B261B4B090025AAFEB22CFE8D988DFE7BB8EB45304F144599E9C197241D736AD45CB21

Uniqueness

Uniqueness Score: -1.00%

Function 01047192 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 01047214
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 01047217
GetWindowLongW.USER32(?,000000F0), ref: 0104723B
_memset.LIBCMT ref: 0104724C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0104725E
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 010472D6

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 3334a13b778f04d77cd596333cdf0b10cf53f435c2b460302c7fee8ed9fbf8d9
Instruction ID: f38fef6449d4c2228115f49c98d6f5cedb7ba48373df96deb8c427d71bb787e8
Opcode Fuzzy Hash: 3334a13b778f04d77cd596333cdf0b10cf53f435c2b460302c7fee8ed9fbf8d9
Instruction Fuzzy Hash: 37618FB5900208EFDB20DFA8CC81EEE77F8EB09710F1441A9FA94A7391D775A941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0101710E Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 01017135
SafeArrayAllocData.OLEAUT32(?), ref: 0101718E
VariantInit.OLEAUT32(?), ref: 010171A0
SafeArrayAccessData.OLEAUT32(?,?), ref: 010171C0
VariantCopy.OLEAUT32(?,?), ref: 01017213
SafeArrayUnaccessData.OLEAUT32(?), ref: 01017227
VariantClear.OLEAUT32(?), ref: 0101723C
SafeArrayDestroyData.OLEAUT32(?), ref: 01017249
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 01017252
VariantClear.OLEAUT32(?), ref: 01017264
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0101726F

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 81220e4279c08530c16eef0f949fcd65820147cb5ea9fa08ad1e9386b5cf7153
Instruction ID: 8a81458fa2502ba68ce235f6d63333451f37953bfa9412559f631166371edaad
Opcode Fuzzy Hash: 81220e4279c08530c16eef0f949fcd65820147cb5ea9fa08ad1e9386b5cf7153
Instruction Fuzzy Hash: 8841727590011AAFCB14DF68D988DEDBBB9FF48350F008069F985A7215CF39A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 010386D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC9997: __itow.LIBCMT ref: 00FC99C2
Part of subcall function 00FC9997: __swprintf.LIBCMT ref: 00FC9A0C

CoInitialize.OLE32 ref: 01038718
CoUninitialize.OLE32 ref: 01038723
CoCreateInstance.OLE32(?,00000000,00000017,01052BEC,?), ref: 01038783
IIDFromString.OLE32(?,?), ref: 010387F6
VariantInit.OLEAUT32(?), ref: 01038890
VariantClear.OLEAUT32(?), ref: 010388F1

Strings

NULL Pointer assignment, xrefs: 010387C8
Invalid parameter, xrefs: 0103880F
Failed to create object, xrefs: 0103878E, 01038844

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: d750e4c47f5edb4548d71effaeeb87197e5a08e515bcd374c504e86ebb09bdfc
Instruction ID: 7349168f18160fc44b3318a1e62c8392e86aa3f54abb29f9c2ccacbe1725bc51
Opcode Fuzzy Hash: d750e4c47f5edb4548d71effaeeb87197e5a08e515bcd374c504e86ebb09bdfc
Instruction Fuzzy Hash: 2B61B2706083029FD711DF28D948F5EBBE8AF85714F04898EF5C59B291C774E948CB92

Uniqueness

Uniqueness Score: -1.00%

Function 01035A45 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 01035AA6
inet_addr.WSOCK32(?), ref: 01035AEB
gethostbyname.WSOCK32(?), ref: 01035AF7
IcmpCreateFile.IPHLPAPI ref: 01035B05
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 01035B75
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 01035B8B
IcmpCloseHandle.IPHLPAPI(00000000), ref: 01035C00
WSACleanup.WSOCK32 ref: 01035C06

Strings

Ping, xrefs: 01035B29

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 8fe926df8ccda087049fe09062931c4a5c843f9981199822090b48ee73c2fa0a
Instruction ID: e3e28da2d7faa743799441e6bca21da34d90434347bc1fb5dd698271397f92bc
Opcode Fuzzy Hash: 8fe926df8ccda087049fe09062931c4a5c843f9981199822090b48ee73c2fa0a
Instruction Fuzzy Hash: 485190316047019FD721DF28CD89B2ABBE8EF84710F048969F995DB2A1DB78E840DF41

Uniqueness

Uniqueness Score: -1.00%

Function 0102B72E Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0102B73B
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0102B7B1
GetLastError.KERNEL32 ref: 0102B7BB
SetErrorMode.KERNEL32(00000000,READY), ref: 0102B828

Strings

READONLY, xrefs: 0102B7F3
NOTREADY, xrefs: 0102B7E7
UNKNOWN, xrefs: 0102B7E0
READY, xrefs: 0102B801
INVALID, xrefs: 0102B7FA

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 0978b10324001ac8cc6f239da6694f0066586af3f962bec3a6139ab94f2bd425
Instruction ID: 332d0a101d187ce2b520392d5a5bf2dadb76705e137573120323d7f2e6bb2cb5
Opcode Fuzzy Hash: 0978b10324001ac8cc6f239da6694f0066586af3f962bec3a6139ab94f2bd425
Instruction Fuzzy Hash: 4C31B235A0021A9FDB50EF68CD85EBE7BF4FF44700F18806AE585DB292DB759942CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01019471 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC7F41: _memmove.LIBCMT ref: 00FC7F82

Part of subcall function 0101B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0101B0E7

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 010194F6
GetDlgCtrlID.USER32 ref: 01019501
GetParent.USER32 ref: 0101951D
SendMessageW.USER32(00000000,?,00000111,?), ref: 01019520
GetDlgCtrlID.USER32(?), ref: 01019529
GetParent.USER32(?), ref: 01019545
SendMessageW.USER32(00000000,?,?,00000111), ref: 01019548

Strings

ComboBox, xrefs: 0101947E
ListBox, xrefs: 010194B3

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 13bce72289aff73b1a1a80b4766d25f69c170d23009553345ff0fe4eb033e625
Instruction ID: 1bef25fea2f5601c23881a8e24fa5c1a26eb7a866ae5e05dcf8c3070838a815d
Opcode Fuzzy Hash: 13bce72289aff73b1a1a80b4766d25f69c170d23009553345ff0fe4eb033e625
Instruction Fuzzy Hash: 9621F174A00205BBDF00AB69CCD5EFEBBB4EF49350F000159B9A297295DB7E9518DB20

Uniqueness

Uniqueness Score: -1.00%

Function 0101955C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC7F41: _memmove.LIBCMT ref: 00FC7F82

Part of subcall function 0101B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0101B0E7

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 010195DF
GetDlgCtrlID.USER32 ref: 010195EA
GetParent.USER32 ref: 01019606
SendMessageW.USER32(00000000,?,00000111,?), ref: 01019609
GetDlgCtrlID.USER32(?), ref: 01019612
GetParent.USER32(?), ref: 0101962E
SendMessageW.USER32(00000000,?,?,00000111), ref: 01019631

Strings

ComboBox, xrefs: 01019569
ListBox, xrefs: 0101959E

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 5256bbd2635d0d6bd5dd35a6e2db32ea8048616e78ec4c1437cdc78439b70366
Instruction ID: 19976381138c170e88db36afc4bf066f4ccfa3a9ce5ebaa961e5ae42b8d6c76b
Opcode Fuzzy Hash: 5256bbd2635d0d6bd5dd35a6e2db32ea8048616e78ec4c1437cdc78439b70366
Instruction Fuzzy Hash: 8D21D374900205BBDF00ABB5CCD5EFEBBB8EF58300F000159B99197199DB7E9519DB20

Uniqueness

Uniqueness Score: -1.00%

Function 01019645 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 01019651
GetClassNameW.USER32(00000000,?,00000100), ref: 01019666
_wcscmp.LIBCMT ref: 01019678
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 010196F3

Strings

list, xrefs: 010196D5
details, xrefs: 010196A1
smallicons, xrefs: 010196BB
SHELLDLL_DefView, xrefs: 01019672
largeicons, xrefs: 01019687

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: bb128bd0978fb9c7f560f6d4e266953c457e5c7cc2a21af5da2c3281ff5f853d
Instruction ID: 89354ce76c998eaaaef2dedb314c77034008b3dc729f289e602e52c9555205f9
Opcode Fuzzy Hash: bb128bd0978fb9c7f560f6d4e266953c457e5c7cc2a21af5da2c3281ff5f853d
Instruction Fuzzy Hash: 74115C7A648313BAF611252ADC2FDA677DC9B09378F10001AF940E5096FE6E6500C768

Uniqueness

Uniqueness Score: -1.00%

Function 01038BC0 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 01038BEC
CoInitialize.OLE32(00000000), ref: 01038C19
CoUninitialize.OLE32 ref: 01038C23
GetRunningObjectTable.OLE32(00000000,?), ref: 01038D23
SetErrorMode.KERNEL32(00000001,00000029), ref: 01038E50
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,01052C0C), ref: 01038E84
CoGetObject.OLE32(?,00000000,01052C0C,?), ref: 01038EA7
SetErrorMode.KERNEL32(00000000), ref: 01038EBA
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 01038F3A
VariantClear.OLEAUT32(?), ref: 01038F4A

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 340284ef5ca951b3c6131b7dd5b1f6664c2f4b8040994c57d03563af2b51e843
Instruction ID: d52d11481a64b3f29c42682d7a51293d5b78fed81184917cb0088db4f7145dda
Opcode Fuzzy Hash: 340284ef5ca951b3c6131b7dd5b1f6664c2f4b8040994c57d03563af2b51e843
Instruction Fuzzy Hash: 37C127B1208306AFD700DF68C98496BBBE9FF89748F004A9DF5899B251DB71ED05CB52

Uniqueness

Uniqueness Score: -1.00%

Function 01024189 Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 0102419D
__swprintf.LIBCMT ref: 010241AA

Part of subcall function 00FE38D8: __woutput_l.LIBCMT ref: 00FE3931

FindResourceW.KERNEL32(?,?,0000000E), ref: 010241D4
LoadResource.KERNEL32(?,00000000), ref: 010241E0
LockResource.KERNEL32(00000000), ref: 010241ED
FindResourceW.KERNEL32(?,?,00000003), ref: 0102420D
LoadResource.KERNEL32(?,00000000), ref: 0102421F
SizeofResource.KERNEL32(?,00000000), ref: 0102422E
LockResource.KERNEL32(?), ref: 0102423A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 0102429B

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: 81da1dfe2c8887e2a16802a900f455d20cd2eab0ba0b8642d5fdc2f396ea7abf
Instruction ID: fc1d51308d888d1a64518ad4705c25236c862e2939d8c013b7d9d45d59aeeb1d
Opcode Fuzzy Hash: 81da1dfe2c8887e2a16802a900f455d20cd2eab0ba0b8642d5fdc2f396ea7abf
Instruction Fuzzy Hash: 7C31C1B5A0122AAFDB219FA5DE88EBF7BACEF05301F044555F981D2140D779DA11CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 010216DE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 01021700
GetForegroundWindow.USER32(00000000,?,?,?,?,?,01020778,?,00000001), ref: 01021714
GetWindowThreadProcessId.USER32(00000000), ref: 0102171B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,01020778,?,00000001), ref: 0102172A
GetWindowThreadProcessId.USER32(?,00000000), ref: 0102173C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,01020778,?,00000001), ref: 01021755
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,01020778,?,00000001), ref: 01021767
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,01020778,?,00000001), ref: 010217AC
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,01020778,?,00000001), ref: 010217C1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,01020778,?,00000001), ref: 010217CC

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 5ee7027b5ce8c50979c3025bdc274488fc8118ae256f74d074bc6cb70d871a35
Instruction ID: 55e9cf9bfd32eb2735a84342cdec4386219881c7a649c4706141f555e3d8243b
Opcode Fuzzy Hash: 5ee7027b5ce8c50979c3025bdc274488fc8118ae256f74d074bc6cb70d871a35
Instruction Fuzzy Hash: A331B475600614BBEB319F29D984B6E7BF9BB89711F204055F9C0C628AD7799940CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FCFBBD Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00FCFC06
OleUninitialize.OLE32(?,00000000), ref: 00FCFCA5
UnregisterHotKey.USER32(?), ref: 00FCFDFC
DestroyWindow.USER32(?), ref: 01004A00
FreeLibrary.KERNEL32(?), ref: 01004A65
VirtualFree.KERNEL32(?,00000000,00008000), ref: 01004A92

Strings

close all, xrefs: 00FCFC01

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 3aeff553afe28915e030095c0d30327da908938913d8938afc716fc3f6df859e
Instruction ID: 446da47fa6da12458685a4e63c76fdd7f1de48b163972a118f8a54300e14234a
Opcode Fuzzy Hash: 3aeff553afe28915e030095c0d30327da908938913d8938afc716fc3f6df859e
Instruction Fuzzy Hash: 5CA1CD317012138FDB2AEF14CA95F69F7A1BF04700F1442ADE94AAB292CB34AD56DF54

Uniqueness

Uniqueness Score: -1.00%

Function 0101A693 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,0101AA64), ref: 0101A9A2

Strings

REGEXPCLASS, xrefs: 0101A767
CLASS, xrefs: 0101A721
INSTANCE, xrefs: 0101A8B0
TEXT, xrefs: 0101A8D9
CLASSNN, xrefs: 0101A744
NAME, xrefs: 0101A7D4

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 0215038d09b370ca31335d275327de10829f527c29a81b83b3f9178be62ad8ec
Instruction ID: 2043d53cada96c10b37b45fdc4c39e621ca4b5d43cf6d52f2281d43233ca77b5
Opcode Fuzzy Hash: 0215038d09b370ca31335d275327de10829f527c29a81b83b3f9178be62ad8ec
Instruction Fuzzy Hash: F491A230A01687EBDB58EF64C881BEDFBB5BF04314F008159D9CAA7145DF386A99DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FC2E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00FC2EAE

Part of subcall function 00FC1DB3: GetClientRect.USER32(?,?), ref: 00FC1DDC
Part of subcall function 00FC1DB3: GetWindowRect.USER32(?,?), ref: 00FC1E1D
Part of subcall function 00FC1DB3: ScreenToClient.USER32(?,?), ref: 00FC1E45

GetDC.USER32 ref: 00FFCF82
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00FFCF95
SelectObject.GDI32(00000000,00000000), ref: 00FFCFA3
SelectObject.GDI32(00000000,00000000), ref: 00FFCFB8
ReleaseDC.USER32(?,00000000), ref: 00FFCFC0
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00FFD04B

Strings

U, xrefs: 00FFCF20

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 785be575d9860315501aa33e2aff1377a363d9ac24e23a9c79ca01a62703c4c1
Instruction ID: 595ffe933c7277aace115b234fd4c795e1c6e498151137c704106655649370cd
Opcode Fuzzy Hash: 785be575d9860315501aa33e2aff1377a363d9ac24e23a9c79ca01a62703c4c1
Instruction Fuzzy Hash: CE71D77180020EDFCF219F64C985BBA7BB6FF49360F144269EE959A1A9C7358C41FB60

Uniqueness

Uniqueness Score: -1.00%

Function 0104C27C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC2612: GetWindowLongW.USER32(?,000000EB), ref: 00FC2623

Part of subcall function 00FC2344: GetCursorPos.USER32(?), ref: 00FC2357
Part of subcall function 00FC2344: ScreenToClient.USER32(010867B0,?), ref: 00FC2374
Part of subcall function 00FC2344: GetAsyncKeyState.USER32(00000001), ref: 00FC2399
Part of subcall function 00FC2344: GetAsyncKeyState.USER32(00000002), ref: 00FC23A7

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 0104C2E4
ImageList_EndDrag.COMCTL32 ref: 0104C2EA
ReleaseCapture.USER32 ref: 0104C2F0
SetWindowTextW.USER32(?,00000000), ref: 0104C39A
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0104C3AD
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 0104C48F

Strings

@GUI_DRAGFILE, xrefs: 0104C424
@GUI_DROPID, xrefs: 0104C3E1

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 4705e5bf7554e2ad52a0dc5e63f039ebe973b777ab61152ae3d4b3fc8c5845d1
Instruction ID: d5e3ca9b30c0bd804530198ff6b8dfe830d0b7e38658d6267bd9dfe818491f2d
Opcode Fuzzy Hash: 4705e5bf7554e2ad52a0dc5e63f039ebe973b777ab61152ae3d4b3fc8c5845d1
Instruction Fuzzy Hash: 8751AEB4208306AFD710EF24CA96F6E7BE1FB88310F00452DF5D58B2A1DB7AA944DB51

Uniqueness

Uniqueness Score: -1.00%

Function 01031D09 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 01031D44
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 01031D70
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 01031DB2
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 01031DC7
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 01031DD4
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 01031E04
InternetCloseHandle.WININET(00000000), ref: 01031E4B

Part of subcall function 01032777: GetLastError.KERNEL32(?,?,01031B0B,00000000,00000000,00000001), ref: 0103278C
Part of subcall function 01032777: SetEvent.KERNEL32(?,?,01031B0B,00000000,00000000,00000001), ref: 010327A1

Strings

, xrefs: 01031DF5

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: 15093b612b983d6e61bd47de1f33af492744bf0e69899bee148b4387c310724c
Instruction ID: 0cded594cbb9953137f3c733ec581a57674bed84220d9aee383b329e9322b609
Opcode Fuzzy Hash: 15093b612b983d6e61bd47de1f33af492744bf0e69899bee148b4387c310724c
Instruction Fuzzy Hash: 83418BB5500209BFEB129F54CC89FFF7BACFF49754F004156FA859A284D7799A408BA0

Uniqueness

Uniqueness Score: -1.00%

Function 01038F5B Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,0104F910), ref: 0103903D
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0104F910), ref: 01039071
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 010391EB
SysFreeString.OLEAUT32(?), ref: 01039215

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: de5b004e0a63396dc9089a0f1307055ca1d982fdca3236f47bbeba11cac9a7af
Instruction ID: 9b250065ba37dd12edeb21b8778df0499a8627d4cd7090f7e9c89276ee3be56f
Opcode Fuzzy Hash: de5b004e0a63396dc9089a0f1307055ca1d982fdca3236f47bbeba11cac9a7af
Instruction Fuzzy Hash: 9FF14D75A00109EFDF14DF98C888EAEB7B9FF89318F108099F556AB251CB71AE45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0103F9A8 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0103F9C9
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0103FB5C
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0103FB80
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0103FBC0
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0103FBE2
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0103FD5E
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 0103FD90
CloseHandle.KERNEL32(?), ref: 0103FDBF
CloseHandle.KERNEL32(?), ref: 0103FE36

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 380ab31b831bd9fa520748b5f1eb0f7cbfe9db44b3d0fb48a8cf9b15d245cb7c
Instruction ID: ca9cc8ed1d3619a345700b387eb2a71871f220e71ca878d71529d5826c91a42a
Opcode Fuzzy Hash: 380ab31b831bd9fa520748b5f1eb0f7cbfe9db44b3d0fb48a8cf9b15d245cb7c
Instruction Fuzzy Hash: 25E1C0716043429FCB14EF28C985B6ABBE5AF84350F04845DF9DA8B2A2CB75DC45CB52

Uniqueness

Uniqueness Score: -1.00%

Function 01024F63 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 010248AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,010238D3,?), ref: 010248C7

Part of subcall function 010248AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,010238D3,?), ref: 010248E0

Part of subcall function 01024CD3: GetFileAttributesW.KERNEL32(?,01023947), ref: 01024CD4

lstrcmpiW.KERNEL32(?,?), ref: 01024FE2
_wcscmp.LIBCMT ref: 01024FFC
MoveFileW.KERNEL32(?,?), ref: 01025017

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: fc46d362a56b79e86d7176d56adf11e31cae33d627f4a8442fa4282258c18ac3
Instruction ID: b16bddbcacc5f4da88aea597ace4b6d3276e0dfdbd5a0692744813fd1cdf85da
Opcode Fuzzy Hash: fc46d362a56b79e86d7176d56adf11e31cae33d627f4a8442fa4282258c18ac3
Instruction Fuzzy Hash: 555173B20083959BC764EB64DC85DDFB7ECAF84341F10492EF2C9D3151EE79A188876A

Uniqueness

Uniqueness Score: -1.00%

Function 010488B4 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0104896E

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: eb54c13dbc352428e957a8988ec7546bbf8b667668430cccb9516e0dc6ab6497
Instruction ID: fdd1258a5d379f6b62818efd2dfaf62844fbba4f026ad00a95c84815c56dda23
Opcode Fuzzy Hash: eb54c13dbc352428e957a8988ec7546bbf8b667668430cccb9516e0dc6ab6497
Instruction Fuzzy Hash: 1C51D3B0500205BBFF349EA8DCC5B9D7BA4FB04310F108967F694E61D1CBB5A990CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00FC2B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00FFC547
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00FFC569
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00FFC581
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00FFC59F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00FFC5C0
DestroyIcon.USER32(00000000), ref: 00FFC5CF
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00FFC5EC
DestroyIcon.USER32(?), ref: 00FFC5FB

Part of subcall function 0104A71E: DeleteObject.GDI32(00000000), ref: 0104A757

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: 6c3ef8b1eeac22143ea1a322110b2620695ea7422588e77e1d8841c72e57591d
Instruction ID: 79717c661ef6cc9e0d53bab90e569baa839f3cf0004bb2b9aea3ce4b5edb87a1
Opcode Fuzzy Hash: 6c3ef8b1eeac22143ea1a322110b2620695ea7422588e77e1d8841c72e57591d
Instruction Fuzzy Hash: C7515A74A0020AAFDB24DF24CA46FAA37A5EF58360F140518F94697290DB75ED90EB90

Uniqueness

Uniqueness Score: -1.00%

Function 01019B50 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0101AE57: GetWindowThreadProcessId.USER32(?,00000000), ref: 0101AE77
Part of subcall function 0101AE57: GetCurrentThreadId.KERNEL32 ref: 0101AE7E
Part of subcall function 0101AE57: AttachThreadInput.USER32(00000000,?,01019B65,?,00000001), ref: 0101AE85

MapVirtualKeyW.USER32(00000025,00000000), ref: 01019B70
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 01019B8D
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 01019B90
MapVirtualKeyW.USER32(00000025,00000000), ref: 01019B99
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 01019BB7
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 01019BBA
MapVirtualKeyW.USER32(00000025,00000000), ref: 01019BC3
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 01019BDA
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 01019BDD

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: a867404daa0c4c8f83f9f691239d52f26709895196546cc0ddb9f90d2a3adef6
Instruction ID: 0b8b06ac6d9fac8d6e4ed33df3a88409a1dcc1e22c380f2e344a3c9b95f71fd1
Opcode Fuzzy Hash: a867404daa0c4c8f83f9f691239d52f26709895196546cc0ddb9f90d2a3adef6
Instruction Fuzzy Hash: 1111E1B5A50219BFF6206B74DC89FAA3B6DEB4C795F100415F284AB094C9F75C10DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 01018E03 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,01018A84,00000B00,?,?), ref: 01018E0C
HeapAlloc.KERNEL32(00000000,?,01018A84,00000B00,?,?), ref: 01018E13
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,01018A84,00000B00,?,?), ref: 01018E28
GetCurrentProcess.KERNEL32(?,00000000,?,01018A84,00000B00,?,?), ref: 01018E30
DuplicateHandle.KERNEL32(00000000,?,01018A84,00000B00,?,?), ref: 01018E33
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,01018A84,00000B00,?,?), ref: 01018E43
GetCurrentProcess.KERNEL32(01018A84,00000000,?,01018A84,00000B00,?,?), ref: 01018E4B
DuplicateHandle.KERNEL32(00000000,?,01018A84,00000B00,?,?), ref: 01018E4E
CreateThread.KERNEL32(00000000,00000000,01018E74,00000000,00000000,00000000), ref: 01018E68

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 92df2292e70286867dd3ce00cbd5be44c9615afb89828029f29bc502ecb14473
Instruction ID: d25ba754b7db1e1c069e249ac728c3b2dd0363fddfa30633de5e5ed087854a23
Opcode Fuzzy Hash: 92df2292e70286867dd3ce00cbd5be44c9615afb89828029f29bc502ecb14473
Instruction Fuzzy Hash: 1501BBB9240309BFE720ABA9DD8DF6B3BACEB89711F004411FA45DB195CA759800CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01039428 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0103947C
VariantInit.OLEAUT32(?), ref: 0103954D
VariantInit.OLEAUT32(?), ref: 0103964E
VariantClear.OLEAUT32(?), ref: 01039658
VariantClear.OLEAUT32(?), ref: 010396B5

Strings

Incorrect Object type in FOR..IN loop, xrefs: 01039631
Null Object assignment in FOR..IN loop, xrefs: 010394DD, 0103960B, 010396C3

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: eac271284911080ea0cb17c512566f430fd2fc7106ca52e2506b9b8f736cb622
Instruction ID: 69037e3eadfd935f42c50054321875e6e3970365d691e873a8d7cd9525d09417
Opcode Fuzzy Hash: eac271284911080ea0cb17c512566f430fd2fc7106ca52e2506b9b8f736cb622
Instruction Fuzzy Hash: A191B371A00205EBDF25DFA5C844FAEBBBCEF89318F008559F555AB281D7B09944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01039A72 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 01017652: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0101758C,80070057,?,?,?,0101799D), ref: 0101766F
Part of subcall function 01017652: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0101758C,80070057,?,?), ref: 0101768A
Part of subcall function 01017652: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0101758C,80070057,?,?), ref: 01017698
Part of subcall function 01017652: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0101758C,80070057,?), ref: 010176A8

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 01039B1B
_memset.LIBCMT ref: 01039B28
_memset.LIBCMT ref: 01039C6B
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 01039C97
CoTaskMemFree.OLE32(?), ref: 01039CA2

Strings

NULL Pointer assignment, xrefs: 01039CF0

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: c27e5b83e6563094b2bf5372450a1b6bf3c82c3bdad5171df144c96732a6f441
Instruction ID: ff7e6ef17cea125826480bd4366a456dd30b08dba23c9d6dd5cd8d2a490e043c
Opcode Fuzzy Hash: c27e5b83e6563094b2bf5372450a1b6bf3c82c3bdad5171df144c96732a6f441
Instruction Fuzzy Hash: 02917771D0022DEBDB10DFA5DC85EDEBBB8AF48710F20415AE509A7240DB75AA40CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01046FEF Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 01047093
SendMessageW.USER32(?,00001036,00000000,?), ref: 010470A7
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 010470C1
_wcscat.LIBCMT ref: 0104711C
SendMessageW.USER32(?,00001057,00000000,?), ref: 01047133
SendMessageW.USER32(?,00001061,?,0000000F), ref: 01047161

Strings

SysListView32, xrefs: 01047065

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 5928bb40eaa78b3f2928363675f002a56495a4fa0b18bbe092fbc470451edcae
Instruction ID: 97773ecc20b5ece0a198e24eade10d82465562a9c94f1dd27027b5e90543fb0c
Opcode Fuzzy Hash: 5928bb40eaa78b3f2928363675f002a56495a4fa0b18bbe092fbc470451edcae
Instruction Fuzzy Hash: 4F4191B5A00309EFEB219F68CC85BEE77E9EF08350F10057AF6C5A7192D77699848B50

Uniqueness

Uniqueness Score: -1.00%

Function 0103EC47 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 01023E91: CreateToolhelp32Snapshot.KERNEL32 ref: 01023EB6
Part of subcall function 01023E91: Process32FirstW.KERNEL32(00000000,?), ref: 01023EC4
Part of subcall function 01023E91: CloseHandle.KERNEL32(00000000), ref: 01023F8E

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0103ECB8
GetLastError.KERNEL32 ref: 0103ECCB
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0103ECFA
TerminateProcess.KERNEL32(00000000,00000000), ref: 0103ED77
GetLastError.KERNEL32(00000000), ref: 0103ED82
CloseHandle.KERNEL32(00000000), ref: 0103EDB7

Strings

SeDebugPrivilege, xrefs: 0103ECD6

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 0a74a5ffc57d2d1c7d438bf631d7f834ff3cedea53f8c04def328bb32dc135b0
Instruction ID: f8e6c773f96f6432fdfdc11c89ad086bc1fefd6adf51ecbc775f02ea05d8c4a2
Opcode Fuzzy Hash: 0a74a5ffc57d2d1c7d438bf631d7f834ff3cedea53f8c04def328bb32dc135b0
Instruction Fuzzy Hash: 3C41B5712042029FDB15EF18CC99F6DB7E5AF80714F08815DF9869F2C2DBB9A804CB55

Uniqueness

Uniqueness Score: -1.00%

Function 01023226 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 010232C5

Strings

info, xrefs: 01023266
blank, xrefs: 01023247
warning, xrefs: 010232AE
stop, xrefs: 01023296
question, xrefs: 0102327E

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 5751796727ee0d8cf9d4b51d8a6f573ed26bf7dfea98f2dc554ccdd250badb50
Instruction ID: e2d06c561c53e696028a50002ce59ad2cd41c8ca4f0c102297e9b1d397cf8221
Opcode Fuzzy Hash: 5751796727ee0d8cf9d4b51d8a6f573ed26bf7dfea98f2dc554ccdd250badb50
Instruction Fuzzy Hash: 84112B31B083A6BBE7015A59DC47D6EB7DCFF0E670F10005EF580AF182D67D664486A4

Uniqueness

Uniqueness Score: -1.00%

Function 01024534 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0102454E
LoadStringW.USER32(00000000), ref: 01024555
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0102456B
LoadStringW.USER32(00000000), ref: 01024572
_wprintf.LIBCMT ref: 01024598
MessageBoxW.USER32(00000000,?,?,00011010), ref: 010245B6

Strings

%s (%d) : ==> %s: %s %s, xrefs: 01024593

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 177894805b5efdba201835129e31388b7c0c1d4344db515e465bc3c83029fd69
Instruction ID: 7d7c6515c14c0847aadca8456184883a92551be2265460db750c46286569b514
Opcode Fuzzy Hash: 177894805b5efdba201835129e31388b7c0c1d4344db515e465bc3c83029fd69
Instruction Fuzzy Hash: A201DBF68002197FE720D7A4DEC9EF7776CD708300F000595BB85D2002EA355E854B70

Uniqueness

Uniqueness Score: -1.00%

Function 0104D74C Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC2612: GetWindowLongW.USER32(?,000000EB), ref: 00FC2623

GetSystemMetrics.USER32(0000000F), ref: 0104D78A
GetSystemMetrics.USER32(0000000F), ref: 0104D7AA
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0104D9E5
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0104DA03
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0104DA24
ShowWindow.USER32(00000003,00000000), ref: 0104DA43
InvalidateRect.USER32(?,00000000,00000001), ref: 0104DA68
DefDlgProcW.USER32(?,00000005,?,?), ref: 0104DA8B

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 05c8309a071f82fbc7528e8cd1269571fedb6a99f5bfe39163d3d40bec074dae
Instruction ID: 1c4636f6d3579b25d4951044c690f729c5adc882b5f5f8e257d4ac906bd424dc
Opcode Fuzzy Hash: 05c8309a071f82fbc7528e8cd1269571fedb6a99f5bfe39163d3d40bec074dae
Instruction Fuzzy Hash: 28B177B5600216EBEF14CFACC5C57AD7BF2BF54701F0881B9ED889A289D735A950CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FC2A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00FFC417,00000004,00000000,00000000,00000000), ref: 00FC2ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00FFC417,00000004,00000000,00000000,00000000,000000FF), ref: 00FC2B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00FFC417,00000004,00000000,00000000,00000000), ref: 00FFC46A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00FFC417,00000004,00000000,00000000,00000000), ref: 00FFC4D6

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 5a2dd4fab95832eeb50be8e319e1b5676194bd7249e2564786217132205fac7a
Instruction ID: ee5f35f63e7ff7394cef47efeb5f9dca98081d61150fbd2039d4f519dd859a14
Opcode Fuzzy Hash: 5a2dd4fab95832eeb50be8e319e1b5676194bd7249e2564786217132205fac7a
Instruction Fuzzy Hash: DB412A71A086869BC7B9DB2C9FDAF7A3B91FF85320F14880DE18786560C67E9841F750

Uniqueness

Uniqueness Score: -1.00%

Function 01027368 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0102737F

Part of subcall function 00FE0FF6: std::exception::exception.LIBCMT ref: 00FE102C
Part of subcall function 00FE0FF6: __CxxThrowException@8.LIBCMT ref: 00FE1041

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 010273B6
EnterCriticalSection.KERNEL32(?), ref: 010273D2
_memmove.LIBCMT ref: 01027420
_memmove.LIBCMT ref: 0102743D
LeaveCriticalSection.KERNEL32(?), ref: 0102744C
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 01027461
InterlockedExchange.KERNEL32(?,000001F6), ref: 01027480

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 6ac30b7636a9cf7edc79a2fcba61c12589d0fa13d366dd864235da6a281a5752
Instruction ID: 17a6824fd9f5b5732af7430cce0b532db692985644449915c2d70d51826788f3
Opcode Fuzzy Hash: 6ac30b7636a9cf7edc79a2fcba61c12589d0fa13d366dd864235da6a281a5752
Instruction Fuzzy Hash: 9131CF75900246EBDF10EF69CD85AAFBBB8FF45310B1440A5F944AB24ADB35DA10DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01046442 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 0104645A
GetDC.USER32(00000000), ref: 01046462
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0104646D
ReleaseDC.USER32(00000000,00000000), ref: 01046479
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 010464B5
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 010464C6
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,01049299,?,?,000000FF,00000000,?,000000FF,?), ref: 01046500
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 01046520

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 8d62ac627dd1fa7b7ffc25e4532b813661e5ec872c4ec3298c8dc810c3212542
Instruction ID: 372aaa1822fa72986138b2f922b0545e122344ebd0aff47eeb1abaa2aa6853c2
Opcode Fuzzy Hash: 8d62ac627dd1fa7b7ffc25e4532b813661e5ec872c4ec3298c8dc810c3212542
Instruction Fuzzy Hash: EF3193B52011107FEB218F54CD85FE73FA9EF4A751F0400A5FE489A195D67A9841CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0101C072 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0101C087
_memcmp.LIBCMT ref: 0101C0A9
_memcmp.LIBCMT ref: 0101C0C1
_memcmp.LIBCMT ref: 0101C0D4
_memcmp.LIBCMT ref: 0101C0EE
_memcmp.LIBCMT ref: 0101C101
_memcmp.LIBCMT ref: 0101C119
_memcmp.LIBCMT ref: 0101C134

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 32ac2192bb84eca07adb2db7adb0eea1f54c5874a06b98be7b4f41493bfa9e35
Instruction ID: ae5926950b5102db7bbe2158dd79f481bd64d92381729193cb472fc50f2e4577
Opcode Fuzzy Hash: 32ac2192bb84eca07adb2db7adb0eea1f54c5874a06b98be7b4f41493bfa9e35
Instruction Fuzzy Hash: 0821D7727C1209B7F392A5278E42FAF379CAF12294B040024FE899A247E769DD11C1A6

Uniqueness

Uniqueness Score: -1.00%

Function 0102ED8E Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00FC9997: __itow.LIBCMT ref: 00FC99C2
Part of subcall function 00FC9997: __swprintf.LIBCMT ref: 00FC9A0C

Part of subcall function 00FDFEC6: _wcscpy.LIBCMT ref: 00FDFEE9

_wcstok.LIBCMT ref: 0102EEFF
_wcscpy.LIBCMT ref: 0102EF8E
_memset.LIBCMT ref: 0102EFC1

Strings

X, xrefs: 0102EFFE

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: a185a376b19138b64378bb5b1a88ee035400b4a1e68285f07aedfed8184d19dd
Instruction ID: b065cd47464cb3e81e7cf0eb153cdb373ad26012739e96cbc1d3989aa1291abe
Opcode Fuzzy Hash: a185a376b19138b64378bb5b1a88ee035400b4a1e68285f07aedfed8184d19dd
Instruction Fuzzy Hash: 7EC1AF315083529FD764EF24C986E5AB7E4BF84310F00496DF9D98B2A2DB74ED44DB82

Uniqueness

Uniqueness Score: -1.00%

Function 01036E17 Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?), ref: 01036F14
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 01036F35
WSAGetLastError.WSOCK32(00000000), ref: 01036F48
htons.WSOCK32(?), ref: 01036FFE
inet_ntoa.WSOCK32(?), ref: 01036FBB

Part of subcall function 0101AE14: _strlen.LIBCMT ref: 0101AE1E
Part of subcall function 0101AE14: _memmove.LIBCMT ref: 0101AE40

_strlen.LIBCMT ref: 01037058
_memmove.LIBCMT ref: 010370C1

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: 9c93c77ad63ad19fc493c891da0292f429fd376c2d4a908e14e358307e2682cf
Instruction ID: 63e12e0c3018af97015c461e8eb09dd2c0219f9707d05406f41f616d10ea6587
Opcode Fuzzy Hash: 9c93c77ad63ad19fc493c891da0292f429fd376c2d4a908e14e358307e2682cf
Instruction Fuzzy Hash: 0481DF75104302ABD710EB28CD86F6FB7E9AFC4714F00491CF5959B292DA79AE05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FC1424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e96ef96a2fd6f095c114c915078d4fec04398671391c34c170067b1c81a356f9
Instruction ID: 1d4338822af0a1421a8c9146f986375a8c977f2c3b473357a22e4fee73991aaf
Opcode Fuzzy Hash: e96ef96a2fd6f095c114c915078d4fec04398671391c34c170067b1c81a356f9
Instruction Fuzzy Hash: C071807590010AEFCB14CF58CD85FBEBB79FF86324F248149F915AA252C734AA61DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0104B60B Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01834D88), ref: 0104B6A5
IsWindowEnabled.USER32(01834D88), ref: 0104B6B1
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0104B795
SendMessageW.USER32(01834D88,000000B0,?,?), ref: 0104B7CC
IsDlgButtonChecked.USER32(?,?), ref: 0104B809
GetWindowLongW.USER32(01834D88,000000EC), ref: 0104B82B
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0104B843

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 9de30d596e4d651011b488a885b69921cdc5de79c36d1429a2bf4a6749e859e4
Instruction ID: f2360f9b56d9a7d0c728e712d141e39bdfab7c9a59dc80f05dbe7df087ea3fa6
Opcode Fuzzy Hash: 9de30d596e4d651011b488a885b69921cdc5de79c36d1429a2bf4a6749e859e4
Instruction Fuzzy Hash: 7C719EB4604205AFEB65EF68C8D4FAA7BF9FF09340F0840A9EAC597251C736E941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0103F732 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0103F75C
_memset.LIBCMT ref: 0103F825
ShellExecuteExW.SHELL32(?), ref: 0103F86A

Part of subcall function 00FC9997: __itow.LIBCMT ref: 00FC99C2
Part of subcall function 00FC9997: __swprintf.LIBCMT ref: 00FC9A0C

Part of subcall function 00FDFEC6: _wcscpy.LIBCMT ref: 00FDFEE9

GetProcessId.KERNEL32(00000000), ref: 0103F8E1
CloseHandle.KERNEL32(00000000), ref: 0103F910

Strings

@, xrefs: 0103F839

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 5706739efdb877e8706f5e346647a87b0e7149ff73e03cc2a27fad161a5dba5e
Instruction ID: c419759055dc6bf615656a4da87e47797c8eb0cd25d8dc6a31fe244dfe675aeb
Opcode Fuzzy Hash: 5706739efdb877e8706f5e346647a87b0e7149ff73e03cc2a27fad161a5dba5e
Instruction Fuzzy Hash: C461C075E0061ADFCB14EF54C985AAEBBF4FF88310B14805DE88AAB351CB34AD40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0102145D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0102149C
GetKeyboardState.USER32(?), ref: 010214B1
SetKeyboardState.USER32(?), ref: 01021512
PostMessageW.USER32(?,00000101,00000010,?), ref: 01021540
PostMessageW.USER32(?,00000101,00000011,?), ref: 0102155F
PostMessageW.USER32(?,00000101,00000012,?), ref: 010215A5
PostMessageW.USER32(?,00000101,0000005B,?), ref: 010215C8

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 7d2ec55a8b7697a9e60233923e1377b11c892661d827287dda885068ebcd5532
Instruction ID: 98e9f08d12e6e0fb1a687d0404f8a981c7188d50ac4b06f1f30cd9aa5d6c3e64
Opcode Fuzzy Hash: 7d2ec55a8b7697a9e60233923e1377b11c892661d827287dda885068ebcd5532
Instruction Fuzzy Hash: 9151C2B0A047F67EFB3646388C45BBA7EE96F06304F0C45C9E2D9558C2D7B99884D750

Uniqueness

Uniqueness Score: -1.00%

Function 01021276 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 010212B5
GetKeyboardState.USER32(?), ref: 010212CA
SetKeyboardState.USER32(?), ref: 0102132B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 01021357
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 01021374
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 010213B8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 010213D9

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 3bf59876728719ccaa536d7c0b469f2c8ccd472afe11852a3f69d431d8a29a70
Instruction ID: aee6b1df716302bb2af0cce2df254e05e2ff76b88c78311742cdc6a481be859d
Opcode Fuzzy Hash: 3bf59876728719ccaa536d7c0b469f2c8ccd472afe11852a3f69d431d8a29a70
Instruction Fuzzy Hash: 1151D8B05047E63DFB3286288C55BBA7FEA6F06304F0885C9E2D8568C2D7B5A898D750

Uniqueness

Uniqueness Score: -1.00%

Function 0102589F Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 010258AC
_wcsncpy.LIBCMT ref: 010258E1
_wcsncpy.LIBCMT ref: 01025913
_wcsncpy.LIBCMT ref: 01025946
_wcsncpy.LIBCMT ref: 01025988
_wcsncpy.LIBCMT ref: 010259C2
_wcsncpy.LIBCMT ref: 010259F1

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 95b959342bbfde12c382186f302d1910bfcc6e89dfb39920e5dc930bfba85bc5
Instruction ID: 7905e644cd0193bb75c4ceebf2fb65eb373e573021e3b74e1990ecb37fbde907
Opcode Fuzzy Hash: 95b959342bbfde12c382186f302d1910bfcc6e89dfb39920e5dc930bfba85bc5
Instruction Fuzzy Hash: F741A5A5C2026876CB51EBB58C8B9CFB7ACAF05310F508466F658E3111F738E714D7AA

Uniqueness

Uniqueness Score: -1.00%

Function 010238AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 010248AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,010238D3,?), ref: 010248C7

Part of subcall function 010248AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,010238D3,?), ref: 010248E0

lstrcmpiW.KERNEL32(?,?), ref: 010238F3
_wcscmp.LIBCMT ref: 0102390F
MoveFileW.KERNEL32(?,?), ref: 01023927
_wcscat.LIBCMT ref: 0102396F
SHFileOperationW.SHELL32(?), ref: 010239DB

Strings

\*.*, xrefs: 01023969

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 7623de0b47f164bd1bd217732442ea1dac5ca6865c3ca65cf29c398f1be03b41
Instruction ID: 0e90084cbf2e12a211a93a3a99862f695b6319c361996b701469c9635b2cff97
Opcode Fuzzy Hash: 7623de0b47f164bd1bd217732442ea1dac5ca6865c3ca65cf29c398f1be03b41
Instruction Fuzzy Hash: 754181B16083959AC791EF68C881ADFB7ECBF89340F00096EF5C9C7151EA39D248C752

Uniqueness

Uniqueness Score: -1.00%

Function 01047500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 01047519
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 010475C0
IsMenu.USER32(?), ref: 010475D8
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 01047620
DrawMenuBar.USER32 ref: 01047633

Strings

0, xrefs: 0104750D

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 5226639ed959ace99133718c2c9e5af8d5aa744a2afc0f8c2317472e1bd94ea4
Instruction ID: cd4f245f1141f5a813ac52be0910837bb36f0a6d5688ca37930d55fcf38ce715
Opcode Fuzzy Hash: 5226639ed959ace99133718c2c9e5af8d5aa744a2afc0f8c2317472e1bd94ea4
Instruction Fuzzy Hash: 15411AB5A00249EFDB20DF58D9C4E9ABBF9FF08314F048169EE959B250D735A950CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0104122D Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 0104125C
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 01041286
FreeLibrary.KERNEL32(00000000), ref: 0104133D

Part of subcall function 0104122D: RegCloseKey.ADVAPI32(?), ref: 010412A3
Part of subcall function 0104122D: FreeLibrary.KERNEL32(?), ref: 010412F5
Part of subcall function 0104122D: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 01041318

RegDeleteKeyW.ADVAPI32(?,?), ref: 010412E0

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: adf0140bff9599ea61fcfd01762e1ab47c86faa532b1cfa17590747fceb0dc33
Instruction ID: 5f97be1ffdd2702bb17c003ef8a6089432ca8d16d325f72dd464003556558c79
Opcode Fuzzy Hash: adf0140bff9599ea61fcfd01762e1ab47c86faa532b1cfa17590747fceb0dc33
Instruction Fuzzy Hash: 35314FF5901119BFEB159B94D9C5EFEB7BCEF08300F0041A9E591E2140DA756A859BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0104653C Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0104655B
GetWindowLongW.USER32(01834D88,000000F0), ref: 0104658E
GetWindowLongW.USER32(01834D88,000000F0), ref: 010465C3
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 010465F5
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 0104661F
GetWindowLongW.USER32(?,000000F0), ref: 01046630
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0104664A

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 86eaa37a7be65ad250b88d3ba86129b2deacd357e84658f742a361a2d3fbdb05
Instruction ID: 66bdcedb550671b26e9638524d95a22a308d304d1fee8bda5a7ece15d425a8ae
Opcode Fuzzy Hash: 86eaa37a7be65ad250b88d3ba86129b2deacd357e84658f742a361a2d3fbdb05
Instruction Fuzzy Hash: 513119B4604111AFDB31DF6CE8C4F593BE1FB4A750F1902A4F5858B2AADB77A840CB81

Uniqueness

Uniqueness Score: -1.00%

Function 01036486 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 010380A0: inet_addr.WSOCK32(00000000), ref: 010380CB

socket.WSOCK32(00000002,00000001,00000006), ref: 010364D9
WSAGetLastError.WSOCK32(00000000), ref: 010364E8
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 01036521
connect.WSOCK32(00000000,?,00000010), ref: 0103652A
WSAGetLastError.WSOCK32 ref: 01036534
closesocket.WSOCK32(00000000), ref: 0103655D
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 01036576

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 89263313823b6982da013a44ff32f4e7c15b63746d8506130e786acb4a0df3d1
Instruction ID: 4f4e49af2035a04d6312d255add8cd40887a5a66971ebfc6abf711ce6893f56d
Opcode Fuzzy Hash: 89263313823b6982da013a44ff32f4e7c15b63746d8506130e786acb4a0df3d1
Instruction Fuzzy Hash: 8631B575600119AFEB109F18DD85FBE7BEDEB84714F00806DF989DB281DB79A904CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0101E0B5 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0101E0FA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0101E120
SysAllocString.OLEAUT32(00000000), ref: 0101E123
SysAllocString.OLEAUT32 ref: 0101E144
SysFreeString.OLEAUT32 ref: 0101E14D
StringFromGUID2.OLE32(?,?,00000028), ref: 0101E167
SysAllocString.OLEAUT32(?), ref: 0101E175

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: dcbae8410ebcc3aa9afaf9391e42df0cdb334fa4e1e2faf9366a57897cfb503f
Instruction ID: fb6076b036189ca195d136db9a7d7defa998d0c204093788aafc8ca76b0063c5
Opcode Fuzzy Hash: dcbae8410ebcc3aa9afaf9391e42df0cdb334fa4e1e2faf9366a57897cfb503f
Instruction Fuzzy Hash: 2821A776600109AFDB21AFACDC88CAF77ECEB09760B408165FD95CB259DE79DC418B60

Uniqueness

Uniqueness Score: -1.00%

Function 0101FB6E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0101FB81
__wcsnicmp.LIBCMT ref: 0101FBA2
__wcsnicmp.LIBCMT ref: 0101FBBC

Strings

#OnAutoItStartRegister, xrefs: 0101FBB6
#notrayicon, xrefs: 0101FB79
#requireadmin, xrefs: 0101FB9C

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: d09f59ecb61d9721012428b6215407c0b5eadfd26e3da719d3a3655b58071cce
Instruction ID: 9fb8fbc3b2552855590963b2e8c0c5866bb77d8de4ed3b3bcc883f1ce33781da
Opcode Fuzzy Hash: d09f59ecb61d9721012428b6215407c0b5eadfd26e3da719d3a3655b58071cce
Instruction Fuzzy Hash: 8A217CB2104253A6D331B6399E52FAB73D8FF05344F04402AFEC687146E79CA985E3A1

Uniqueness

Uniqueness Score: -1.00%

Function 0104783C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00FC1D73
Part of subcall function 00FC1D35: GetStockObject.GDI32(00000011), ref: 00FC1D87
Part of subcall function 00FC1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00FC1D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 010478A1
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 010478AE
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 010478B9
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 010478C8
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 010478D4

Strings

Msctls_Progress32, xrefs: 01047872

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 3febb89ce44718102afcc7f349c2f1d706e20caa7b30c34cf2796e22b51dd708
Instruction ID: f175a384b5db5b5a624edd211b36d34e8d41525399b9a8d7dbcde957629200d8
Opcode Fuzzy Hash: 3febb89ce44718102afcc7f349c2f1d706e20caa7b30c34cf2796e22b51dd708
Instruction Fuzzy Hash: A01193B155011ABFFF159E64CC85EEB7F6DEF08798F014129B644A6050C7729C21DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00FE41C9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00FE4292,?), ref: 00FE41E3
GetProcAddress.KERNEL32(00000000), ref: 00FE41EA
EncodePointer.KERNEL32(00000000), ref: 00FE41F6
DecodePointer.KERNEL32(00000001,00FE4292,?), ref: 00FE4213

Strings

RoInitialize, xrefs: 00FE41D2
combase.dll, xrefs: 00FE41DE

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: abce1ab908f0a5e2ba47f179ed56df646c18968441434528892b9ed581cf3972
Instruction ID: 183ea7576ebee70fb2909a08b472208188f64f68cac8384bc3254cb06fcf2e4e
Opcode Fuzzy Hash: abce1ab908f0a5e2ba47f179ed56df646c18968441434528892b9ed581cf3972
Instruction Fuzzy Hash: 97E012F4E90342AFEF306B75ED49B093595BB11743F508428B9D1D9088D7BF50519F10

Uniqueness

Uniqueness Score: -1.00%

Function 00FE429E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00FE41B8), ref: 00FE42B8
GetProcAddress.KERNEL32(00000000), ref: 00FE42BF
EncodePointer.KERNEL32(00000000), ref: 00FE42CA
DecodePointer.KERNEL32(00FE41B8), ref: 00FE42E5

Strings

RoUninitialize, xrefs: 00FE42A7
combase.dll, xrefs: 00FE42B3

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 60724c58d8a832416ea83fa475050ffcce40a03856c3a9c353ec3736597bff20
Instruction ID: c7b05fe3c179ec0f2399b36e4b7fa40f45689c4c077f696141dd7c674fbdb496
Opcode Fuzzy Hash: 60724c58d8a832416ea83fa475050ffcce40a03856c3a9c353ec3736597bff20
Instruction Fuzzy Hash: 09E0BFBCA45302EBEF70AF65EE4DB093AA4BB14B46F104018F9C1D5048DB7E5500DB14

Uniqueness

Uniqueness Score: -1.00%

Function 0102675A Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 010268AD
_memmove.LIBCMT ref: 010267E8

Part of subcall function 00FC9997: __itow.LIBCMT ref: 00FC99C2
Part of subcall function 00FC9997: __swprintf.LIBCMT ref: 00FC9A0C

_memmove.LIBCMT ref: 0102685B
_memmove.LIBCMT ref: 01026942
_memmove.LIBCMT ref: 0102695B
_memmove.LIBCMT ref: 01026977

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: da52f7aa59bd86189c3283b216ba2f53a604beb6c066220f3fc8d1d2b7220bb0
Instruction ID: 0984039e8a2f08311dc191abf85b8631f5d16122ba368d798a310a060e7b8aeb
Opcode Fuzzy Hash: da52f7aa59bd86189c3283b216ba2f53a604beb6c066220f3fc8d1d2b7220bb0
Instruction Fuzzy Hash: A661FF305042AAABDF11EF21CD82FFE3BA8AF44308F044158FD895B292DF79A901DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0104046F Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC7F41: _memmove.LIBCMT ref: 00FC7F82

Part of subcall function 010410A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,01040038,?,?), ref: 010410BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 01040548
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 01040588
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 010405AB
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 010405D4
RegCloseKey.ADVAPI32(?,?,00000000), ref: 01040617
RegCloseKey.ADVAPI32(00000000), ref: 01040624

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 31ff03cee1b4cd96499f0d8fc06e2fa6cf0a5d126e04e7b2f08fd5d77e4da111
Instruction ID: c2338fec294e8d267dd3943b2b4b0db43831e35dff6f81c24a23af2b0e5b8e93
Opcode Fuzzy Hash: 31ff03cee1b4cd96499f0d8fc06e2fa6cf0a5d126e04e7b2f08fd5d77e4da111
Instruction Fuzzy Hash: DF516971108241AFD710EB28CD85EAFBBE8FF88704F04496DF68597291DB76E904DB92

Uniqueness

Uniqueness Score: -1.00%

Function 01045A20 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 01045A82
GetMenuItemCount.USER32(00000000), ref: 01045AB9
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 01045AE1
GetMenuItemID.USER32(?,?), ref: 01045B50
GetSubMenu.USER32(?,?), ref: 01045B5E
PostMessageW.USER32(?,00000111,?,00000000), ref: 01045BAF

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: e93a40ddd64482f929c949bb67d7ebb0f94e74045de8aa78907f7b9a40731a0c
Instruction ID: 3b80809884a93bd0529bee6e41e07987703482f4c5b916c7d8faabc9926d2056
Opcode Fuzzy Hash: e93a40ddd64482f929c949bb67d7ebb0f94e74045de8aa78907f7b9a40731a0c
Instruction Fuzzy Hash: BD5191B5A00216EFDB11DF68CD85AAEB7B4EF48310F1044A9E985BB351CB75AE40CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0101F3DD Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0101F3F7
VariantClear.OLEAUT32(00000013), ref: 0101F469
VariantClear.OLEAUT32(00000000), ref: 0101F4C4
_memmove.LIBCMT ref: 0101F4EE
VariantClear.OLEAUT32(?), ref: 0101F53B
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 0101F569

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 4c9f06770592c76e9b534734b8fb2d75d4b5a36fe7d3f008b5b2d62032abe36b
Instruction ID: ff4af890363c013e85e3d0ae7334ab92d38f78db92d30cbd59a113ac1fc77295
Opcode Fuzzy Hash: 4c9f06770592c76e9b534734b8fb2d75d4b5a36fe7d3f008b5b2d62032abe36b
Instruction Fuzzy Hash: 06516BB5A0020AEFDB10CF58D880AAABBF8FF4C354B158159EA59DB305D734E915CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010226F9 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 01022747
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 01022792
IsMenu.USER32(00000000), ref: 010227B2
CreatePopupMenu.USER32 ref: 010227E6
GetMenuItemCount.USER32(000000FF), ref: 01022844
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 01022875

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 65ccbe77380544e641ce0319b0b9264957128e5676cbccc4dd355ba75f2fbe52
Instruction ID: 64d06b8263bd2029d2f2dba0205cc56ebefabfb071a047e4de6743d0bd4a3b06
Opcode Fuzzy Hash: 65ccbe77380544e641ce0319b0b9264957128e5676cbccc4dd355ba75f2fbe52
Instruction Fuzzy Hash: A951B170A0136ADFDF25CFA8C988AAEBBF4BF44314F104299F9919B291D7B0D544CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00FC1765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00FC2612: GetWindowLongW.USER32(?,000000EB), ref: 00FC2623

BeginPaint.USER32(?,?,?,?,?,?), ref: 00FC179A
GetWindowRect.USER32(?,?), ref: 00FC17FE
ScreenToClient.USER32(?,?), ref: 00FC181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00FC182C
EndPaint.USER32(?,?), ref: 00FC1876

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: e30e193eef2508825a69883a706d730958dd6baf06c25d5fb8c6018fe492ba1d
Instruction ID: b287fe06997c3b0da90ece751c302ce143501b5d8a1a6dac318d2a83a03789bb
Opcode Fuzzy Hash: e30e193eef2508825a69883a706d730958dd6baf06c25d5fb8c6018fe492ba1d
Instruction Fuzzy Hash: 9B41A0B1508302DFD720DF24C985FBA7BE8FB4A724F14066CF9D4861A2C73A9855EB61

Uniqueness

Uniqueness Score: -1.00%

Function 0104B958 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(010867B0,00000000,01834D88,?,?,010867B0,?,0104B862,?,?), ref: 0104B9CC
EnableWindow.USER32(?,00000000), ref: 0104B9F0
ShowWindow.USER32(010867B0,00000000,01834D88,?,?,010867B0,?,0104B862,?,?), ref: 0104BA50
ShowWindow.USER32(?,00000004,?,0104B862,?,?), ref: 0104BA62
EnableWindow.USER32(?,00000001), ref: 0104BA86
SendMessageW.USER32(?,0000130C,?,00000000), ref: 0104BAA9

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 75627b7d0907d1216d6fabab5f1f81a161a56d45a3dfc1076e9eda7b247acce4
Instruction ID: 4b5eef2e60a8930355a746663b88afe123f8779bbe97e304b625ea0d6e4a6e02
Opcode Fuzzy Hash: 75627b7d0907d1216d6fabab5f1f81a161a56d45a3dfc1076e9eda7b247acce4
Instruction Fuzzy Hash: 694153B4600241AFDB62DF2CC5C9BA57FE0BB09315F1841F9EA888F2A6C731E855CB51

Uniqueness

Uniqueness Score: -1.00%

Function 010373B1 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,01035134,?,?,00000000,00000001), ref: 010373BF

Part of subcall function 01033C94: GetWindowRect.USER32(?,?), ref: 01033CA7

GetDesktopWindow.USER32 ref: 010373E9
GetWindowRect.USER32(00000000), ref: 010373F0
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 01037422

Part of subcall function 010254E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0102555E

GetCursorPos.USER32(?), ref: 0103744E
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 010374AC

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 40e5cc30a1450cb7859aef050eac4fa1025fa91148e9b8e5e1cfd319c7c374ae
Instruction ID: 841e63fbfec329b87f3fe31bb3ca1e3ff4f044ea50e14f3a1cfe2cbbb0811074
Opcode Fuzzy Hash: 40e5cc30a1450cb7859aef050eac4fa1025fa91148e9b8e5e1cfd319c7c374ae
Instruction Fuzzy Hash: E031B0B2504316ABD720DF58D888F9BBBE9FF98314F004919F9D997181CB75E908CB92

Uniqueness

Uniqueness Score: -1.00%

Function 01018D5B Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 010185F1: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 01018608
Part of subcall function 010185F1: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 01018612
Part of subcall function 010185F1: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 01018621
Part of subcall function 010185F1: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 01018628
Part of subcall function 010185F1: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 0101863E

GetLengthSid.ADVAPI32(?,00000000,01018977), ref: 01018DAC
GetProcessHeap.KERNEL32(00000008,00000000), ref: 01018DB8
HeapAlloc.KERNEL32(00000000), ref: 01018DBF
CopySid.ADVAPI32(00000000,00000000,?), ref: 01018DD8
GetProcessHeap.KERNEL32(00000000,00000000,01018977), ref: 01018DEC
HeapFree.KERNEL32(00000000), ref: 01018DF3

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 326859dbdbf857ba19bb27a3dd29e5d2558cc029278360ccf2881a3c31fa7fa5
Instruction ID: 723fe7897d3460fbb7d73b82a97e7341cc36d854ef7044fdde410740c963fceb
Opcode Fuzzy Hash: 326859dbdbf857ba19bb27a3dd29e5d2558cc029278360ccf2881a3c31fa7fa5
Instruction Fuzzy Hash: 9A11E175500606FFDB60AFA8CD88BAE7BA9EF51315F50805AF9C597208C73A9A00CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01018AF9 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 01018B2A
OpenProcessToken.ADVAPI32(00000000), ref: 01018B31
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 01018B40
CloseHandle.KERNEL32(00000004), ref: 01018B4B
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 01018B7A
DestroyEnvironmentBlock.USERENV(00000000), ref: 01018B8E

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 19dab303adb77ed1158703333b5d20bc9abcf937607faafa44a61fb1cf761a8e
Instruction ID: 1179b1785e6d6f1b8a18b5c994680f20cb9ac251dd67e1ccebca0f785a1e2049
Opcode Fuzzy Hash: 19dab303adb77ed1158703333b5d20bc9abcf937607faafa44a61fb1cf761a8e
Instruction Fuzzy Hash: EA111DB650120AABEB118F98ED89FDA7BE9FB45304F044055FE44A2154C27A9E609B60

Uniqueness

Uniqueness Score: -1.00%

Function 0104C19A Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00FC12F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00FC134D
Part of subcall function 00FC12F3: SelectObject.GDI32(?,00000000), ref: 00FC135C
Part of subcall function 00FC12F3: BeginPath.GDI32(?), ref: 00FC1373
Part of subcall function 00FC12F3: SelectObject.GDI32(?,00000000), ref: 00FC139C

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 0104C1C4
LineTo.GDI32(00000000,00000003,?), ref: 0104C1D8
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0104C1E6
LineTo.GDI32(00000000,00000000,?), ref: 0104C1F6
EndPath.GDI32(00000000), ref: 0104C206
StrokePath.GDI32(00000000), ref: 0104C216

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: cf29c2c1f10918e90d6f3f0b07c64de7dc4859fe3fa0f9c2c0fe89c65bb7311c
Instruction ID: 91da79ab4b8c95d7388c69213b0fe3639adfec00a583c6122065f46010fe5090
Opcode Fuzzy Hash: cf29c2c1f10918e90d6f3f0b07c64de7dc4859fe3fa0f9c2c0fe89c65bb7311c
Instruction Fuzzy Hash: 0D115EB600010DBFEF219F94DD88FDA3FACEB04354F048021BA8846165C7769D54DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00FE03A2 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00FE03D3
MapVirtualKeyW.USER32(00000010,00000000), ref: 00FE03DB
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00FE03E6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00FE03F1
MapVirtualKeyW.USER32(00000011,00000000), ref: 00FE03F9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FE0401

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: c246b060f32b71d6900534dba0d7e1e49e82d77212d56a50eb9fcc3cc262a4f3
Instruction ID: f38200f2867656847c097720d73222093864512debc349775a3d42b0e966fc47
Opcode Fuzzy Hash: c246b060f32b71d6900534dba0d7e1e49e82d77212d56a50eb9fcc3cc262a4f3
Instruction Fuzzy Hash: 79016CB090275A7DE3009F6A8C85B52FFA8FF19354F00411BA15C47941C7F5A868CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0102568B Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0102569B
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 010256B1
GetWindowThreadProcessId.USER32(?,?), ref: 010256C0
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 010256CF
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 010256D9
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 010256E0

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: a52256f202aa07a51422b31774e4049f841d70cf4814ad9ecc8a9c4fcee7aa83
Instruction ID: 36433969bd43e1d5cde34f50d507174e1e1cd1e9faeb08e2a2cd941a27d3beb3
Opcode Fuzzy Hash: a52256f202aa07a51422b31774e4049f841d70cf4814ad9ecc8a9c4fcee7aa83
Instruction Fuzzy Hash: 21F09675141159BBE3315A66DD4DEEF7B7CEFCBB11F000159F940D1041D7A61A0187B5

Uniqueness

Uniqueness Score: -1.00%

Function 010274D2 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 010274E5
EnterCriticalSection.KERNEL32(?,?,00FD1044,?,?), ref: 010274F6
TerminateThread.KERNEL32(00000000,000001F6,?,00FD1044,?,?), ref: 01027503
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00FD1044,?,?), ref: 01027510

Part of subcall function 01026ED7: CloseHandle.KERNEL32(00000000,?,0102751D,?,00FD1044,?,?), ref: 01026EE1

InterlockedExchange.KERNEL32(?,000001F6), ref: 01027523
LeaveCriticalSection.KERNEL32(?,?,00FD1044,?,?), ref: 0102752A

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: b96826a039c76c010020ae4038ee5bb8685a2974df09002b6c9959224d4c0a2d
Instruction ID: 281f3e3bd1c684536e971130f14ebb0eb1e1aa94050f39c793b8cddb65c50377
Opcode Fuzzy Hash: b96826a039c76c010020ae4038ee5bb8685a2974df09002b6c9959224d4c0a2d
Instruction Fuzzy Hash: 41F054BE540623ABEB212B68FFCC9DB7B69EF45302B000561F682910A8CB7A5401CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01018E74 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 01018E7F
UnloadUserProfile.USERENV(?,?), ref: 01018E8B
CloseHandle.KERNEL32(?), ref: 01018E94
CloseHandle.KERNEL32(?), ref: 01018E9C
GetProcessHeap.KERNEL32(00000000,?), ref: 01018EA5
HeapFree.KERNEL32(00000000), ref: 01018EAC

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 625c63b03d8432b702a7b0529286dfceeee090e5ce680978e1c1777cb92f9049
Instruction ID: 90cf2ae884b947986d0168f10d42123af3509f03be4b074c3b7eb5fe976aba35
Opcode Fuzzy Hash: 625c63b03d8432b702a7b0529286dfceeee090e5ce680978e1c1777cb92f9049
Instruction Fuzzy Hash: 14E0EDBA004002BBD7112FE9EE4C906BFB9FF897227108220F255C1478CB3B5420DB50

Uniqueness

Uniqueness Score: -1.00%

Function 01038902 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 01038928
CharUpperBuffW.USER32(?,?), ref: 01038A37
VariantClear.OLEAUT32(?), ref: 01038BAF

Part of subcall function 01027804: VariantInit.OLEAUT32(00000000), ref: 01027844
Part of subcall function 01027804: VariantCopy.OLEAUT32(00000000,?), ref: 0102784D
Part of subcall function 01027804: VariantClear.OLEAUT32(00000000), ref: 01027859

Strings

AUTOIT.ERROR, xrefs: 01038A3D
Incorrect Parameter format, xrefs: 01038960, 01038B22

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 11ccc8b09ff8511129cfa3f3fb3435e68173984a188dc73c800bb9dafe5fd46e
Instruction ID: ae932d8ea845bee59c7747cff017f64611d9dd802d925d5e6a7d27de8c8ff714
Opcode Fuzzy Hash: 11ccc8b09ff8511129cfa3f3fb3435e68173984a188dc73c800bb9dafe5fd46e
Instruction Fuzzy Hash: E5919F74608302DFC714DF28C58595ABBE8EFC8714F048AAEF89A8B351DB35E945CB52

Uniqueness

Uniqueness Score: -1.00%

Function 01022F86 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FDFEC6: _wcscpy.LIBCMT ref: 00FDFEE9

_memset.LIBCMT ref: 01023077
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 010230A6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 01023159
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 01023187

Strings

0, xrefs: 01023063

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 34280514322675ec259ea306e93743cdb335060deb96f1805a66d692b347ba66
Instruction ID: 2333f6fbc83c90d96f63b26b457a94ae6e3475f2f003fda915c10f10bec2094f
Opcode Fuzzy Hash: 34280514322675ec259ea306e93743cdb335060deb96f1805a66d692b347ba66
Instruction Fuzzy Hash: 615102316083219BE7A59E28C845B6BBBF4FF48310F140A6DFAC5DB191DB79C9448792

Uniqueness

Uniqueness Score: -1.00%

Function 0101DA5D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0101DAC5
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0101DAFB
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0101DB0C
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 0101DB8E

Strings

DllGetClassObject, xrefs: 0101DB01

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: ee361bc0681ade029ec7ab610bdb6f4fe4069748288ea0bdbaaaf0a05e722e63
Instruction ID: 29b97b28310d5d646912861f49f00d17d20b8f68b53063261905133e8d34dc02
Opcode Fuzzy Hash: ee361bc0681ade029ec7ab610bdb6f4fe4069748288ea0bdbaaaf0a05e722e63
Instruction Fuzzy Hash: 534185B1600209EFDB15CF99C8C8A9A7BF9FF44314F04819DAE469F209D7B5D940CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01022C42 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 01022CAF
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 01022CCB
DeleteMenu.USER32(?,00000007,00000000), ref: 01022D11
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,01086890,00000000), ref: 01022D5A

Strings

0, xrefs: 01022CA4

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 37df962dcbaf43c649faa7e4dc1f2199a936538c1c675859d2942b7ab4746f25
Instruction ID: 5ca3359ba41d9d1383d829a7a6d793eec5265ca512e9a299de25feb5dddfd2de
Opcode Fuzzy Hash: 37df962dcbaf43c649faa7e4dc1f2199a936538c1c675859d2942b7ab4746f25
Instruction Fuzzy Hash: 5841BF742043529FD720EF68C884B5BBBE8EF85320F14465EFAA5972A1D770E505CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0103DAB9 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0103DAD9

Part of subcall function 00FC79AB: _memmove.LIBCMT ref: 00FC79F9

Strings

cdecl, xrefs: 0103DB30
none, xrefs: 0103DBB4
winapi, xrefs: 0103DB4A
stdcall, xrefs: 0103DB5B

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: eefd98f682224ebf17daede38c05d682f3cbca6cbbff182ba2492245288850e6
Instruction ID: 2d4096834d9df2fddb52695d0f12ccd183d87f0c12c9a061ba25698739e26753
Opcode Fuzzy Hash: eefd98f682224ebf17daede38c05d682f3cbca6cbbff182ba2492245288850e6
Instruction Fuzzy Hash: B531B27090021AEFCF14EF98CD81DEEB7B8FF85720B408659E8A597691CF75A905CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01019372 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC7F41: _memmove.LIBCMT ref: 00FC7F82

Part of subcall function 0101B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0101B0E7

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 010193F6
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 01019409
SendMessageW.USER32(?,00000189,?,00000000), ref: 01019439

Part of subcall function 00FC7D2C: _memmove.LIBCMT ref: 00FC7D66

Strings

ComboBox, xrefs: 01019380
ListBox, xrefs: 010193B5

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 6792d1e3feff1f3db25ef55824ac7db7e1020380e39f1b207d095d1067a6cad5
Instruction ID: 54afbd7e9e2b4808efef86ac62ac43946e8969ade7795e476f267952ebbdca55
Opcode Fuzzy Hash: 6792d1e3feff1f3db25ef55824ac7db7e1020380e39f1b207d095d1067a6cad5
Instruction Fuzzy Hash: EB2146B1940105BFEB14AB75CC86DFEBBB8DF05364B00411DF9A6971E4CF3D09099A10

Uniqueness

Uniqueness Score: -1.00%

Function 01031B21 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 01031B40
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 01031B66
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 01031B96
InternetCloseHandle.WININET(00000000), ref: 01031BDD

Part of subcall function 01032777: GetLastError.KERNEL32(?,?,01031B0B,00000000,00000000,00000001), ref: 0103278C
Part of subcall function 01032777: SetEvent.KERNEL32(?,?,01031B0B,00000000,00000000,00000001), ref: 010327A1

Strings

, xrefs: 01031B87

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: dfd86a87e8d52eb9cf034739ddd898f5d19cdc9e270a7cebadf3f650ea9222ef
Instruction ID: 9e2eef2d0fa44eb869f4cfe3b0b297151cb9b7516de4329f00aeb394037d730f
Opcode Fuzzy Hash: dfd86a87e8d52eb9cf034739ddd898f5d19cdc9e270a7cebadf3f650ea9222ef
Instruction Fuzzy Hash: 6C21BEB5500209BFEB269F289CC4EBF76ECFB89644F00011AF585E2240EB399D0587B1

Uniqueness

Uniqueness Score: -1.00%

Function 01046656 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00FC1D73
Part of subcall function 00FC1D35: GetStockObject.GDI32(00000011), ref: 00FC1D87
Part of subcall function 00FC1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00FC1D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 010466D0
LoadLibraryW.KERNEL32(?), ref: 010466D7
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 010466EC
DestroyWindow.USER32(?), ref: 010466F4

Strings

SysAnimate32, xrefs: 010466AB

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 582d942775272bf48474bdaeb584585d20373ec9200ee129cce8d691d18b48b2
Instruction ID: 833d6023ba34fc601fd57cc30bed7188b43b558cc4e5e6789066ea31e681b38e
Opcode Fuzzy Hash: 582d942775272bf48474bdaeb584585d20373ec9200ee129cce8d691d18b48b2
Instruction Fuzzy Hash: 7E218BF1200206ABEF119E68ECC0EBB77E9FB4A364F104639FA9196191E77388519760

Uniqueness

Uniqueness Score: -1.00%

Function 0102710C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 0102712B
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0102715D
GetStdHandle.KERNEL32(000000F6), ref: 0102716E
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 010271A8

Strings

nul, xrefs: 010271A3

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 4be315b8e66a3e742b5dd8e14492f0f3b087c893a4f17ffbbc45dc02e99a3e9e
Instruction ID: 424b6276e9f6d9912c6e207a8f64029950755484577e942cfea4ba7da05899dd
Opcode Fuzzy Hash: 4be315b8e66a3e742b5dd8e14492f0f3b087c893a4f17ffbbc45dc02e99a3e9e
Instruction Fuzzy Hash: EB21B3756002269BEF209F6D8C44A9AB7E9AF65720F300699FDE0D72C0D7719441CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0102703E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 0102705E
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 01027091
GetStdHandle.KERNEL32(0000000C), ref: 010270A3
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 010270DD

Strings

nul, xrefs: 010270D8

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: b3a11d49d8e0bc51b13580190c0e750dc74b912a2cd0c2abca4486fa60af06c7
Instruction ID: 667eeb727a0b6c34eb994edce771695affcfcd93981e6de1bebaa207bb744663
Opcode Fuzzy Hash: b3a11d49d8e0bc51b13580190c0e750dc74b912a2cd0c2abca4486fa60af06c7
Instruction Fuzzy Hash: 46215378500226DBEF209F2DD884A9EBBE8AF54720F204659FDE1D72D0D775A854CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0102AEAB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0102AEBF
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0102AF13
__swprintf.LIBCMT ref: 0102AF2C
SetErrorMode.KERNEL32(00000000,00000001,00000000,0104F910), ref: 0102AF6A

Strings

%lu, xrefs: 0102AF26

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 2bf1a810b7b67671e08f3e19f7170a95f675acef33c79154f7b9652398cdd307
Instruction ID: 4c2c00a575750cb319ff1ca04871f91dc50ec5dcba29f5d4e39b4fcf1506ac1f
Opcode Fuzzy Hash: 2bf1a810b7b67671e08f3e19f7170a95f675acef33c79154f7b9652398cdd307
Instruction Fuzzy Hash: 1F21B374A0010AAFCB10DF69CD85EEE7BB8EF89704B0040A9F949DB251DB75EE01DB21

Uniqueness

Uniqueness Score: -1.00%

Function 0101A52F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC7D2C: _memmove.LIBCMT ref: 00FC7D66

Part of subcall function 0101A37C: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0101A399
Part of subcall function 0101A37C: GetWindowThreadProcessId.USER32(?,00000000), ref: 0101A3AC
Part of subcall function 0101A37C: GetCurrentThreadId.KERNEL32 ref: 0101A3B3
Part of subcall function 0101A37C: AttachThreadInput.USER32(00000000), ref: 0101A3BA

GetFocus.USER32 ref: 0101A554

Part of subcall function 0101A3C5: GetParent.USER32(?), ref: 0101A3D3

GetClassNameW.USER32(?,?,00000100), ref: 0101A59D
EnumChildWindows.USER32(?,0101A615), ref: 0101A5C5
__swprintf.LIBCMT ref: 0101A5DF

Strings

%s%d, xrefs: 0101A5D9

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 0de4c12516bee203509edf9c1e3c582386a50e91c00c99ced331962ff4edeb0e
Instruction ID: 256e20962f84f14144699c25ace21c93d0077a519203d869c9fb9deed7cdb203
Opcode Fuzzy Hash: 0de4c12516bee203509edf9c1e3c582386a50e91c00c99ced331962ff4edeb0e
Instruction Fuzzy Hash: B811D2B120024ABBDF10BF74DD85FEA37B8AF88300F004069B988AB046CA7859458B34

Uniqueness

Uniqueness Score: -1.00%

Function 01022017 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 01022048

Strings

KEYS, xrefs: 0102205F
APPEND, xrefs: 01022081
REMOVE, xrefs: 0102204E
EXISTS, xrefs: 01022070

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 78e1abc6ebf89d506dc433abc0adbfcc19329ce9e55b0a6f0f1140d988ba9fdc
Instruction ID: ed793858fd7ec64ca87c5229499733ed85dad300be1ebab56379cbd311561465
Opcode Fuzzy Hash: 78e1abc6ebf89d506dc433abc0adbfcc19329ce9e55b0a6f0f1140d988ba9fdc
Instruction Fuzzy Hash: 6C115730A0011ACFCF10EFE8DD819EEB7B5FF05314B508898E895A7253EB36694ADB50

Uniqueness

Uniqueness Score: -1.00%

Function 0103EE69 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0103EF1B
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0103EF4B
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 0103F07E
CloseHandle.KERNEL32(?), ref: 0103F0FF

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: e3cfa107d436488422ffa0cc37defea2ba11fd5f1d29394dc776845417df040e
Instruction ID: df3aa87872ad353d5ed0a9271bddb77a9240b447b540d6319262f0c246f09f00
Opcode Fuzzy Hash: e3cfa107d436488422ffa0cc37defea2ba11fd5f1d29394dc776845417df040e
Instruction Fuzzy Hash: 5981A3716047029FD720DF28CD86F6AB7E5AF88710F04881DF599DB292DBB5AC41CB52

Uniqueness

Uniqueness Score: -1.00%

Function 010402C2 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC7F41: _memmove.LIBCMT ref: 00FC7F82

Part of subcall function 010410A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,01040038,?,?), ref: 010410BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 01040388
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 010403C7
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0104040E
RegCloseKey.ADVAPI32(?,?), ref: 0104043A
RegCloseKey.ADVAPI32(00000000), ref: 01040447

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 8359fee9e7823f4afbe81e2b03ad9f3b734d23e3fde2492e13e51290ceeea4ee
Instruction ID: a30ce784ca45a3799b16d49275c4ad12ae9101022b64bc46adc391e006ce8582
Opcode Fuzzy Hash: 8359fee9e7823f4afbe81e2b03ad9f3b734d23e3fde2492e13e51290ceeea4ee
Instruction Fuzzy Hash: B6516BB1208205AFD700EB68CDC1FAEBBE8FF84704F04896DB59597291DB75E904DB52

Uniqueness

Uniqueness Score: -1.00%

Function 0103DBDC Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC9997: __itow.LIBCMT ref: 00FC99C2
Part of subcall function 00FC9997: __swprintf.LIBCMT ref: 00FC9A0C

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0103DC3B
GetProcAddress.KERNEL32(00000000,?), ref: 0103DCBE
GetProcAddress.KERNEL32(00000000,00000000), ref: 0103DCDA
GetProcAddress.KERNEL32(00000000,?), ref: 0103DD1B
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0103DD35

Part of subcall function 00FC5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,01027B20,?,?,00000000), ref: 00FC5B8C
Part of subcall function 00FC5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,01027B20,?,?,00000000,?,?), ref: 00FC5BB0

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: 4b891774879398b2182f319795e57245eba907d7c9231c35d0bed9743b15b7bf
Instruction ID: 317258707279020feaa332733bbb0fd5d125b78b5685c0e2a7d2f2489d30f095
Opcode Fuzzy Hash: 4b891774879398b2182f319795e57245eba907d7c9231c35d0bed9743b15b7bf
Instruction Fuzzy Hash: 8D514B75A0020A9FCB01EFA8C985DADB7F8FF49310B458099E859AB312DB75ED45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0102E7DC Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 0102E88A
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 0102E8B3
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0102E8F2

Part of subcall function 00FC9997: __itow.LIBCMT ref: 00FC99C2
Part of subcall function 00FC9997: __swprintf.LIBCMT ref: 00FC9A0C

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 0102E917
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0102E91F

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 9055a8f426ef8bfc65137fa0d3ef06af5dbb4646e02a20521b797ef59eb011ba
Instruction ID: 5611c9d17f374cdb697c18bdbb9ec496092104dadbae063942f2aed5f722afd7
Opcode Fuzzy Hash: 9055a8f426ef8bfc65137fa0d3ef06af5dbb4646e02a20521b797ef59eb011ba
Instruction Fuzzy Hash: 53513975A00216DFCF01EF65CA85EAEBBF5EF08310B148099E849AB362CB75ED11DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0104A2C5 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6e5d11faf1007f367d778e116e3936d7e81c58f3d994a25bbced3089f2de2b0
Instruction ID: bcbcb2139b6dc539235d2c7b702dfae59c07e5536bd0bcfa6a530d109ac486db
Opcode Fuzzy Hash: c6e5d11faf1007f367d778e116e3936d7e81c58f3d994a25bbced3089f2de2b0
Instruction Fuzzy Hash: 8341F2F9A40104EBD760DA2CC8C8BA9BBA4EB09311F0581B4FAD6A72D1EB7199418A50

Uniqueness

Uniqueness Score: -1.00%

Function 00FC2344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00FC2357
ScreenToClient.USER32(010867B0,?), ref: 00FC2374
GetAsyncKeyState.USER32(00000001), ref: 00FC2399
GetAsyncKeyState.USER32(00000002), ref: 00FC23A7

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: a8e3f2f422ddea6e065144c24bd92e75ee89a2ff9078d077fa9263e47600754a
Instruction ID: c4e3a94b8c58ffd3a4c08037a8ef2764d620fafebaa1f80a9dd48d63747ff2c6
Opcode Fuzzy Hash: a8e3f2f422ddea6e065144c24bd92e75ee89a2ff9078d077fa9263e47600754a
Instruction Fuzzy Hash: A5417F7590415AFBDF159FA8C944FEDBB74FF05320F20431AE968922A0C7356950EB91

Uniqueness

Uniqueness Score: -1.00%

Function 01016920 Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0101695D
TranslateAcceleratorW.USER32(?,?,?), ref: 010169A9
TranslateMessage.USER32(?), ref: 010169D2
DispatchMessageW.USER32(?), ref: 010169DC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 010169EB

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: 05f2089925491467d09adefc027625dea32ec6231330e0038c4cd0c6a4dd095e
Instruction ID: 6448ce8684e19cc985a6dfb8926db93a50e9d97eed4bbc9878494c838057bdf2
Opcode Fuzzy Hash: 05f2089925491467d09adefc027625dea32ec6231330e0038c4cd0c6a4dd095e
Instruction Fuzzy Hash: 1E31D271904246ABEB71CE799C84FFA7BEDAB05300F1541A9E5E1C3149E7AF9085CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01018F01 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 01018F12
PostMessageW.USER32(?,00000201,00000001), ref: 01018FBC
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 01018FC4
PostMessageW.USER32(?,00000202,00000000), ref: 01018FD2
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 01018FDA

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 04218b4f00b4063eb70ebc0df6de360b3d46488dbd237ccd725e5b0b489d5441
Instruction ID: e8311ddb88a1bd83947fa896efd640e2458f0103f0f77279b77a8a989d35e4c0
Opcode Fuzzy Hash: 04218b4f00b4063eb70ebc0df6de360b3d46488dbd237ccd725e5b0b489d5441
Instruction Fuzzy Hash: 2E31E2B150021AEFDB14CF6CD98CA9E7BB6EB04315F00825AFAA4A71D5C3B49A14CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0101B6AF Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0101B6C7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0101B6E4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0101B71C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 0101B742
_wcsstr.LIBCMT ref: 0101B74C

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: a24088f1a24b3595f5520053aa380012f10fc91bb882007a128144cbcb45bee3
Instruction ID: 6ba0d5035523cbbc7e5efd354a5a689020c9b46c54dc09a0e33df1208e7ec17e
Opcode Fuzzy Hash: a24088f1a24b3595f5520053aa380012f10fc91bb882007a128144cbcb45bee3
Instruction Fuzzy Hash: 12212672204244BBEB255B3E9D49E7B7BFCEF49760F044069FD49CA195EF69C84093A0

Uniqueness

Uniqueness Score: -1.00%

Function 0104B405 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00FC2612: GetWindowLongW.USER32(?,000000EB), ref: 00FC2623

GetWindowLongW.USER32(?,000000F0), ref: 0104B44C
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 0104B471
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 0104B489
GetSystemMetrics.USER32(00000004), ref: 0104B4B2
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,01031184,00000000), ref: 0104B4D0

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: db35d7d80c8eb441ebec5811e5755a30a878b386792104cf0bfdee1bc9db3705
Instruction ID: e5fb8a4b3932eecb04c1d6dd58f83a5ad5bb868172b7df00017058fba20510fc
Opcode Fuzzy Hash: db35d7d80c8eb441ebec5811e5755a30a878b386792104cf0bfdee1bc9db3705
Instruction Fuzzy Hash: FE2191B1914226AFDB609E3CCC84B6A3BA4FB45720F114778FAA6D21D0EB31D811CB90

Uniqueness

Uniqueness Score: -1.00%

Function 010197E9 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 01019802

Part of subcall function 00FC7D2C: _memmove.LIBCMT ref: 00FC7D66

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 01019834
__itow.LIBCMT ref: 0101984C
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 01019874
__itow.LIBCMT ref: 01019885

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 8925aad39b58a5547b167b2afdbb38db72fd114280654bc16c6fcd381866a5b9
Instruction ID: 13b15512053ac1b3542e15c554a1d0200f842e123497d3286a06cd652d059443
Opcode Fuzzy Hash: 8925aad39b58a5547b167b2afdbb38db72fd114280654bc16c6fcd381866a5b9
Instruction Fuzzy Hash: 2D210A71B00305FBEB10BA798D8AEEE3BA9EF48714F040069FE45DB241D6788D419791

Uniqueness

Uniqueness Score: -1.00%

Function 00FC12F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00FC134D
SelectObject.GDI32(?,00000000), ref: 00FC135C
BeginPath.GDI32(?), ref: 00FC1373
SelectObject.GDI32(?,00000000), ref: 00FC139C

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 3bd501c344f92b074081890cf2de0605a17b1f5d74c1cbb326e99afa883fe277
Instruction ID: 285cf9a5721d85fc1a86354edc4ff8600707ef4d5e173e2947f373fae6d76dd6
Opcode Fuzzy Hash: 3bd501c344f92b074081890cf2de0605a17b1f5d74c1cbb326e99afa883fe277
Instruction Fuzzy Hash: 6E21D8B0C14346DFDB208F54DA09B6D3BB8FB11325F21431AF4C496195D37B8861EB50

Uniqueness

Uniqueness Score: -1.00%

Function 0101C161 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0101C176
_memcmp.LIBCMT ref: 0101C194
_memcmp.LIBCMT ref: 0101C1A7
_memcmp.LIBCMT ref: 0101C1BF
_memcmp.LIBCMT ref: 0101C1D7

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 0a5f63327d2465eddcffd203a53d9a1c057f09a1cc79abbe4c196ca81c9e347d
Instruction ID: 105a7c774b4b7a498366bdbadfb5594413ad25c1b1692578232a98344219d1c3
Opcode Fuzzy Hash: 0a5f63327d2465eddcffd203a53d9a1c057f09a1cc79abbe4c196ca81c9e347d
Instruction Fuzzy Hash: 3601D8B26C4109BBF345A6275E42FAF77DCAF12294F444029FD449B247F768DE1182E2

Uniqueness

Uniqueness Score: -1.00%

Function 01024D35 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 01024D5C
__beginthreadex.LIBCMT ref: 01024D7A
MessageBoxW.USER32(?,?,?,?), ref: 01024D8F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 01024DA5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 01024DAC

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 4c70bc6909359a4a9e1a26499329bb76844ab268c4ec41b8bd577bfb380cf0b3
Instruction ID: cde8718004b4ec5dede15c02f3de5f29073e141c155bbe66d1b384108756a42c
Opcode Fuzzy Hash: 4c70bc6909359a4a9e1a26499329bb76844ab268c4ec41b8bd577bfb380cf0b3
Instruction Fuzzy Hash: AB1148B6908654BBC7219BACDC44ADE7FECEB45320F144299F994D7241C67A880087A0

Uniqueness

Uniqueness Score: -1.00%

Function 0101874A Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 01018766
GetLastError.KERNEL32(?,0101822A,?,?,?), ref: 01018770
GetProcessHeap.KERNEL32(00000008,?,?,0101822A,?,?,?), ref: 0101877F
HeapAlloc.KERNEL32(00000000,?,0101822A,?,?,?), ref: 01018786
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0101879D

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 836962771244ec751f94f338de551ddff6c401da8c17cdfb2fb97b08879c5ab7
Instruction ID: 2e54191a8609b46b0a57ac1ad7ae4110666099a3eaf325f6e1027d39f90f5911
Opcode Fuzzy Hash: 836962771244ec751f94f338de551ddff6c401da8c17cdfb2fb97b08879c5ab7
Instruction Fuzzy Hash: B4016DB5200205BFDB245FBADD88D6B7FACFF8A255710446AF989C3254DA36D910CB60

Uniqueness

Uniqueness Score: -1.00%

Function 010254E6 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 01025502
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 01025510
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 01025518
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 01025522
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0102555E

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 152eaff66b44b3a3c7d4f9b83fed886350595421e1a9360dca2fa1e7d89e122b
Instruction ID: 5f7ffa095f2bf7c7ab9b9af4aa93416d932bd7c61ac326203c4f39d376ef389b
Opcode Fuzzy Hash: 152eaff66b44b3a3c7d4f9b83fed886350595421e1a9360dca2fa1e7d89e122b
Instruction Fuzzy Hash: 25015B75D0063ADBCF10EFE8ED986EDBBB8BB09711F440086E981F2144DB355550C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 01017652 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0101758C,80070057,?,?,?,0101799D), ref: 0101766F
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0101758C,80070057,?,?), ref: 0101768A
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0101758C,80070057,?,?), ref: 01017698
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0101758C,80070057,?), ref: 010176A8
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0101758C,80070057,?,?), ref: 010176B4

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 839eb21d80e7c7c2e8108816e9ebdd5aac26e45f5ef53d926a20ae304b9c4ba5
Instruction ID: add02ab5f85eb72815dd00ab5230874340bc5fc4c57876d06de4861a8ff190d4
Opcode Fuzzy Hash: 839eb21d80e7c7c2e8108816e9ebdd5aac26e45f5ef53d926a20ae304b9c4ba5
Instruction Fuzzy Hash: 7401D4B6600215BBEB204F5CDD44BAA7FECEB48651F100458FE84D7209E73ADD4087A0

Uniqueness

Uniqueness Score: -1.00%

Function 010185F1 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 01018608
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 01018612
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 01018621
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 01018628
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 0101863E

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: c3dfc44b8b9bcfe44fabf1363e2099b3dd22bd651c1f0b8eb44abfd9f231c494
Instruction ID: 2d902fd6c6d9e3c6065a5b5f360881ee9dd2d26e16cdf2ed2b2dab050d9e25f0
Opcode Fuzzy Hash: c3dfc44b8b9bcfe44fabf1363e2099b3dd22bd651c1f0b8eb44abfd9f231c494
Instruction Fuzzy Hash: 89F0C274200205AFEB211FACDDCDE6B3FECEF8A654B004416F985C2144CB7A9841DB60

Uniqueness

Uniqueness Score: -1.00%

Function 01018652 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 01018669
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 01018673
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 01018682
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 01018689
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0101869F

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 83c8a4195c52cbc4219a1437379f22a30da04584553153869cbb5558aef0cc81
Instruction ID: 37cafa33ecd0e9b2cf7e5929c6106e780d43075ec18cba96de8a2df1e087739a
Opcode Fuzzy Hash: 83c8a4195c52cbc4219a1437379f22a30da04584553153869cbb5558aef0cc81
Instruction Fuzzy Hash: 3DF0AFB8200205AFEB211FA8ECC8E673FECEF8A654B100416F985D3144CA6A9900DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0101C6A6 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 0101C6BA
GetWindowTextW.USER32(00000000,?,00000100), ref: 0101C6D1
MessageBeep.USER32(00000000), ref: 0101C6E9
KillTimer.USER32(?,0000040A), ref: 0101C705
EndDialog.USER32(?,00000001), ref: 0101C71F

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 2cd56716015c8835c56a4ac54069eb42b5872eb319d6c27efd2667ff021f458d
Instruction ID: a2a7017dde3e599d4010475c06071e0801866a0f917274196292a7f198dc57cf
Opcode Fuzzy Hash: 2cd56716015c8835c56a4ac54069eb42b5872eb319d6c27efd2667ff021f458d
Instruction Fuzzy Hash: CE0184744403059BFB315B28EE8EF967BB8BB04701F00055DB6C2A14D5DBE9A9548B40

Uniqueness

Uniqueness Score: -1.00%

Function 00FC13B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00FC13BF
StrokeAndFillPath.GDI32(?,?,00FFBAD8,00000000,?), ref: 00FC13DB
SelectObject.GDI32(?,00000000), ref: 00FC13EE
DeleteObject.GDI32 ref: 00FC1401
StrokePath.GDI32(?), ref: 00FC141C

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 074c43ccbdacd7533ee2dd18179fbc750fad4789cd7adc404a931943a2365642
Instruction ID: 87fcf251aebb0c5b770dc831b0d7e01da6fda73d6f06ef1569dc3325bf897e8f
Opcode Fuzzy Hash: 074c43ccbdacd7533ee2dd18179fbc750fad4789cd7adc404a931943a2365642
Instruction Fuzzy Hash: B6F06DB001824ADBDB354F1AEA4DB583BA4BB12326F148318F4E9440E9C33B44A1DF10

Uniqueness

Uniqueness Score: -1.00%

Function 00FD2E5B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00FE0FF6: std::exception::exception.LIBCMT ref: 00FE102C
Part of subcall function 00FE0FF6: __CxxThrowException@8.LIBCMT ref: 00FE1041

Part of subcall function 00FC7F41: _memmove.LIBCMT ref: 00FC7F82

Part of subcall function 00FC7BB1: _memmove.LIBCMT ref: 00FC7C0B

__swprintf.LIBCMT ref: 00FD302D

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00FD2EC6

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 5656bec02a444db37a2e2f729c3434283ad017e7c7d796b0d7594a3581c4de54
Instruction ID: 742775c3b814423c10435a5aa599de400b6bc14e6fb83201a3450bdb8db0915b
Opcode Fuzzy Hash: 5656bec02a444db37a2e2f729c3434283ad017e7c7d796b0d7594a3581c4de54
Instruction Fuzzy Hash: 5F91AD311083029FD718EF24CD8AD6EB7E5EF85710F44091EF5829B2A1DA75EE44EB52

Uniqueness

Uniqueness Score: -1.00%

Function 0102BBA6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00FC48A1,?,?,00FC37C0,?), ref: 00FC48CE

CoInitialize.OLE32(00000000), ref: 0102BC26
CoCreateInstance.OLE32(01052D6C,00000000,00000001,01052BDC,?), ref: 0102BC3F
CoUninitialize.OLE32 ref: 0102BC5C

Part of subcall function 00FC9997: __itow.LIBCMT ref: 00FC99C2
Part of subcall function 00FC9997: __swprintf.LIBCMT ref: 00FC9A0C

Strings

.lnk, xrefs: 0102BC08, 0102BC16

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: adc63f5b52937f71221e8bda5c9e224d4b19c45c57bfd46ea213e0e4f8369d91
Instruction ID: 0580efa5a4c143113801fba1d5ed9c7c212355da90d1b7f56c0e5bf1cba1d676
Opcode Fuzzy Hash: adc63f5b52937f71221e8bda5c9e224d4b19c45c57bfd46ea213e0e4f8369d91
Instruction Fuzzy Hash: FAA143752043129FCB00DF18C985E6ABBE5FF88714F14898CF8999B261CB35ED45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FE524D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00FE52DD

Part of subcall function 00FF0340: __87except.LIBCMT ref: 00FF037B

Strings

pow, xrefs: 00FE52B5, 00FE52D2

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 5b35b51a5797108f38b2e8186dfcf873787688cedeb0239a9027b829037d5f72
Instruction ID: 6fc721b7d2ecc9dbcc453789b9c9abc61962f2b30455635a6f7252886e7f4a25
Opcode Fuzzy Hash: 5b35b51a5797108f38b2e8186dfcf873787688cedeb0239a9027b829037d5f72
Instruction Fuzzy Hash: ED51AE71E0974987CB21B625C94137E3B91AF00B64F608D59E2D5812FBEF798CC4BB42

Uniqueness

Uniqueness Score: -1.00%

Function 00FE023B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

#, xrefs: 00FE0280
+, xrefs: 00FE0277

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: 1fa53b6d83c90de95afe9ba299ebbab4de19ce78cc8822c76195034f00eb1dc5
Instruction ID: 326957e0d48567a1cefc2738dad0ceb5de05aa518c2f342b54327874a8e8c871
Opcode Fuzzy Hash: 1fa53b6d83c90de95afe9ba299ebbab4de19ce78cc8822c76195034f00eb1dc5
Instruction Fuzzy Hash: D35135355042468FDF21AF2DCC89AF97BE4EF9A310F540095E8D19F2A4DB789883DB20

Uniqueness

Uniqueness Score: -1.00%

Function 00FD62F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FD63A8
_memmove.LIBCMT ref: 00FD6446
_memset.LIBCMT ref: 00FD646A

Strings

ERCP, xrefs: 00FD6313

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 1d255c593922b31f3e7168a1ea724972d16fa2f30d6e17e416e8adb6aed9d786
Instruction ID: 4c2cc0963172324395f2bb7926a1ebb1a69df40541eeaed5ce68c4106723080d
Opcode Fuzzy Hash: 1d255c593922b31f3e7168a1ea724972d16fa2f30d6e17e416e8adb6aed9d786
Instruction Fuzzy Hash: ED51A171D003099BDB28DF65C8857AABBF5EF04324F14856FE98ACB341E7759684CB40

Uniqueness

Uniqueness Score: -1.00%

Function 01047BB5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0104F910,00000000,?,?,?,?), ref: 01047C4E
GetWindowLongW.USER32 ref: 01047C6B
SetWindowLongW.USER32(?,000000F0,00000000), ref: 01047C7B

Strings

SysTreeView32, xrefs: 01047C20

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 29ac4ec83214688fc33a79149d7f8a57d9d5afbddcbe2a262217007649a632a3
Instruction ID: 0a047407d9908d435803ed3b2a7cb92f554ba4356b5321c7ec5784269623e1c5
Opcode Fuzzy Hash: 29ac4ec83214688fc33a79149d7f8a57d9d5afbddcbe2a262217007649a632a3
Instruction Fuzzy Hash: 4031E37120020AAFDB619E38DC85BEA7BA9FF45324F204729F9B5931D1D735E8509B90

Uniqueness

Uniqueness Score: -1.00%

Function 01047648 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 010476D0
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 010476E4
SendMessageW.USER32(?,00001002,00000000,?), ref: 01047708

Strings

SysMonthCal32, xrefs: 0104769B

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: fbb3f1c1420c1d1203fb0f329ba79a2f958d658692e9447c2c007d7aaff0b3b5
Instruction ID: 6204c10f4b744c40664e4a39f011044d4da4074708cc3d60d42d802800cf51b6
Opcode Fuzzy Hash: fbb3f1c1420c1d1203fb0f329ba79a2f958d658692e9447c2c007d7aaff0b3b5
Instruction Fuzzy Hash: 0D21B472500219ABDF22CE54CC86FEA3BA5FB4C754F110254FE956B1D1D7B5A8508B90

Uniqueness

Uniqueness Score: -1.00%

Function 01046F1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 01046FAA
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 01046FBA
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 01046FDF

Strings

Listbox, xrefs: 01046F77

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: b5305ac9391f502bc8c3e2bd6e813e83b44438bf4a114aa6d21ae8e433c54f8d
Instruction ID: 257dff18516ef531703a7922ae140b5d07be28320a0538b58dfb18be01008918
Opcode Fuzzy Hash: b5305ac9391f502bc8c3e2bd6e813e83b44438bf4a114aa6d21ae8e433c54f8d
Instruction Fuzzy Hash: 9B21C572610118BFEF128F58CCC5FAB37AAFF8A750F418164F9859B191DA729C51C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0104797D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 010479E1
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 010479F6
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 01047A03

Strings

msctls_trackbar32, xrefs: 010479B8

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: e833233b23bc6e531705403babfbcc486eb81e4c9a51defaba68b415f3747271
Instruction ID: 0466ae7f34f71638ab6eec639d0599b8e46dbd776d1419b05bdc1d220e14d43b
Opcode Fuzzy Hash: e833233b23bc6e531705403babfbcc486eb81e4c9a51defaba68b415f3747271
Instruction Fuzzy Hash: ED11E772250249BBEF219E74CC45FEB77A9EFC9764F02052DF681A6091D272D811CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00FC4C95 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00FC4C2E), ref: 00FC4CA3
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00FC4CB5

Strings

kernel32.dll, xrefs: 00FC4C9E
GetNativeSystemInfo, xrefs: 00FC4CAF

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: f0d661256bcae0dfa440629162172e32702a917cbf22bf093d790775248fd42a
Instruction ID: 6fb35f3f32efa3f76585b464e19413891f8b6107471eac1f5694cd58b257668e
Opcode Fuzzy Hash: f0d661256bcae0dfa440629162172e32702a917cbf22bf093d790775248fd42a
Instruction Fuzzy Hash: 2FD012B4911723CFD7209F39DBA9A0676D5AF06691B11883D98C5D6520D674D880C750

Uniqueness

Uniqueness Score: -1.00%

Function 00FC4D94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00FC4CE1,?), ref: 00FC4DA2
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00FC4DB4

Strings

kernel32.dll, xrefs: 00FC4D9D
Wow64RevertWow64FsRedirection, xrefs: 00FC4DAE

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 8698d0fd7577dcac371597c01b0be65b7570fb992fd62ba789d8c92c6e9ea9ae
Instruction ID: feee7a2729a405c6e7d75dff812333459acbf2cd9d0865439c09094a755aa006
Opcode Fuzzy Hash: 8698d0fd7577dcac371597c01b0be65b7570fb992fd62ba789d8c92c6e9ea9ae
Instruction Fuzzy Hash: 8FD0C2B4900313CFC7305F35C659B4672D4AF06290B00883DD8C2C6510D774D880C750

Uniqueness

Uniqueness Score: -1.00%

Function 00FC4D61 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00FC4D2E,?,00FC4F4F,?,010862F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00FC4D6F
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00FC4D81

Strings

Wow64DisableWow64FsRedirection, xrefs: 00FC4D7B
kernel32.dll, xrefs: 00FC4D6A

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: c078213387769f5beb3b86b7a13b858620e5cb5b34c8772ecfe7bcf1ebc570fb
Instruction ID: 65b76d246f68a22d3ef8d8678c861e0cb359a0bd9c6fae5bb5b4b2fed352f2d4
Opcode Fuzzy Hash: c078213387769f5beb3b86b7a13b858620e5cb5b34c8772ecfe7bcf1ebc570fb
Instruction Fuzzy Hash: 69D012B4910713CFD7305F35DA59B1676D8BF162A1B11887D98C7D6210D675D880CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01041072 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,010412C1), ref: 01041080
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 01041092

Strings

advapi32.dll, xrefs: 0104107B
RegDeleteKeyExW, xrefs: 0104108C

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 32fed3d519d14a058d7725263e5af03ed2e2fb1c4efd2ec83b215aae1e0dc788
Instruction ID: 46f7fcf38d131e309cbfbcfb99c65da4bade0050e1048d88295eef37b68e84b7
Opcode Fuzzy Hash: 32fed3d519d14a058d7725263e5af03ed2e2fb1c4efd2ec83b215aae1e0dc788
Instruction Fuzzy Hash: 19D012F49117138FD7305F39D59895676E4AF05251F118C7DA4C5DA110DAB4D4C0C754

Uniqueness

Uniqueness Score: -1.00%

Function 010393F5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,01039009,?,0104F910), ref: 01039403
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 01039415

Strings

GetModuleHandleExW, xrefs: 0103940F
kernel32.dll, xrefs: 010393FE

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: f596ecb23cbd8a9f6a1f7dd6660403c8665e487f8ae949925e8c4fcc38ad6ded
Instruction ID: 11bd44c6b307e17edae3b950c7110997fe3762dbd17d89ab0ed3139333788bf4
Opcode Fuzzy Hash: f596ecb23cbd8a9f6a1f7dd6660403c8665e487f8ae949925e8c4fcc38ad6ded
Instruction Fuzzy Hash: 39D0C2B4900313CFD7204F39C64890776D8AF02241B10C83D94C1C6510DAB4C4C0C750

Uniqueness

Uniqueness Score: -1.00%

Function 01001B3E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 01001B42
__swprintf.LIBCMT ref: 01001B73

Strings

WIN_XPe, xrefs: 01001BB2
%.3d, xrefs: 01001B4D

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 34844ab1f7fc08c28c37b250e49a640718e191bad41cde71d2c0aceff98b4629
Instruction ID: e1ab5b19105051a4878c21270e96686bd06c71d2419302602a2a271f0a6e911b
Opcode Fuzzy Hash: 34844ab1f7fc08c28c37b250e49a640718e191bad41cde71d2c0aceff98b4629
Instruction Fuzzy Hash: 36D012B6C04519EBDB159A918D89DFD777CAB04301F440592F58692040F379DB849B25

Uniqueness

Uniqueness Score: -1.00%

Function 010176C5 Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b4756d82395062060e7004c1325a9e840668f110db1ec1a84a6a24a208bae8b
Instruction ID: ab3d8b574025ae573560cc5137b8c1cb11098e5a83a213d6e2cf1445f8b1bf36
Opcode Fuzzy Hash: 2b4756d82395062060e7004c1325a9e840668f110db1ec1a84a6a24a208bae8b
Instruction Fuzzy Hash: EBC19075A00216EFDB14CF98C884EAEBBF5FF48310B148598E985EB255D734EE81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0103E33E Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 0103E3D2
CharLowerBuffW.USER32(?,?), ref: 0103E415

Part of subcall function 0103DAB9: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0103DAD9

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 0103E615
_memmove.LIBCMT ref: 0103E628

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: e5e9a011373b1e877a068c131626afea576016f2b804c94c45c585327de6dbd2
Instruction ID: 10b031150b8e685a1e9a44a37d27d3b048b7a38ab2c18dcebefefeb248c2c51d
Opcode Fuzzy Hash: e5e9a011373b1e877a068c131626afea576016f2b804c94c45c585327de6dbd2
Instruction Fuzzy Hash: C8C16B716083428FC754DF28C480A5ABBE4FF88714F048A6DF8999B351DB75E946CF82

Uniqueness

Uniqueness Score: -1.00%

Function 010383A8 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 010383D8
CoUninitialize.OLE32 ref: 010383E3

Part of subcall function 0101DA5D: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0101DAC5

VariantInit.OLEAUT32(?), ref: 010383EE
VariantClear.OLEAUT32(?), ref: 010386BF

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: b92b67b94b87973ac1b1463ec89a371be2b5d70c3b3e23d01d59333f7f1e3986
Instruction ID: 93680846187b5d6f475b9540ee4173385e3fdbfc44cad2029073b6b1c59ddb1d
Opcode Fuzzy Hash: b92b67b94b87973ac1b1463ec89a371be2b5d70c3b3e23d01d59333f7f1e3986
Instruction Fuzzy Hash: BFA127752047029FDB10DF19C985F1ABBE8BF88714F05858DFA9A9B3A1CB74E904DB41

Uniqueness

Uniqueness Score: -1.00%

Function 01017A78 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,01052C7C,?), ref: 01017C32
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,01052C7C,?), ref: 01017C4A
CLSIDFromProgID.OLE32(?,?,00000000,0104FB80,000000FF,?,00000000,00000800,00000000,?,01052C7C,?), ref: 01017C6F
_memcmp.LIBCMT ref: 01017C90

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: d937211655293c0f10e895209af8f7648347150295db874cc6da12e035391871
Instruction ID: a1f3398de00e89bf79301656e86f0c0b5c3ab83fff64f9553d9ebfe654506a02
Opcode Fuzzy Hash: d937211655293c0f10e895209af8f7648347150295db874cc6da12e035391871
Instruction Fuzzy Hash: 1E813B76A00109EFCB04DFD8C984EEEB7B9FF89315F204198E545AB254DB35AE45CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01016DF3 Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 01016E04
SysAllocString.OLEAUT32(00000000), ref: 01016EAD
VariantCopy.OLEAUT32 ref: 01016EDC
VariantClear.OLEAUT32(?), ref: 01016F03

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: de9f0b408223535ca4d55b9cb5c7aae0e9844b41f7d1526b44d0f3ec45c2e013
Instruction ID: 6889224c4cf0f9fd2176a465e536700bb5f7baa0800ede167c9235b020c5caa9
Opcode Fuzzy Hash: de9f0b408223535ca4d55b9cb5c7aae0e9844b41f7d1526b44d0f3ec45c2e013
Instruction Fuzzy Hash: 8C51B134604303DADB60AF69D895B6EB7E5AF48310F50881FF6D6CB295DFB9D8808B11

Uniqueness

Uniqueness Score: -1.00%

Function 01049A63 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 01049AD2
ScreenToClient.USER32(00000002,00000002), ref: 01049B05
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 01049B72

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 7da11f49b51042fe1384832e9deeb1fb553262301ae9277c6524d9eedd779cc8
Instruction ID: 82f8fa730de6b68f64ede41c6603f9c9230b1fffd1a5d614f6ccf0d70a1d8948
Opcode Fuzzy Hash: 7da11f49b51042fe1384832e9deeb1fb553262301ae9277c6524d9eedd779cc8
Instruction Fuzzy Hash: B95141B4900209EFDF21DF58D9C0AAE7BF5FB48324F1082B9F99597291D731A951CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01036CBD Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 01036CE4
WSAGetLastError.WSOCK32(00000000), ref: 01036CF4

Part of subcall function 00FC9997: __itow.LIBCMT ref: 00FC99C2
Part of subcall function 00FC9997: __swprintf.LIBCMT ref: 00FC9A0C

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 01036D58
WSAGetLastError.WSOCK32(00000000), ref: 01036D64

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 05e5714e24a240ab1e0b166f3b3205aa4122b7858d2c75b2a4e95ff3b2437f32
Instruction ID: a6f320c4353b3f2ccc1c3df6dabf32d8c08c7545c258500df031fd3d3b7e9b4f
Opcode Fuzzy Hash: 05e5714e24a240ab1e0b166f3b3205aa4122b7858d2c75b2a4e95ff3b2437f32
Instruction Fuzzy Hash: B041D774740201AFEB20AF28DD8BF7A77E99F44B10F44805CFA599F2C2DAB99D019751

Uniqueness

Uniqueness Score: -1.00%

Function 0103672D Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,0104F910), ref: 010367BA
_strlen.LIBCMT ref: 010367EC

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 17399d066d7b022d175d7bbcb2178c792d205799149f3da52185df078dc18b8b
Instruction ID: dc7f5cd165432c3ddc25d1df999d20baf6666e0f76eafa5fb64519618fc33618
Opcode Fuzzy Hash: 17399d066d7b022d175d7bbcb2178c792d205799149f3da52185df078dc18b8b
Instruction Fuzzy Hash: BE41F575A00106BFCB14EB69CDC5FAEB3ADAF88310F048259F9559B292DF75AE40C750

Uniqueness

Uniqueness Score: -1.00%

Function 0102BA5F Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 0102BB09
GetLastError.KERNEL32(?,00000000), ref: 0102BB2F
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 0102BB54
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 0102BB80

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: ce016cb6b8042d43590f06e2bb33911600066714f917efbbe22262e54051c879
Instruction ID: afd9652f320171d933728f28fd46b59fe72a64cd03834cf282d123965fe78b7f
Opcode Fuzzy Hash: ce016cb6b8042d43590f06e2bb33911600066714f917efbbe22262e54051c879
Instruction Fuzzy Hash: BB415139200512DFCB21DF19C689E5DBBE1EF49710B058488ED8A9B762CB78FD01DB91

Uniqueness

Uniqueness Score: -1.00%

Function 01048AC0 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 01048B4D

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 261b271e898dbf09b28aa8ccb98e8fcb67afd164636a68053f98342f80e506fc
Instruction ID: 608d71346bbbf1fe6cec0a6d0f9813e27151ca43d0826d4c6095228009aafbb3
Opcode Fuzzy Hash: 261b271e898dbf09b28aa8ccb98e8fcb67afd164636a68053f98342f80e506fc
Instruction Fuzzy Hash: E131ADF4644204BFEB619AACCCC5FAD3BA4EB09320F14CE67FBD1D6291C635A5508B81

Uniqueness

Uniqueness Score: -1.00%

Function 0104ADF1 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0104AE1A
GetWindowRect.USER32(?,?), ref: 0104AE90
PtInRect.USER32(?,?,0104C304), ref: 0104AEA0
MessageBeep.USER32(00000000), ref: 0104AF11

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 37850da33febc5705a94ef436f28bcf04d8703b137bd9dc29b9cc02beb331964
Instruction ID: 5826e397cb91ded9249cb000bb3de181fa81306bcb7e796822418bc5b6faa7da
Opcode Fuzzy Hash: 37850da33febc5705a94ef436f28bcf04d8703b137bd9dc29b9cc02beb331964
Instruction Fuzzy Hash: AB418FB4744106DFDB21CF59C4C4A9D7BF5FB49340F1581B9E9AA8B245D732A842CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01020FE6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 01021037
SetKeyboardState.USER32(00000080,?,00000001), ref: 01021053
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 010210B9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 0102110B

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 5ba0c45b57ec68edc783a07b3784a9fa5d12b00dfa8ee093e75ac9168666320f
Instruction ID: 073ae2490bf451b3f6e038e2d8b4efc3aa535aa49a140c459befc02a0e3f04a4
Opcode Fuzzy Hash: 5ba0c45b57ec68edc783a07b3784a9fa5d12b00dfa8ee093e75ac9168666320f
Instruction Fuzzy Hash: 8F313970F446A8AEFB318A6D8C44BFEBBE9AF44310F04435AF6C0521D1C3BD45818791

Uniqueness

Uniqueness Score: -1.00%

Function 01021121 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A4C0D0,?,00008000), ref: 01021176
SetKeyboardState.USER32(00000080,?,00008000), ref: 01021192
PostMessageW.USER32(00000000,00000101,00000000), ref: 010211F1
SendInput.USER32(00000001,?,0000001C,75A4C0D0,?,00008000), ref: 01021243

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 22fab8fef5f0e295ad8afca6c4e5293056e9668456d87f9ed63eb8d51e7a137d
Instruction ID: 7b011da4478fe7d153566581b19c9936cbfbd359de9a8da92ad761e2da187a06
Opcode Fuzzy Hash: 22fab8fef5f0e295ad8afca6c4e5293056e9668456d87f9ed63eb8d51e7a137d
Instruction Fuzzy Hash: 68312670A407286EFF318A6D8804BFEBBFAAB49310F14439AF5C4925D5C37986558791

Uniqueness

Uniqueness Score: -1.00%

Function 00FF6415 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00FF644B
__isleadbyte_l.LIBCMT ref: 00FF6479
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00FF64A7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00FF64DD

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: e2d1a65f2962f47ce78d923b4c90d7bc1312d3052951433d5002214cb312a7ca
Instruction ID: c25730ce1d82335b599cbe260d34b45ee38a28258385dcfa58cd8d91da05767e
Opcode Fuzzy Hash: e2d1a65f2962f47ce78d923b4c90d7bc1312d3052951433d5002214cb312a7ca
Instruction Fuzzy Hash: 6331AD31A0024AAFDB21EF65CC85BBA7BB5FF41320F154029EA64D71B1EB35D850EB90

Uniqueness

Uniqueness Score: -1.00%

Function 01045175 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 01045189

Part of subcall function 0102387D: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 01023897
Part of subcall function 0102387D: GetCurrentThreadId.KERNEL32 ref: 0102389E
Part of subcall function 0102387D: AttachThreadInput.USER32(00000000,?,010252A7), ref: 010238A5

GetCaretPos.USER32(?), ref: 0104519A
ClientToScreen.USER32(00000000,?), ref: 010451D5
GetForegroundWindow.USER32 ref: 010451DB

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: ed7c5a08652e758b17cfbf6efc0105cc5c5cdf42e2d0d11401e8e04fca04d3b9
Instruction ID: 388eb24d1dda0960efb08a3536c6704ec2e2032c199ef26a8cb53f794e993a72
Opcode Fuzzy Hash: ed7c5a08652e758b17cfbf6efc0105cc5c5cdf42e2d0d11401e8e04fca04d3b9
Instruction Fuzzy Hash: 50312175900109AFDB10EFA5CD85EEFB7F9EF98300F10406AE455E7241EA799E05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0104C788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC2612: GetWindowLongW.USER32(?,000000EB), ref: 00FC2623

GetCursorPos.USER32(?), ref: 0104C7C2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00FFBBFB,?,?,?,?,?), ref: 0104C7D7
GetCursorPos.USER32(?), ref: 0104C824
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00FFBBFB,?,?,?), ref: 0104C85E

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: e6e38cce01862684d0e1ac798396437306e505b19b51f8bc48297efb4ec53190
Instruction ID: 52eb2e5787fd595b92950a9bb0db79877fcc0192100a7e32ffa773da0c161f82
Opcode Fuzzy Hash: e6e38cce01862684d0e1ac798396437306e505b19b51f8bc48297efb4ec53190
Instruction Fuzzy Hash: F131E175601018AFEB25CF4CC9D8EEA7BF6FB09320F0440A9FA858B251D7369950DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01018B9E Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 01018652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 01018669
Part of subcall function 01018652: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 01018673
Part of subcall function 01018652: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 01018682
Part of subcall function 01018652: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 01018689
Part of subcall function 01018652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0101869F

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 01018BEB
_memcmp.LIBCMT ref: 01018C0E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 01018C44
HeapFree.KERNEL32(00000000), ref: 01018C4B

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 9868f059cd2ac16d81ebd75eee3a00df33288d257773df7604f192be39ddf26f
Instruction ID: d9fe4dd7ac8745e640e42eb74634aab3547613f7a86533fc30c5f4f3914e4c69
Opcode Fuzzy Hash: 9868f059cd2ac16d81ebd75eee3a00df33288d257773df7604f192be39ddf26f
Instruction Fuzzy Hash: A7216D71E01209ABDB10DF98C944BEEB7F8FF44354F14809AE994A7244D739AA05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FE0BD0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00FE0BF2

Part of subcall function 00FC5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,01027B20,?,?,00000000), ref: 00FC5B8C
Part of subcall function 00FC5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,01027B20,?,?,00000000,?,?), ref: 00FC5BB0

_fprintf.LIBCMT ref: 00FE0C29
OutputDebugStringW.KERNEL32(?), ref: 01016331

Part of subcall function 00FE4CDA: _flsall.LIBCMT ref: 00FE4CF3

__setmode.LIBCMT ref: 00FE0C5E

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: e3e04d34ee98587396b7a7b67ba73fca88b1803d896e45cb133ff481e3697c81
Instruction ID: 60fcb7a68b789ed8b623ac34c8ad16572f399129426d0b107ed910473caea12a
Opcode Fuzzy Hash: e3e04d34ee98587396b7a7b67ba73fca88b1803d896e45cb133ff481e3697c81
Instruction Fuzzy Hash: B3113A32A042457BCB04B7BAAC47EBE7B699F41320F24415EF104971C2DE792D816791

Uniqueness

Uniqueness Score: -1.00%

Function 01031A5B Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 01031A97

Part of subcall function 01031B21: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 01031B40
Part of subcall function 01031B21: InternetCloseHandle.WININET(00000000), ref: 01031BDD

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 33de4ac9abaaa790e5e809277d00dc19ff3377cf2f4bed717f221cf1c20a98f3
Instruction ID: 70454c2e1f6e08ff9f71416db47bbafacabd9e5612869b75e91d46e00d3ab835
Opcode Fuzzy Hash: 33de4ac9abaaa790e5e809277d00dc19ff3377cf2f4bed717f221cf1c20a98f3
Instruction Fuzzy Hash: E521A475200601BFEB169F648C00FBBBBEDFF8C601F00401AFA91D6550E775D41197A0

Uniqueness

Uniqueness Score: -1.00%

Function 0101E1AF Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0101F5AD: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,0101E1C4,?,?,?,0101EFB7,00000000,000000EF,00000119,?,?), ref: 0101F5BC
Part of subcall function 0101F5AD: lstrcpyW.KERNEL32(00000000,?), ref: 0101F5E2
Part of subcall function 0101F5AD: lstrcmpiW.KERNEL32(00000000,?,0101E1C4,?,?,?,0101EFB7,00000000,000000EF,00000119,?,?), ref: 0101F613

lstrlenW.KERNEL32(?,00000002,?,?,?,?,0101EFB7,00000000,000000EF,00000119,?,?,00000000), ref: 0101E1DD
lstrcpyW.KERNEL32(00000000,?), ref: 0101E203
lstrcmpiW.KERNEL32(00000002,cdecl,?,0101EFB7,00000000,000000EF,00000119,?,?,00000000), ref: 0101E237

Strings

cdecl, xrefs: 0101E22E

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 6dade2dd40109d3be3ac2c753f0007a961a260e37f9a25123222b5aca25d436b
Instruction ID: a077e7d043f3473b0d79dadbc821d8a15dfe41fae2aadc9314d3547cb39894b9
Opcode Fuzzy Hash: 6dade2dd40109d3be3ac2c753f0007a961a260e37f9a25123222b5aca25d436b
Instruction Fuzzy Hash: 3511D33A200342EFCB26AF68D844DBE77E8FF45310B40802AED46CB258EB75D850D790

Uniqueness

Uniqueness Score: -1.00%

Function 00FF5332 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00FF5351

Part of subcall function 00FE594C: __FF_MSGBANNER.LIBCMT ref: 00FE5963
Part of subcall function 00FE594C: __NMSG_WRITE.LIBCMT ref: 00FE596A
Part of subcall function 00FE594C: RtlAllocateHeap.NTDLL(01820000,00000000,00000001,00000000,?,?,?,00FE1013,?), ref: 00FE598F

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 3c6de64db33d65459f540b9ad32c556e3783d39a2b7afb05ee0957178fcfc5f1
Instruction ID: 11288a9f0f2a6785d9141f3e5dedafc3be6d8d1ed4ab73f6fb76670d70f2d888
Opcode Fuzzy Hash: 3c6de64db33d65459f540b9ad32c556e3783d39a2b7afb05ee0957178fcfc5f1
Instruction Fuzzy Hash: 8A11E732904A1AAFCB313FB9EC4477D37995F10BF1F144429FB889A1A1DE7A8941B750

Uniqueness

Uniqueness Score: -1.00%

Function 00FC4531 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FC4560

Part of subcall function 00FC410D: _memset.LIBCMT ref: 00FC418D
Part of subcall function 00FC410D: _wcscpy.LIBCMT ref: 00FC41E1
Part of subcall function 00FC410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00FC41F1

KillTimer.USER32(?,00000001,?,?), ref: 00FC45B5
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00FC45C4
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00FFD6CE

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: f9cd1f62cf06ab2d109e3c7c9a1e90c37fd64b62d9e849f9012db05bed7714b2
Instruction ID: 49d2b9c5e4b41842d745df90dbed757199921130c054f50acae55f16ea55c0ce
Opcode Fuzzy Hash: f9cd1f62cf06ab2d109e3c7c9a1e90c37fd64b62d9e849f9012db05bed7714b2
Instruction Fuzzy Hash: 05212571904788AFEB328B248956FF6BBEC9F01318F04009DE3DE96245C7792A84AB41

Uniqueness

Uniqueness Score: -1.00%

Function 010240B1 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 010240D1
_memset.LIBCMT ref: 010240F2
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 01024144
CloseHandle.KERNEL32(00000000), ref: 0102414D

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: a0caaa9b8d05030f6772e57598152ba597d63e8252a22674c810613c76ac8adf
Instruction ID: 164a0fec89ab1b781bf9813710f423aba1b5515f3a6b69abf6855a707c4d03f8
Opcode Fuzzy Hash: a0caaa9b8d05030f6772e57598152ba597d63e8252a22674c810613c76ac8adf
Instruction Fuzzy Hash: D111AB75D012387AD7305AA99C8DFABBBBCEF45760F1045D6F908D7180D6744E808BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0103667C Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,01027B20,?,?,00000000), ref: 00FC5B8C
Part of subcall function 00FC5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,01027B20,?,?,00000000,?,?), ref: 00FC5BB0

gethostbyname.WSOCK32(?), ref: 010366AC
WSAGetLastError.WSOCK32(00000000), ref: 010366B7
_memmove.LIBCMT ref: 010366E4
inet_ntoa.WSOCK32(?), ref: 010366EF

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 443526cf5721a66ad90c8c569a1f4580e1a3e261ec68cc8dbb301385c741eb1f
Instruction ID: 1b770fec8a4cc0543ecc33aca47efaea4f534c30a683a22577b8195c12fa5221
Opcode Fuzzy Hash: 443526cf5721a66ad90c8c569a1f4580e1a3e261ec68cc8dbb301385c741eb1f
Instruction Fuzzy Hash: 2D11907650010AAFCB00EBA5DE86DEEB7B8AF44710B044069F502A7161DF79AF04DB61

Uniqueness

Uniqueness Score: -1.00%

Function 01019023 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 01019043
SendMessageW.USER32(?,000000C9,?,00000000), ref: 01019055
SendMessageW.USER32(?,000000C9,?,00000000), ref: 0101906B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 01019086

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4a4bdc6a944f99576a471ddac9556cc2b6a7db6d8117d4f2d3feb1c2c76f9937
Instruction ID: 1149ce3657dc50bf536deb09d092cd5f8081c2f79720f2de91d6d8287237e655
Opcode Fuzzy Hash: 4a4bdc6a944f99576a471ddac9556cc2b6a7db6d8117d4f2d3feb1c2c76f9937
Instruction Fuzzy Hash: 36115A79901219FFEB11DFA9C984EADBBB8FB48350F204095FA44B7294D6726E10DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FC1290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00FC2612: GetWindowLongW.USER32(?,000000EB), ref: 00FC2623

DefDlgProcW.USER32(?,00000020,?), ref: 00FC12D8
GetClientRect.USER32(?,?), ref: 00FFB84B
GetCursorPos.USER32(?), ref: 00FFB855
ScreenToClient.USER32(?,?), ref: 00FFB860

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: a03937b596406e8711b760f167f3da64c8c13cbff6b2563b8aef45b3ec094925
Instruction ID: 41749e912415047e02fe89875a48f2afddcc1c74df54e00a469d040f32282bab
Opcode Fuzzy Hash: a03937b596406e8711b760f167f3da64c8c13cbff6b2563b8aef45b3ec094925
Instruction Fuzzy Hash: 72112B7990001AEBDB10EFA8DA86EEE77B8FB06301F000459E951E7141C735BA61ABA5

Uniqueness

Uniqueness Score: -1.00%

Function 01021652 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,010201FD,?,01021250,?,00008000), ref: 0102166F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,010201FD,?,01021250,?,00008000), ref: 01021694
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,010201FD,?,01021250,?,00008000), ref: 0102169E
Sleep.KERNEL32(?,?,?,?,?,?,?,010201FD,?,01021250,?,00008000), ref: 010216D1

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 16f6e6f700a6475e6212cf7a7852d82660385fcc52f066216be97e8e57135f93
Instruction ID: 3e966406413472210e6c2029d07f8dcb3f461abdf2cf824afa296b508c014f1e
Opcode Fuzzy Hash: 16f6e6f700a6475e6212cf7a7852d82660385fcc52f066216be97e8e57135f93
Instruction Fuzzy Hash: 25113C71D0052DE7CF20AFA9E988AEEBF78FF0D751F054095E980B6244CB355560CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0101DD22 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 0101DD3E
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 0101DD55
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 0101DD6A
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 0101DD88

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: ad0444e6477ce3fb86a02e26cc134b7a42fd03d3467f64e976b93e2e914dd7b7
Instruction ID: 29c5126fe92f1b43289199f7a9937113170c5f2a2d1dba8693a311f0f0be3d6a
Opcode Fuzzy Hash: ad0444e6477ce3fb86a02e26cc134b7a42fd03d3467f64e976b93e2e914dd7b7
Instruction Fuzzy Hash: E211A1B5201305EBE720EF54DD4CB96BBBCEF01B08F40855AAA96C6144DBB9E504CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FF7207 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00FF722B

Part of subcall function 00FF7912: __fltout2.LIBCMT ref: 00FF793B

__cftog_l.LIBCMT ref: 00FF7251
__cftoe_l.LIBCMT ref: 00FF7283

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 6cd2e390a946091f402a1197efef3675b6d33d83954d3cdd7525b065202c31b5
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: AD014C3644824EBBCF126E84DC018EEBF62BF69351B588615FB1858031D237C9B1BF81

Uniqueness

Uniqueness Score: -1.00%

Function 0104B57F Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0104B59E
ScreenToClient.USER32(?,?), ref: 0104B5B6
ScreenToClient.USER32(?,?), ref: 0104B5DA
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0104B5F5

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 6931e7cb0faca919299a236abe004a37ab2673082c46ab7a544707c1253d0c9e
Instruction ID: ed483cf32da9dd4faa6edc280e54afb22fcf3f00aa183ea4f7a5ae4a88e7782c
Opcode Fuzzy Hash: 6931e7cb0faca919299a236abe004a37ab2673082c46ab7a544707c1253d0c9e
Instruction Fuzzy Hash: 861163B9D0020AEFDB51DFA9C584AEEFBF9FB08310F108166E954E3210D735AA518F90

Uniqueness

Uniqueness Score: -1.00%

Function 0104B8EF Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0104B8FE
_memset.LIBCMT ref: 0104B90D
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,01087F20,01087F64), ref: 0104B93C
CloseHandle.KERNEL32 ref: 0104B94E

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 89d6c6a9f415ead19b6cb2d6b41cfcdfba7bf831202ad2e048cd23c138b63cfb
Instruction ID: fb0459335d5f1f24e8e031d1257a6954f7106f3176d041ae98ad0f87dd48eb07
Opcode Fuzzy Hash: 89d6c6a9f415ead19b6cb2d6b41cfcdfba7bf831202ad2e048cd23c138b63cfb
Instruction Fuzzy Hash: 49F082F2544310BBF2202666AC49FBF3A9CEB08758F104060BBC8D618FD77A4D0087A8

Uniqueness

Uniqueness Score: -1.00%

Function 01026E7C Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 01026E88

Part of subcall function 0102794E: _memset.LIBCMT ref: 01027983

_memmove.LIBCMT ref: 01026EAB
_memset.LIBCMT ref: 01026EB8
LeaveCriticalSection.KERNEL32(?), ref: 01026EC8

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 7b6b3c89a90bc4ab35b990e09b0d22ad45ccaa0deda3cca9aae26ca04482692a
Instruction ID: b7c40778f4fd2e9de135908e063e7c029bf89759cb4d2638e8aab281056aa324
Opcode Fuzzy Hash: 7b6b3c89a90bc4ab35b990e09b0d22ad45ccaa0deda3cca9aae26ca04482692a
Instruction Fuzzy Hash: 28F05E7A200210ABCF116F55DD84A8ABB2AEF45320B08C055FE089F21AC736A911DBB4

Uniqueness

Uniqueness Score: -1.00%

Function 0104C00C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00FC12F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00FC134D
Part of subcall function 00FC12F3: SelectObject.GDI32(?,00000000), ref: 00FC135C
Part of subcall function 00FC12F3: BeginPath.GDI32(?), ref: 00FC1373
Part of subcall function 00FC12F3: SelectObject.GDI32(?,00000000), ref: 00FC139C

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0104C030
LineTo.GDI32(00000000,?,?), ref: 0104C03D
EndPath.GDI32(00000000), ref: 0104C04D
StrokePath.GDI32(00000000), ref: 0104C05B

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 1dc72ed73465ca6d8ae1e50339241e28fbe74030c6d551a26753d9913e35dafd
Instruction ID: 5eebb8efa46d697dd1032382ebb2bd9618206b430c3e33be1a3d0998ba81c9a7
Opcode Fuzzy Hash: 1dc72ed73465ca6d8ae1e50339241e28fbe74030c6d551a26753d9913e35dafd
Instruction Fuzzy Hash: 11F0BE7500525ABBEB326F58ED0EFCE3F98AF06310F044100FA91210D587BA0160CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0101A37C Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0101A399
GetWindowThreadProcessId.USER32(?,00000000), ref: 0101A3AC
GetCurrentThreadId.KERNEL32 ref: 0101A3B3
AttachThreadInput.USER32(00000000), ref: 0101A3BA

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 387c45cc7dede41937c90e6d111b74ef644bc95ab8a4c18127ce200512de7584
Instruction ID: f78bf9f569e0fdfa3cb041f493c087578452f4627ac6d1eb440e2c2825b4a91d
Opcode Fuzzy Hash: 387c45cc7dede41937c90e6d111b74ef644bc95ab8a4c18127ce200512de7584
Instruction Fuzzy Hash: 7CE03071241268BBEB211A65DD4CFD77F5CEF167A1F008015F989D6054C6BA8540C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00FC2218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00FC2231
SetTextColor.GDI32(?,000000FF), ref: 00FC223B
SetBkMode.GDI32(?,00000001), ref: 00FC2250
GetStockObject.GDI32(00000005), ref: 00FC2258
GetWindowDC.USER32(?,00000000), ref: 00FFC0D3
GetPixel.GDI32(00000000,00000000,00000000), ref: 00FFC0E0
GetPixel.GDI32(00000000,?,00000000), ref: 00FFC0F9
GetPixel.GDI32(00000000,00000000,?), ref: 00FFC112
GetPixel.GDI32(00000000,?,?), ref: 00FFC132
ReleaseDC.USER32(?,00000000), ref: 00FFC13D

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 57c3bef8b355d5287d89fa26ea333ca56b78e01e75d55ab35126aa2c1a6a263d
Instruction ID: 8aebf47b0d08c6cf6d876fc6331a285e4c115a99f2b109036f339f6ec24618c1
Opcode Fuzzy Hash: 57c3bef8b355d5287d89fa26ea333ca56b78e01e75d55ab35126aa2c1a6a263d
Instruction Fuzzy Hash: A0E06576500149ABEB315F68FA4D7D83B10EB06332F008356FBA9580F587764590DB51

Uniqueness

Uniqueness Score: -1.00%

Function 01018C5A Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 01018C63
OpenThreadToken.ADVAPI32(00000000,?,?,?,0101882E), ref: 01018C6A
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,0101882E), ref: 01018C77
OpenProcessToken.ADVAPI32(00000000,?,?,?,0101882E), ref: 01018C7E

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: e89a513c7b51361a5fc1446841431d077ca715323376bb57773a7aeabb394687
Instruction ID: 093c894f67dcd02a0faa94ef46e66411d479e25370ad56531d0775d769795f2a
Opcode Fuzzy Hash: e89a513c7b51361a5fc1446841431d077ca715323376bb57773a7aeabb394687
Instruction Fuzzy Hash: 58E086BA642212EBD7705FBC6F4CB573BACEF41792F048858B6C5C9048D63D8041CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01002187 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 01002187
GetDC.USER32(00000000), ref: 01002191
GetDeviceCaps.GDI32(00000000,0000000C), ref: 010021B1
ReleaseDC.USER32(?), ref: 010021D2

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 870479243c7edc7ead0b63df9bbf9d35ab516f3aba21b51e9fdcc0bd1341b689
Instruction ID: e1cbb5758ecb8fe7dcb63e556d0967538e9fd365f42fb3d51486e4fc7bb8c4b4
Opcode Fuzzy Hash: 870479243c7edc7ead0b63df9bbf9d35ab516f3aba21b51e9fdcc0bd1341b689
Instruction Fuzzy Hash: 95E0E5B9800606EFDB11AFB5DA49B9E7BB1EB5C350F118409FD9A97250CB7D8141AF40

Uniqueness

Uniqueness Score: -1.00%

Function 0100219B Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0100219B
GetDC.USER32(00000000), ref: 010021A5
GetDeviceCaps.GDI32(00000000,0000000C), ref: 010021B1
ReleaseDC.USER32(?), ref: 010021D2

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: da4991181ce18a1e0af6708020f2d2a8314b1833b7bb415e6c47579684798a89
Instruction ID: 05d1e39e82520574ed549af86d5e3e6ff4da8854e8bee4b383c9a6ecf19d76b1
Opcode Fuzzy Hash: da4991181ce18a1e0af6708020f2d2a8314b1833b7bb415e6c47579684798a89
Instruction Fuzzy Hash: A5E0E5B9800206AFCB21AFB5CA49A9E7BA1EB4C310F118009FD9A97210CB7D9141AF40

Uniqueness

Uniqueness Score: -1.00%

Function 0101B7B6 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 0101B981

Strings

AutoIt3GUI, xrefs: 0101B8F9
Container, xrefs: 0101B8FE

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 7c2c1a729384e9a4bf833184c70c5a7b3b7c7b3c6c15c1b460cca42c10d8ed4d
Instruction ID: 0efb4f893902c2360365288366f55c66b1dddbcb74642a4ee59cbdca43b258dc
Opcode Fuzzy Hash: 7c2c1a729384e9a4bf833184c70c5a7b3b7c7b3c6c15c1b460cca42c10d8ed4d
Instruction Fuzzy Hash: F8915B716002029FDB64DF68C884A6ABBF5FF48710F1485ADF98ACB295DB75E841CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0102B217 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00FDFEC6: _wcscpy.LIBCMT ref: 00FDFEE9

Part of subcall function 00FC9997: __itow.LIBCMT ref: 00FC99C2
Part of subcall function 00FC9997: __swprintf.LIBCMT ref: 00FC9A0C

__wcsnicmp.LIBCMT ref: 0102B298
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 0102B361

Strings

LPT, xrefs: 0102B292

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 5162b67a78c42f6a3082b5145dc9cce8fb4240db445484655daf3a9b8b831f29
Instruction ID: 4ab6d482dcca87941766afd58e1aca988fad6065a4ceaeeda45c771a2e5c75a7
Opcode Fuzzy Hash: 5162b67a78c42f6a3082b5145dc9cce8fb4240db445484655daf3a9b8b831f29
Instruction Fuzzy Hash: E7618375A04225EFCB14DF98C985EAEB7F4EF08710F05809AF986AB351DB74AE44CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FD2AB7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00FD2AC8
GlobalMemoryStatusEx.KERNEL32(?), ref: 00FD2AE1

Strings

@, xrefs: 00FD2AD5

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: c8fa42e3e10dba1ce9780456913fadec896166a600ef4fdcb688168f22c36739
Instruction ID: aef8466030424f97bab3f4a23bc005cdd4d352d234bb11aa9d1e0d7876479262
Opcode Fuzzy Hash: c8fa42e3e10dba1ce9780456913fadec896166a600ef4fdcb688168f22c36739
Instruction Fuzzy Hash: 565168714187459BD320AF11DD8AFABBBE8FF84310F42884DF1D981095DB798428DB26

Uniqueness

Uniqueness Score: -1.00%

Function 010299BE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00FC506B: __fread_nolock.LIBCMT ref: 00FC5089

_wcscmp.LIBCMT ref: 01029AAE
_wcscmp.LIBCMT ref: 01029AC1

Strings

FILE, xrefs: 010299FA

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: a4e0b19dddf2a0f0fce71e5712d99bea1c2f89d8410a4ac3eb545d475a4b7c85
Instruction ID: d17354d32d4b9aea3edbbe57eb9de891f2888ae2cffc9a8ba7061fbaf12e11ce
Opcode Fuzzy Hash: a4e0b19dddf2a0f0fce71e5712d99bea1c2f89d8410a4ac3eb545d475a4b7c85
Instruction Fuzzy Hash: 8D410671A4062ABADF219BA4CC46FEFBBFDDF45B14F000079F940E7181DA75AA4487A1

Uniqueness

Uniqueness Score: -1.00%

Function 01032882 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 01032892
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 010328C8

Strings

|, xrefs: 01032899

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 91371256fef38153db6bf90e527e1eadf6df0b28c7f6daee8553bbe906c2c86f
Instruction ID: 9edc70752d8bdab3d3501bd9d49c3e154c9d34cd5fae6605b1ae920351c3b79b
Opcode Fuzzy Hash: 91371256fef38153db6bf90e527e1eadf6df0b28c7f6daee8553bbe906c2c86f
Instruction Fuzzy Hash: 4631507180121AAFCF01EFA5CC86EEEBFB9FF08350F10406AF914A6165DB355A56DB60

Uniqueness

Uniqueness Score: -1.00%

Function 01046CD2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 01046D86
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 01046DC2

Strings

static, xrefs: 01046D22

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: e20cc9b6d9df66c141c016b13c909e80efdf025b367cb2954b897dd17c844a8c
Instruction ID: ada0f5a9cc694d3b58f3b8ee9effe493a3969a21ebd7b8886d4111241d756754
Opcode Fuzzy Hash: e20cc9b6d9df66c141c016b13c909e80efdf025b367cb2954b897dd17c844a8c
Instruction Fuzzy Hash: DB318FB1500605AFEB11AF28CC80BFB77A8FF49724F108529F9E597191DA36A891DB60

Uniqueness

Uniqueness Score: -1.00%

Function 01022D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 01022E00
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 01022E3B

Strings

0, xrefs: 01022DF9

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 7ab3c99c102cf13596b284460d9d338024c51980f9117711d9942c76ae7e8916
Instruction ID: 3b84f1fe6832dc27c4ac97a2b9bc69427d11812dcff083570b64d6da2b083f71
Opcode Fuzzy Hash: 7ab3c99c102cf13596b284460d9d338024c51980f9117711d9942c76ae7e8916
Instruction Fuzzy Hash: CD31E371600325ABEF649E8DC884BAEBFF9FF05300F1400A9EAC5971A0D7709580EB50

Uniqueness

Uniqueness Score: -1.00%

Function 01046943 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 010469D0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 010469DB

Strings

Combobox, xrefs: 0104699D

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: b73fd399eb641f5b48fe0a15c22031a095aa03600ad9a964ba39e230d95e241b
Instruction ID: 8d9e93543d0ff13aaafa4de6422c69d9c4a73a71afcaf418d5c318a728a20c55
Opcode Fuzzy Hash: b73fd399eb641f5b48fe0a15c22031a095aa03600ad9a964ba39e230d95e241b
Instruction Fuzzy Hash: DE11E9B56101096FEF129E18CCC0EFB37AEEB8A3A4F110135F99897291E6769C5087A0

Uniqueness

Uniqueness Score: -1.00%

Function 01046E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00FC1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00FC1D73
Part of subcall function 00FC1D35: GetStockObject.GDI32(00000011), ref: 00FC1D87
Part of subcall function 00FC1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00FC1D91

GetWindowRect.USER32(00000000,?), ref: 01046EE0
GetSysColor.USER32(00000012), ref: 01046EFA

Strings

static, xrefs: 01046EBD

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: e05a7fe7108e9851aa2e841d106ab3edd28a72b60f7b845282191de9bfcc83d6
Instruction ID: 53474c312a18da687908e3e15cb99596b38c42a1e8b17d61f4e27fb57f7ff63f
Opcode Fuzzy Hash: e05a7fe7108e9851aa2e841d106ab3edd28a72b60f7b845282191de9bfcc83d6
Instruction Fuzzy Hash: 5D2117B261020AAFDB14DFA8C985AEA7BF8FB09314F014669F995D2240E635E8619B50

Uniqueness

Uniqueness Score: -1.00%

Function 01046B8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 01046C11
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 01046C20

Strings

edit, xrefs: 01046BF5

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: fc617fbdb6b6c751f55a2feb22eb991981f2bd43ac36ea686e893baf3777efec
Instruction ID: e0a02b5ff545e2fb2656b44e720a71f9bfb13baca6e2c7e1bd9703f22558e89e
Opcode Fuzzy Hash: fc617fbdb6b6c751f55a2feb22eb991981f2bd43ac36ea686e893baf3777efec
Instruction Fuzzy Hash: 3611BFB1500209ABEB515E68DC81AFB37A9EB06374F104728F9A1971D0D676DC909BA0

Uniqueness

Uniqueness Score: -1.00%

Function 01022E9E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 01022F11
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 01022F30

Strings

0, xrefs: 01022F07

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 9b2e9d3b1e80b5523b9d801414427bca43b900a18f8f1e0f8f7ac8d323bdeac0
Instruction ID: c73b9e136482d78a8793880d156fd39b2536241fe88e021cda674c27f450a745
Opcode Fuzzy Hash: 9b2e9d3b1e80b5523b9d801414427bca43b900a18f8f1e0f8f7ac8d323bdeac0
Instruction Fuzzy Hash: 6811E671905134ABEBA0EADCDC44FAE7BE9EB01310F0500F1EAC4A72A0DBB1A904C795

Uniqueness

Uniqueness Score: -1.00%

Function 010324CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 01032520
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 01032549

Strings

<local>, xrefs: 01032511

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 87f39f98dbdeddc2433ce7b592e8e8726fefc1f030d9dcf7d4c0a7b1f9163ae6
Instruction ID: 9b7fce2afd564ce8ef6d162985f964ebeb40074fbef4e9251a980877d5146c99
Opcode Fuzzy Hash: 87f39f98dbdeddc2433ce7b592e8e8726fefc1f030d9dcf7d4c0a7b1f9163ae6
Instruction Fuzzy Hash: 481106B0500225BADB259F558C99FBBFFACFF46651F00816AF58686081D7706650C7F0

Uniqueness

Uniqueness Score: -1.00%

Function 010380A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0103830B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,010380C8,?,00000000,?,?), ref: 01038322

inet_addr.WSOCK32(00000000), ref: 010380CB
htons.WSOCK32(00000000), ref: 01038108

Strings

255.255.255.255, xrefs: 010380E3

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: 756a16bcb0deabc14e59fcd5982cf6aa872f61e112707971983acd219734cc87
Instruction ID: c6fd15d08da3e4c2a67fdb8eb97b024148909a6e19c3368fcb3a6d08dd868949
Opcode Fuzzy Hash: 756a16bcb0deabc14e59fcd5982cf6aa872f61e112707971983acd219734cc87
Instruction Fuzzy Hash: F811E574600206ABDB20DF68CC86FEEB368FF44310F10C69BFA5197281DA76A810C755

Uniqueness

Uniqueness Score: -1.00%

Function 010192E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC7F41: _memmove.LIBCMT ref: 00FC7F82

Part of subcall function 0101B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0101B0E7

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 01019355

Strings

ComboBox, xrefs: 010192F4
ListBox, xrefs: 0101931F

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 4e776baad4f721ca18f0f2d9acaa162e771763abf8c9dc39524851c6baeb449c
Instruction ID: c8a3d157c7781cac4ceac45fb7016b5dc8c734b73def42c0d13cf97f343eaef6
Opcode Fuzzy Hash: 4e776baad4f721ca18f0f2d9acaa162e771763abf8c9dc39524851c6baeb449c
Instruction Fuzzy Hash: 8301F171A01216ABCB04FBA5CCA2DFE77A9BF06760B00065DF9B2572C5DF396908D750

Uniqueness

Uniqueness Score: -1.00%

Function 010191DF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC7F41: _memmove.LIBCMT ref: 00FC7F82

Part of subcall function 0101B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0101B0E7

SendMessageW.USER32(?,00000180,00000000,?), ref: 0101924D

Strings

ComboBox, xrefs: 010191EC
ListBox, xrefs: 01019217

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: b067752d1eca55d93c7eeee031149ec13ce34b8f6f89b1214d7d4825e1962ccc
Instruction ID: a2b44ff2af167cad63b3ef36c4ee732737c27836937290ad13c94ee0c9eeb758
Opcode Fuzzy Hash: b067752d1eca55d93c7eeee031149ec13ce34b8f6f89b1214d7d4825e1962ccc
Instruction Fuzzy Hash: FD014271E4120A6BCB04FBA0CEA2EFE77AC9F05740F10015DB98267281EE1D6F0C96B1

Uniqueness

Uniqueness Score: -1.00%

Function 01019264 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC7F41: _memmove.LIBCMT ref: 00FC7F82

Part of subcall function 0101B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0101B0E7

SendMessageW.USER32(?,00000182,?,00000000), ref: 010192D0

Strings

ComboBox, xrefs: 01019271
ListBox, xrefs: 0101929C

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 65f47d9d3c2d450b090c858b36acd19da6464f869e1023cd898d354c6fc97200
Instruction ID: 509372767e9a1d7ca992a9fc30ca0313f45ac33d086158b6dcf30736106392a8
Opcode Fuzzy Hash: 65f47d9d3c2d450b090c858b36acd19da6464f869e1023cd898d354c6fc97200
Instruction Fuzzy Hash: F0012671E4120A6BCB00FAA5CE92EFE77AC9F10750F14015DB98263285DA2D5F0C96B1

Uniqueness

Uniqueness Score: -1.00%

Function 010251CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 010251E8
_wcscmp.LIBCMT ref: 010251FA

Strings

#32770, xrefs: 010251F4

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: fb14bacbf205e0a03e08bb012dd4fc811093037cad311212581d17d8e8627115
Instruction ID: 07644d08d8fd743db838f3bc4844b9361f2b9f0c1f8c90819145ddcc01c676eb
Opcode Fuzzy Hash: fb14bacbf205e0a03e08bb012dd4fc811093037cad311212581d17d8e8627115
Instruction Fuzzy Hash: 4CE02B72A0423957D32095999C49B97F7ACEB41721F00005AF950D3040D565950587E0

Uniqueness

Uniqueness Score: -1.00%

Function 010181BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 010181CA

Part of subcall function 00FE3598: _doexit.LIBCMT ref: 00FE35A2

Strings

Error allocating memory., xrefs: 010181C3
AutoIt, xrefs: 010181BE

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 7092347f715947309570d8d5d9f3dc211c3ea389df48d01166973225118fcade
Instruction ID: e0f2163a70135eb313dc36180f37ea71db9fa40599a673360a65bf46723f50b6
Opcode Fuzzy Hash: 7092347f715947309570d8d5d9f3dc211c3ea389df48d01166973225118fcade
Instruction Fuzzy Hash: 64D05B323C535932D26432BA6D0BFC67D884B05B55F04441ABB48995D38EEA558152DD

Uniqueness

Uniqueness Score: -1.00%

Function 00FFB511 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00FFB564: _memset.LIBCMT ref: 00FFB571

Part of subcall function 00FE0B84: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00FFB540,?,?,?,00FC100A), ref: 00FE0B89

IsDebuggerPresent.KERNEL32(?,?,?,00FC100A), ref: 00FFB544
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00FC100A), ref: 00FFB553

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00FFB54E

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 29048dfa1d57ced926229ff448fe3d3fb708e6ec01d70d2451d3755d1d371841
Instruction ID: 40664510df01fee249e211ab69aa17f3e328725f7333b51b427221ac02521f66
Opcode Fuzzy Hash: 29048dfa1d57ced926229ff448fe3d3fb708e6ec01d70d2451d3755d1d371841
Instruction Fuzzy Hash: 4CE06DB46007158BD330DF29DA047527BE4AF00758F08892DE5C6C6255DBBDD444DB61

Uniqueness

Uniqueness Score: -1.00%

Function 01045BEB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 01045BF5
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 01045C08

Part of subcall function 010254E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0102555E

Strings

Shell_TrayWnd, xrefs: 01045BEE

Memory Dump Source

Source File: 00000000.00000002.1224790304.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.1224692847.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.000000000104F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225416317.0000000001075000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225611549.000000000107F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001088000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.000000000108A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1225930818.0000000001098000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_DPT_590327839_027838893200_____________________________.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: dbb2f83a5bf12dcf1b8bc18204d28a6505cc8dfe6c07242f7a031db678b537e5
Instruction ID: 9aa54ff305ee12a4fc1501182b7dc3894b5676d13adabe0d4eed12fab843cb4c
Opcode Fuzzy Hash: dbb2f83a5bf12dcf1b8bc18204d28a6505cc8dfe6c07242f7a031db678b537e5
Instruction Fuzzy Hash: BCD0A975388312B7E334AA30AC4BFD76A10AB00B40F000828B385AA0C0C8E86800C344

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DPT_590327839_027838893200_____________________________.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\aut9B87.tmp

C:\Users\user\AppData\Local\Temp\aut9BE5.tmp

C:\Users\user\AppData\Local\Temp\electicism

C:\Users\user\AppData\Local\Temp\intemeration

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

Windows Analysis Report
DPT_590327839_027838893200_____________________________.exe

Function 00FC3B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Function 00FC4AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 00FC4FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 010293DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 00FC3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Function 00FC3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 00FC71EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00FC3A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00FC3633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 00FC3778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Function 00FC39E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 00FC410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Function 00FE564D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Function 00FC69CA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260
COMMON

Function 00FC35B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59
registryCOMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre